You're viewing version 3.8 of the OpenSearch documentation. This version is no longer maintained. For the latest version, see the current documentation. For information about OpenSearch version maintenance, see Release Schedule and Maintenance Policy.
Mappings APIs
The following APIs can be used for a number of tasks related to mappings, from creating to getting and updating mappings.
Get mappings view
Returns a view of the fields contained in an index used as a log source.
Request body fields
The following fields are used to get field mappings.
| Field | Type | Description |
|---|---|---|
index_name | String | The name of the index used for log ingestion. |
rule_topic | String | The log type of the index. |
Example request
GET /_plugins/_security_analytics/mappings/view
{
"index_name": "windows",
"rule_topic": "windows"
}
Example response
{
"properties": {
"windows-event_data-CommandLine": {
"path": "CommandLine",
"type": "alias"
},
"event_uid": {
"path": "EventID",
"type": "alias"
}
},
"unmapped_index_fields": [
"windows-event_data-CommandLine",
"unmapped_HiveName",
"src_ip",
"sha1",
"processPath",
"CallerProcessName",
"CallTrace",
"AuthenticationPackageName",
"AuditSourceName",
"AuditPolicyChanges",
"AttributeValue",
"AttributeLDAPDisplayName",
"ApplicationPath",
"Application",
"AllowedToDelegateTo",
"Address",
"Action",
"AccountType",
"AccountName",
"Accesses",
"AccessMask",
"AccessList"
]
}
Create mappings
Creates field alias mappings for a specified index.
Example request
POST /_plugins/_security_analytics/mappings
{
"index_name": "windows",
"rule_topic": "windows",
"partial": true,
"alias_mappings": {
"properties": {
"event_uid": {
"type": "alias",
"path": "EventID"
}
}
}
}
Example response
{
"acknowledged": true
}
Get mappings
Retrieves field alias mappings for a specified index.
Path parameters
| Field | Type | Description |
|---|---|---|
index_name | String | The name of the index used for log ingestion. Required. |
Example request
GET /_plugins/_security_analytics/mappings?index_name=windows
Example response
{
"windows": {
"mappings": {
"properties": {
"windows-event_data-CommandLine": {
"type": "alias",
"path": "CommandLine"
},
"event_uid": {
"type": "alias",
"path": "EventID"
}
}
}
}
}
Update mappings
Updates the field alias mapping for a specified index.
Example request
PUT /_plugins/_security_analytics/mappings
{
"index_name": "windows",
"field": "CommandLine",
"alias": "windows-event_data-CommandLine"
}
Example response
{
"acknowledged": true
}