"settings" : "...", "mappings": { "syslog": "...", "http": "...", "gelf": { "dynamic_templates": [{ "ctxt": { "match": "ctxt_*", "match_mapping_type": "string", "mapping": { "type": "string", "index": "not_analyzed" } } }], "properties" : { "@timestamp" : { "type" : "date", "index" : "not_analyzed" }, "message" : { "type" : "string", "index" : "analyzed" }, "facility" : { "type" : "string", "index" : "not_analyzed" }, "type" : { "type" : "string", "index" : "not_analyzed" }, "ctxt_user_id" : { "type" : "string", "index" : "not_analyzed" } } } } }