update elasticsearch mappings

docker-compose-build.yml

@@ -0,0 +1,69 @@
+version: '2'
+
+services:
+  wazuh:
+    build: wazuh
+    hostname: wazuh-manager
+    restart: always
+    ports:
+      - "1514/udp:1514/udp"
+      - "1515:1515"
+      - "514/udp:514/udp"
+      - "55000:55000"
+    networks:
+        - docker_elk
+#    volumes:
+#      - my-path:/var/ossec/data
+#      - my-path:/etc/postfix
+    depends_on:
+      - elasticsearch
+  logstash:
+    build: logstash
+    hostname: logstash
+    restart: always
+    command: -f /etc/logstash/conf.d/
+#    volumes:
+#      - my-path:/etc/logstash/conf.d
+    links:
+     - kibana
+     - elasticsearch
+    ports:
+      - "5000:5000"
+    networks:
+        - docker_elk
+    depends_on:
+      - elasticsearch
+    environment:
+      - LS_HEAP_SIZE=2048m
+  elasticsearch:
+    image: elasticsearch:5.3.0
+    hostname: elasticsearch
+    restart: always
+    command: elasticsearch -E node.name="node-1" -E cluster.name="wazuh" -E network.host=0.0.0.0
+#    ports:
+#      - ""
+#      - ""
+    environment:
+      ES_JAVA_OPTS: "-Xms1g -Xmx1g"
+#    volumes:
+#      - my-path:/usr/share/elasticsearch/data
+    networks:
+        - docker_elk
+  kibana:
+    build: kibana
+    hostname: kibana
+    restart: always
+    ports:
+      - "5601:5601"
+    networks:
+        - docker_elk
+    depends_on:
+      - elasticsearch
+    entrypoint: sh wait-for-it.sh elasticsearch
+
+networks:
+  docker_elk:
+    driver: bridge
+    ipam:
+      config:
+      - subnet: 172.25.0.0/24

logstash/config/wazuh-elastic5-template.json

@@ -8,8 +8,8 @@
     "wazuh": {
       "dynamic_templates": [
         {
-          "notanalyzed": {
+          "string_as_keyword": {
-            "match": "*",
+            "match_mapping_type": "string",
             "mapping": {
               "type": "keyword",
               "doc_values": "true"