diff --git a/USAGE.md b/USAGE.md index cb0c49bf27..9d478dfa3e 100644 --- a/USAGE.md +++ b/USAGE.md @@ -15,6 +15,7 @@ relevant artifacts for their unique set of data sources. ## Table of Contents +- [TLDR Example](#tldr-example) - [Terminology](#terminology) - [Setup and Install](#setup-and-install) * [Prerequisites](#prerequisites) @@ -33,6 +34,34 @@ relevant artifacts for their unique set of data sources. + [Strict Mode](#strict-mode) + [Intermediate-Only](#intermediate-only) +## TLDR Example + +Before diving into the details, here's a complete example that: + +* takes ECS 1.6 fields +* selects only the subset of fields relevant to the project's use case +* includes custom fields relevant to the project +* outputs the resulting artifacts to a project directory +* replace the ECS project's sample template settings and + mapping settings with ones appropriate to the project + +```bash +python scripts/generator.py --ref v1.6.0 \ + --subset ../my-project/fields/subset.yml \ + --include ../my-project/fields/custom/ \ + --out ../my-project/ \ + --template-settings ../my-project/fields/template-settings.json \ + --mapping-settings ../my-project/fields/mapping-settings.json +``` + +The generated Elasticsearch template would be output at + +`my-project/generated/elasticsearch/7/template.json` + +If this sounds interesting, read on to learn all about each of these settings. + +See [usage-example/](usage-example/) for a complete example with source files. + ## Terminology | Term | Definition | @@ -80,6 +109,9 @@ $ make ve All necessary Python dependencies will also be installed with `pip`. +You can use the Python and dependencies from this isolated virtual environment +by using `build/ve/bin/python` instead of `python` in the examples shown here. + #### Option 2: Install dependencies via pip Install dependencies using `pip` (An active `virutalenv` is recommended): @@ -255,19 +287,19 @@ The `--template-settings` argument defines [index level settings](https://www.el ```json { - "index_patterns": ["ecs-*"], - "order": 1, - "settings": { - "index": { - "mapping": { - "total_fields": { - "limit": 10000 - } - }, - "refresh_interval": "10s" + "index_patterns": ["mylog-*"], + "order": 1, + "settings": { + "index": { + "mapping": { + "total_fields": { + "limit": 10000 } - }, - "mappings": {} + }, + "refresh_interval": "1s" + } + }, + "mappings": {} } ``` @@ -275,20 +307,20 @@ The `--template-settings` argument defines [index level settings](https://www.el ```json { - "_meta": { - "version": "1.5.0" - }, + "_meta": { + "version": "1.5.0" + }, "date_detection": false, "dynamic_templates": [ - { - "strings_as_keyword": { - "mapping": { - "ignore_above": 1024, - "type": "keyword" - }, - "match_mapping_type": "string" - } + { + "strings_as_keyword": { + "mapping": { + "ignore_above": 1024, + "type": "keyword" + }, + "match_mapping_type": "string" } + } ], "properties": {} } diff --git a/scripts/generator.py b/scripts/generator.py index b6dcf05db9..936731c0ef 100644 --- a/scripts/generator.py +++ b/scripts/generator.py @@ -35,7 +35,6 @@ def main(): default_dirs = True ecs_helpers.make_dirs(out_dir) - ecs_helpers.make_dirs(docs_dir) # To debug issues in the gradual building up of the nested structure, insert # statements like this after any step of interest. @@ -58,6 +57,7 @@ def main(): if args.include or args.subset: exit() + ecs_helpers.make_dirs(docs_dir) asciidoc_fields.generate(nested, ecs_version, docs_dir) diff --git a/usage-example/README.md b/usage-example/README.md new file mode 100644 index 0000000000..18eb203123 --- /dev/null +++ b/usage-example/README.md @@ -0,0 +1,19 @@ +# Concrete usage example + +This directory contains a full example of using the ECS tools to manage your +project's index template (or your Beats field definitions) with the ECS tools. + +The `fields` directory contains files managed by the sample project, whereas +the `generated` directory contains the files generated by running the following +command from the root of the ECS repository: + +```bash +python scripts/generator.py --ref v1.6.0 \ + --subset usage-example/fields/subset.yml \ + --include usage-example/fields/custom/ \ + --out usage-example/ \ + --template-settings usage-example/fields/template-settings.json \ + --mapping-settings usage-example/fields/mapping-settings.json +``` + +Refer back to [USAGE.md](../USAGE.md) for the documentation on each of these flags. diff --git