{
  "template" : "packetbeat-*",
  "settings" : {
    "index.refresh_interval" : "5s",
    "analysis" : {
      "analyzer" : {
        "default" : {
          "type" : "standard",
          "stopwords" : "_none_"
        }
      }
    }
  },
  "mappings" : {
    "_default_" : {
       "_all" : {"enabled" : true},
       "dynamic_templates" : [ {
         "raw_fields" : {
           "match" : "*.raw",
           "match_mapping_type" : "string",
           "mapping" : {
                 "type": "string", 
                 "index" : "not_analyzed" 
           }
         }
       } ]
    }
  }
}

{
  "template" : "packetbeat-*",
  "settings" : {
    "index.refresh_interval" : "5s",
    "analysis" : {
      "analyzer" : {
        "default" : {
          "type" : "standard",
          "stopwords" : "_none_"
        }
      }
    }
  },
  "mappings" : {
    "_default_" : {
       "_all" : {"enabled" : true},
       "dynamic_templates" : [ {
         "raw_fields" : {
           "match" : "*.raw",
           "match_mapping_type" : "string",
           "mapping" : {
                 "type": "string",
                 "index" : "not_analyzed"
           }
         }
       }, {
        "server_fields": {
           "match": "*_server",
           "match_mapping_type" : "string",
           "mapping" : {
                 "type": "string",
                 "index" : "not_analyzed"
           }
        }
       }]
    }
  }
}

Disable tokenising of the src_server and dst_server.
Disable tokenising of the src_server and dst_server.

This is for better supporting server names containing dashes or
dots.
