{
  "properties": {
    "source": {
      "properties": {
        "IP": {
          "type": "ip"
        }
      }
    },
    "threat_level": {
      "type": "keyword"
    }
  }
}