a/usage-example/fields/custom/acme.yml b/usage-example/fields/custom/acme.yml new file mode 100644 index 0000000000..4259faa321 --- /dev/null +++ b/usage-example/fields/custom/acme.yml @@ -0,0 +1,11 @@ +- name: acme + title: ACME + description: > + Acme Inc. custom fields + type: group + fields: + - name: account.id + type: keyword + level: custom + description: > + Customer account for this activity. diff --git a/usage-example/fields/mapping-settings.json b/usage-example/fields/mapping-settings.json new file mode 100644 index 0000000000..213c50bcc0 --- /dev/null +++ b/usage-example/fields/mapping-settings.json @@ -0,0 +1,20 @@ +{ + "_meta": { + "version": "1.6.0" + }, + "date_detection": false, + "dynamic_templates": [ + { + "strings_as_keyword": { + "mapping": { + "type": "keyword", + "ignore_above": 1024, + "fields": { + "text": { "type": "text", "norms" : false } + } + }, + "match_mapping_type": "string" + } + } + ] +} diff --git a/usage-example/fields/subset.yml b/usage-example/fields/subset.yml new file mode 100644 index 0000000000..f263492ae6 --- /dev/null +++ b/usage-example/fields/subset.yml @@ -0,0 +1,45 @@ +--- +name: web_logs +fields: + # Project's custom fields + acme: + fields: "*" + + # ECS basic fields + base: + fields: "*" + ecs: + fields: "*" + event: + fields: "*" + + # web log specific fields + user_agent: + fields: "*" + url: + fields: "*" + http: + fields: "*" + user: # mapping url.username to user.name + fields: + "name": {} + + # Network fields to capture IPs, geo and stuff + network: + fields: "*" + related: + fields: + ip: {} + user: {} + source: + fields: "*" + destination: + fields: "*" + client: + fields: "*" + server: + fields: "*" + + # pipeline meta-data + agent: + fields: "*" diff --git a/usage-example/fields/template-settings.json b/usage-example/fields/template-settings.json new file mode 100644 index 0000000000..af6683dc5a --- /dev/null +++ b/usage-example/fields/template-settings.json @@ -0,0 +1,16 @@ +{ + "index_patterns": ["acme-weblogs-*"], + "order": 1, + "settings": { + "index": { + "codec" : "best_compression", + "mapping": { + "total_fields": { + "limit": 1000 + } + }, + "refresh_interval": "2s" + } + } +} + diff --git a/usage-example/generated/beats/fields.ecs.yml b/usage-example/generated/beats/fields.ecs.yml new file mode 100644 index 0000000000..24e320ec4b --- /dev/null +++ b/usage-example/generated/beats/fields.ecs.yml @@ -0,0 +1,1872 @@ +# WARNING! Do not edit this file directly, it was generated by the ECS project, +# based on ECS version 1.6.0. +# Please visit https://github.com/elastic/ecs to suggest changes to ECS fields. + +- key: ecs + title: ECS + description: ECS Fields. + fields: + - name: '@timestamp' + level: core + required: true + type: date + description: 'Date/time when the event originated. + + This is the date/time extracted from the event, typically representing when + the event was generated by the source. + + If the event source has no original timestamp, this value is typically populated + by the first time the event was received by the pipeline. + + Required field for all events.' + example: '2016-05-23T08:05:34.853Z' + - name: labels + level: core + type: object + object_type: keyword + description: 'Custom key/value pairs. + + Can be used to add meta information to events. Should not contain nested objects. + All values are stored as keyword. + + Example: `docker` and `k8s` labels.' + example: '{"application": "foo-bar", "env": "production"}' + - name: message + level: core + type: text + description: 'For log events the message field contains the log message, optimized + for viewing in a log viewer. + + For structured logs without an original message field, other fields can be concatenated + to form a human-readable summary of the event. + + If multiple messages exist, they can be combined into one message.' + example: Hello World + - name: tags + level: core + type: keyword + ignore_above: 1024 + description: List of keywords used to tag each event. + example: '["production", "env2"]' + - name: acme + title: ACME + group: 2 + description: Acme Inc. custom fields + type: group + fields: + - name: account.id + level: custom + type: keyword + ignore_above: 1024 + description: Customer account for this activity. + default_field: false + - name: agent + title: Agent + group: 2 + description: 'The agent fields contain the data about the software entity, if + any, that collects, detects, or observes events on a host, or takes measurements + on a host. + + Examples include Beats. Agents may also run on observers. ECS agent.