{
  "endgame-*": {
    "endgame": {
      "metadata": {
        "type": "keyword"
      },
      "event_subtype_full": "keyword"
    }
  },
  "winlogbeat-*": {
    "winlog.event_data.OriginalFileName": "keyword",
    "winlog.event_data.GrantedAccess": "keyword",
    "winlog.event_data.CallTrace": "keyword",
    "powershell.file.script_block_text": "text"
  },
  "filebeat-*": {
    "o365.audit.NewValue": "keyword"
  },
  "logs-endpoint.events.*": {
    "process.Ext.token.integrity_level_name": "keyword",
	  "process.parent.Ext.real.pid": "long"
  },
  "logs-windows.*": {
    "powershell.file.script_block_text": "text"
  }
}