update Elasticsearch mapping

.editorconfig

@@ -2,6 +2,10 @@
 indent_style = tab
 indent_size = 8
 
+[*.json]
+indent_style = space
+indent_size = 2
+
 [*.sql]
 indent_style = space
 indent_size = 2

README.md

@@ -45,16 +45,17 @@ Elaticsearch server in the following format:
 
 ```js
 {
-  "country_code": string,
-  "hostname":     string,
-  "object_type":  string,
-  "status_code":  int,
-  "@timestamp":   date // generated from `timestamp` pipeline
+  "country_code": keyword,
+  "hostname":     keyword,
+  "object_type":  keyword,
+  "status_code":  short,
+  "@timestamp":   date // generated from `@timestamp` pipeline
 }
 ```
 
-The index and `timestamp` pipeline are created automatically if `cdn-origin` has
-permission.
+The index and `@timestamp` pipeline are created automatically if `cdn-origin`
+has permission. Alternatively, the mapping and pipeline can be created by other
+means using the `.json` files in [metrics/](metrics).
 
 ### TODO
 

metrics/collector.go

@@ -13,6 +13,8 @@ import (
 	"gopkg.in/olivere/elastic.v5/config"
 )
 
+// mapping is the default mapping to use when creating the index if it doesn't exist. This JSON data is also maintained
+// in `./mapping.elasticsearch.json`.
 const mapping = `
 {
   "settings": {
@@ -20,16 +22,39 @@ const mapping = `
   },
 
   "mappings": {
-    "type": {
+    "request": {
       "properties": {
-        "timestamp": {
-          "type": "date"
+        "country_code": {
+          "type": "keyword",
+          "ignore_above": 2,
+          "index": true
+        },
+        "hostname": {
+          "type": "keyword",
+          "ignore_above": 30,
+          "index": true
+        },
+        "object_type": {
+          "type": "keyword",
+          "ignore_above": 30,
+          "index": true
+        },
+        "status_code": {
+          "type": "short",
+          "index": true
+        },
+
+        "@timestamp": {
+          "type": "date",
+          "index": true
         }
       }
     }
   }
 }`
 
+// The default `@timestamp` pipeline. Sets the `@timestamp` field to the ingest timestamp (date type). This JSON data is
+// also maintained in `./timestampPipeline.elasticsearch.json`.
 const timestampPipeline = `
 {
   "description": "Stores the ingest timestamp as a date field in the document.",

metrics/mapping.elasticsearch.json

+{
+  "settings": {
+    "number_of_shards": 1
+  },
+
+  "mappings": {
+    "request": {
+      "properties": {
+        "country_code": {
+          "type": "keyword",
+          "ignore_above": 2,
+          "index": true
+        },
+        "hostname": {
+          "type": "keyword",
+          "ignore_above": 30,
+          "index": true
+        },
+        "object_type": {
+          "type": "keyword",
+          "ignore_above": 30,
+          "index": true
+        },
+        "status_code": {
+          "type": "short",
+          "index": true
+        },
+
+        "@timestamp": {
+          "type": "date",
+          "index": true
+        }
+      }
+    }
+  }
+}

metrics/timestampPipeline.elasticsearch.json

+{
+  "description": "Stores the ingest timestamp as a date field in the document.",
+  "processors": [
+    {
+      "set": {
+        "field": "@timestamp",
+        "value": "{{_ingest.timestamp}}"
+      }
+    },
+    {
+      "date": {
+        "field": "@timestamp",
+        "target_field": "@timestamp",
+        "formats": ["EEE MMM d HH:mm:ss z yyyy"]
+      }
+    }
+  ]
+}