* fields + shall be populated with details of the agent running on the host or observer + where the event happened or the measurement was taken.' + footnote: 'Examples: In the case of Beats for logs, the agent.name is filebeat. + For APM, it is the agent running in the app/service. The agent information does + not change if data is sent through queuing systems like Kafka, Redis, or processing + systems such as Logstash or APM Server.' + type: group + fields: + - name: build.original + level: core + type: keyword + ignore_above: 1024 + description: 'Extended build information for the agent. + + This field is intended to contain any build information that a data source + may provide, no specific formatting is required.' + example: metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c + built 2020-02-05 23:10:10 +0000 UTC] + default_field: false + - name: ephemeral_id + level: extended + type: keyword + ignore_above: 1024 + description: 'Ephemeral identifier of this agent (if one exists). + + This id normally changes across restarts, but `agent.id` does not.' + example: 8a4f500f + - name: id + level: core + type: keyword + ignore_above: 1024 + description: 'Unique identifier of this agent (if one exists). + + Example: For Beats this would be beat.id.' + example: 8a4f500d + - name: name + level: core + type: keyword + ignore_above: 1024 + description: 'Custom name of the agent. + + This is a name that can be given to an agent. This can be helpful if for example + two Filebeat instances are running on the same host but a human readable separation + is needed on which Filebeat instance data is coming from. + + If no name is given, the name is often left empty.' + example: foo + - name: type + level: core + type: keyword + ignore_above: 1024 + description: 'Type of the agent. + + The agent type always stays the same and should be given by the agent used. + In case of Filebeat the agent would always be Filebeat also if two Filebeat + instances are run on the same machine.' + example: filebeat + - name: version + level: core + type: keyword + ignore_above: 1024 + description: Version of the agent. + example: 6.0.0-rc2 + - name: client + title: Client + group: 2 + description: 'A client is defined as the initiator of a network connection for + events regarding sessions, connections, or bidirectional flow records. + + For TCP events, the client is the initiator of the TCP connection that sends + the SYN packet(s). For other protocols, the client is generally the initiator + or requestor in the network transaction. Some systems use the term "originator" + to refer the client in TCP connections. The client fields describe details about + the system acting as the client in the network event. Client fields are usually + populated in conjunction with server fields. Client fields are generally not + populated for packet-level events. + + Client / server representations can add semantic context to an exchange, which + is helpful to visualize the data in certain situations. If your context falls + in that category, you should still ensure that source and destination are filled + appropriately.' + type: group + fields: + - name: address + level: extended + type: keyword + ignore_above: 1024 + description: 'Some event client addresses are defined ambiguously. The event + will sometimes list an IP, a domain or a unix socket. You should always store + the raw address in the `.address` field. + + Then it should be duplicated to `.ip` or `.domain`, depending on which one + it is.' + - name: as.number + level: extended + type: long + description: Unique number allocated to the autonomous system. The autonomous + system number (ASN) uniquely identifies each network on the Internet. + example: 15169 + - name: as.organization.name + level: extended + type: keyword + ignore_above: 1024 + multi_fields: + - name: text + type: text + norms: false + default_field: false + description: Organization name. + example: Google LLC + - name: bytes + level: core + type: long + format: bytes + description: Bytes sent from the client to the server. + example: 184 + - name: domain + level: core + type: keyword + ignore_above: 1024 + description: Client domain. + - name: geo.city_name + level: core + type: keyword + ignore_above: 1024 + description: