Skip to main content

Elastic Stack ECS Template

How to install the Elastic Common Schema (ECS) index template from SOC Prime Platform

Written by Andrew Vdovin

Overview

This guide describes how to install the Elastic Common Schema (ECS) index template from SOC Prime Platform.

About Index Templates

Index templates allow initializing new indices with predefined mappings and settings. For example, if you continuously index log data, you can define an index template so that all of these indices have the same number of shards and replicas. Templates are configured prior to index creation and template settings are used as a basis for creating the index. Changing a template will have no impact on the existing indices — to change the settings of a certain index, it should be re-indexed.

Templates include both settings and mappings and a simple template pattern that controls whether the template needs to be applied to a new index.

About Mapping

Mapping is the process of defining how a document and the fields it consists of are stored and indexed. Mappings are used to define the structure of fields in a document: which field should be full text or contain numbers, dates, geolocations, etc. Each field contains a data type that can be one of the following:

  • Simple type like text, keyword, date, long, double, boolean or ip

  • Type which supports the hierarchical nature of JSON, such as object or nested

  • Specific type like geo_point, geo_shape, or completion

It can be quite useful to index the same field in different ways for various purposes. For instance, a string field can be indexed as a text field for full-text search, and as a keyword field for sorting or aggregations.

As a result, for the content and search queries to work properly, certain index template must be predefined.

For example, to make the content for Elastic from the SOC Prime Platform work properly, in most cases you should use the predefined ECS index template.

Installing the ECS Index Template

The latest versions of the ECS index template can be installed from the Elastic Repo. To install the template, take the following steps:

  1. Log in to Kibana.

  2. To get to the console, select Management > Dev Tools on the left-hand side panel.

  3. Please copy and paste the template to the console.

  4. The command below creates a template named ecs_logs and applies it to any new index whose name matches the regular expression ecs-*:

    As you can see, the template describes all fields and their types, index patterns, mappings, and replication settings for relevant indices.

  5. You should get the following response:

  6. Check that the template has been loaded correctly. This command should return a response with the template body:

Verifying the Template's Successful Installation

Let's check that all settings and mappings from our template are assigned correctly to the new indices. For example, if you create an index named ecs_checkpoiTemplate's01-01, you should see that it has the mappings and settings from the main template:

Any additional indices that match this pattern (ecs_checkpoint-2020-01-02, ecs_checkpoint-2020-01-03) will inherit the same mappings and settings.

All documents that are placed in these indices will have the appropriate mapping and field types — aggregation, sorting, and searching will work correctly.

Did this answer your question?