{
  "template": {
    "mappings": {
      "_meta": {
        "version": "1.0.0",
        "catalog": "observability",
        "type": "logs",
        "component": "cloudtrail"
      },
      "properties": {
        "aws": {
          "type": "object",
          "properties": {
            "cloudtrail": {
              "type": "object",
              "properties": {
                "eventVersion": {
                  "type": "keyword"
                },
                "eventName": {
                  "type": "keyword"
                },
                "eventSource": {
                  "type": "keyword"
                },
                "eventTime": {
                  "type": "date"
                },
                "eventType": {
                  "type": "keyword"
                },
                "eventCategory": {
                  "type": "keyword"
                },
                "sourceIPAddress": {
                  "type": "keyword"
                },
                "apiVersion": {
                  "type": "keyword"
                },
                "awsRegion": {
                  "type": "keyword"
                },
                "requestParameter": {
                  "properties": {
                    "endTime": {
                      "type": "date"
                    },
                    "startTime": {
                      "type": "date"
                    }
                  }
                },
                "responseElements": {
                  "properties": {
                    "version": {
                      "type": "keyword"
                    },
                    "lastModified": {
                      "type": "date"
                    }
                  }
                },
                "userIdentity": {
                  "properties": {
                    "sessionContext": {
                      "properties": {
                        "attributes": {
                          "properties": {
                            "creationDate": {
                              "type": "date"
                            }
                          }
                        }
                      }
                    }
                  }
                }
              }
            }
          }
        }
      }
    }
  }
}