City name. + example: Montreal + - name: geo.continent_name + level: core + type: keyword + ignore_above: 1024 + description: Name of the continent. + example: North America + - name: geo.country_iso_code + level: core + type: keyword + ignore_above: 1024 + description: Country ISO code. + example: CA + - name: geo.country_name + level: core + type: keyword + ignore_above: 1024 + description: Country name. + example: Canada + - name: geo.location + level: core + type: geo_point + description: Longitude and latitude. + example: '{ "lon": -73.614830, "lat": 45.505918 }' + - name: geo.name + level: extended + type: keyword + ignore_above: 1024 + description: 'User-defined description of a location, at the level of granularity + they care about. + + Could be the name of their data centers, the floor number, if this describes + a local physical entity, city names. + + Not typically used in automated geolocation.' + example: boston-dc + - name: geo.region_iso_code + level: core + type: keyword + ignore_above: 1024 + description: Region ISO code. + example: CA-QC + - name: geo.region_name + level: core + type: keyword + ignore_above: 1024 + description: Region name. + example: Quebec + - name: ip + level: core + type: ip + description: IP address of the client (IPv4 or IPv6). + - name: mac + level: core + type: keyword + ignore_above: 1024 + description: MAC address of the client. + - name: nat.ip + level: extended + type: ip + description: 'Translated IP of source based NAT sessions (e.g. internal client + to internet). + + Typically connections traversing load balancers, firewalls, or routers.' + - name: nat.port + level: extended + type: long + format: string + description: 'Translated port of source based NAT sessions (e.g. internal client + to internet). + + Typically connections traversing load balancers, firewalls, or routers.' + - name: packets + level: core + type: long + description: Packets sent from the client to the server. + example: 12 + - name: port + level: core + type: long + format: string + description: Port of the client. + - name: registered_domain + level: extended + type: keyword + ignore_above: 1024 + description: 'The highest registered client domain, stripped of the subdomain. + + For example, the registered domain for "foo.example.com" is "example.com". + + This value can be determined precisely with a list like the public suffix + list (http://publicsuffix.org). Trying to approximate this by simply taking + the last two labels will not work well for TLDs such as "co.uk".' + example: example.com + - name: top_level_domain + level: extended + type: keyword + ignore_above: 1024 + description: 'The effective top level domain (eTLD), also known as the domain + suffix, is the last part of the domain name. For example, the top level domain + for example.com is "com". + + This value can be determined precisely with a list like the public suffix + list (http://publicsuffix.org). Trying to approximate this by simply taking + the last label will not work well for effective TLDs such as "co.uk".' + example: co.uk + - name: user.domain + level: extended + type: keyword + ignore_above: 1024 + description: 'Name of the directory the user is a member of. + + For example, an LDAP or Active Directory domain name.' + - name: user.email + level: extended + type: keyword + ignore_above: 1024 + description: User email address. + - name: user.full_name + level: extended + type: keyword + ignore_above: 1024 + multi_fields: + - name: text + type: text + norms: false + default_field: false + description: User's full name, if available. + example: Albert Einstein + - name: user.group.domain + level: extended + type: keyword + ignore_above: 1024 + description: 'Name of the directory the group is a member of. + + For example, an LDAP or Active Directory domain name.' + - name: user.group.id + level: extended + type: keyword + ignore_above: 1024 + description: Unique identifier for the group on the system/platform. + - name: user.group.name + level: extended + type: keyword + ignore_above: 1024 + description: Name of the group. + - name: user.hash + level: extended + type: keyword + ignore_above: 1024 + description: 'Unique user hash to correlate information for a user in anonymized + form. + + Useful if `user.id` or `user.name` contain confidential information and cannot + be used.' + - name: user.id + level: core + type: keyword + ignore_above: 1024 + description: Unique identifier of the user. + - name: user.name + level: core + type: keyword + ignore_above: 1024 + multi_fields: + - name: text + type: text + norms: false + default_field: false + description: Short name or login of the user. + example: albert + - name: user.roles + level: extended + type: keyword + ignore_above: 1024 + description: Array of user roles at the time of the event. + example: '["kibana_admin", "reporting_user"]' + default_field: false + - name: destination + title: Destination + group: 2 + description: 'Destination fields describe details about the destination of a packet/event. + + Destination fields are usually populated in conjunction with source fields.' + type: group + fields: + - name: address + level: extended + type: keyword + ignore_above: 1024 + description: 'Some event destination addresses are defined ambiguously. The + event will sometimes list an IP, a domain or a unix socket. You should always + store the raw address in the `.address` field. + + Then it should be duplicated to `.ip` or `.domain`, depending on which one + it is.' + - name: as.number + level: extended + type: long + description: Unique number allocated to the autonomous system. The autonomous + system number (ASN) uniquely identifies each network on the Internet. + example: 15169 + - name: as.organization.name + level: extended + type: keyword + ignore_above: 1024 + multi_fields: + - name: text + type: text + norms: false + default_field: false + description: Organization name. + example: Google LLC + - name: bytes + level: core + type: long + format: bytes + description: Bytes sent from the destination to the source. + example: 184 + - name: domain + level: core + type: keyword + ignore_above: 1024 + description: Destination domain. + - name: geo.city_name + level: core + type: keyword + ignore_above: 1024 + description: City name. + example: Montreal + - name: geo.continent_name + level: core + type: keyword + ignore_above: 1024 + description: Name of the continent. + example: North America + - name: geo.country_iso_code + level: core + type: keyword + ignore_above: 1024 + description: Country ISO code. + example: CA + - name: geo.country_name + level: core + type: keyword + ignore_above: 1024 + description: Country name. + example: Canada + - name: geo.location + level: core + type: geo_point + description: Longitude and latitude. + example: '{ "lon": -73.614830, "lat": 45.505918 }' + - name: geo.name + level: extended + type: keyword + ignore_above: 1024 + description: 'User-defined description of a location, at the level of granularity + they care about. + + Could be the name of their data centers, the floor number, if this describes + a local physical entity, city names. + + Not typically used in automated geolocation.' + example: boston-dc + - name: geo.region_iso_code + level: core + type: keyword + ignore_above: 1024 + description: Region ISO code. + example: CA-QC + - name: geo.region_name + level: core + type: keyword + ignore_above: 1024 + description: Region name. + example: Quebec + - name: ip + level: core + type: ip + description: IP address of the destination (IPv4 or IPv6). + - name: mac + level: core + type: keyword + ignore_above: 1024 + description: MAC address of the destination. + - name: nat.ip + level: extended + type: ip + description: 'Translated ip of destination based NAT sessions (e.g. internet + to private DMZ) + + Typically used with load balancers, firewalls, or routers.' + - name: nat.port + level: extended + type: long + format: string + description: 'Port the source session is translated to by NAT Device. + + Typically used with load balancers, firewalls, or routers.' + - name: packets + level: core + type: long + description: Packets sent from the destination to the source. + example: 12 + - name: port + level: core + type: long + format: string + description: Port of the destination. + - name: registered_domain + level: extended + type: keyword + ignore_above: 1024 + description: 'The highest registered destination domain, stripped of the subdomain. + + For example, the registered domain for "foo.example.com" is "example.com". + + This value can be determined precisely with a list like the public suffix + list (http://publicsuffix.org). Trying to approximate this by simply taking + the last two labels will not work well for TLDs such as "co.uk".' + example: example.com + - name: top_level_domain + level: extended + type: keyword + ignore_above: 1024 + description: 'The effective top level domain (eTLD), also known as the domain + suffix, is the last part of the domain name. For example, the top level domain + for example.com is "com". + + This value can be determined precisely with a list like the public suffix + list (http://publicsuffix.org). Trying to approximate this by simply taking + the last label will not work well for effective TLDs such as "co.uk".' + example: co.uk + - name: user.domain + level: extended + type: keyword + ignore_above: 1024 + description: 'Name of the directory the user is a member of. + + For example, an LDAP or Active Directory domain name.' + - name: user.email + level: extended + type: keyword + ignore_above: 1024 + description: User email address. + - name: user.full_name + level: extended + type: keyword + ignore_above: 1024 + multi_fields: + - name: text + type: text + norms: false + default_field: false + description: User's full name, if available. + example: Albert Einstein + - name: user.group.domain + level: extended + type: keyword + ignore_above: 1024 + description: 'Name of the directory the group is a member of. + + For example, an LDAP or Active Directory domain name.' + - name: user.group.id + level: extended + type: keyword + ignore_above: 1024 + description: Unique identifier for the group on the system/platform. + - name: user.group.name + level: extended + type: keyword + ignore_above: 1024 + description: Name of the group. + - name: user.hash + level: extended + type: keyword + ignore_above: 1024 + description: 'Unique user hash to correlate information for a user in anonymized + form. + + Useful if `user.id` or `user.name` contain confidential information and cannot + be used.' + - name: user.id + level: core + type: keyword + ignore_above: 1024 + description: Unique identifier of the user. + - name: user.name + level: core + type: keyword + ignore_above: 1024 + multi_fields: + - name: text + type: text + norms: false + default_field: false + description: Short name or login of the user. + example: albert + - name: user.roles + level: extended + type: keyword + ignore_above: 1024 + description: Array of user roles at the time of the event. + example: '["kibana_admin", "reporting_user"]' + default_field: false + - name: ecs + title: ECS + group: 2 + description: Meta-information specific to ECS. + type: group + fields: + - name: version + level: core + required: true + type: keyword + ignore_above: 1024 + description: 'ECS version this event conforms to. `ecs.version` is a required + field and must exist in all events. + + When querying across multiple indices -- which may conform to slightly different + ECS versions -- this field lets integrations adjust to the schema version + of the events.' + example: 1.0.0 + - name: event + title: Event + group: 2 + description: 'The event fields are used for context information about the log + or metric event itself. + + A log is defined as an event containing details of something that happened. + Log events must include the time at which the thing happened. Examples of log + events include a process starting on a host, a network packet being sent from + a source to a destination, or a network connection between a client and a server + being initiated or closed. A metric is defined as an event containing one or + more numerical measurements and the time at which the measurement was taken. + Examples of metric events include memory pressure measured on a host and device + temperature. See the `event.kind` definition in this section for additional + details about metric and state events.' + type: group + fields: + - name: action + level: core + type: keyword + ignore_above: 1024 + description: 'The action captured by the event. + + This describes the information in the event. It is more specific than `event.category`. + Examples are `group-add`, `process-started`, `file-created`. The value is + normally defined by the implementer.' + example: user-password-change + - name: category + level: core + type: keyword + ignore_above: 1024 + description: 'This is one of four ECS Categorization Fields, and indicates the + second level in the ECS category hierarchy. + + `event.category` represents the "big buckets" of ECS categories. For example, + filtering on `event.category:process` yields all events relating to process + activity. This field is closely related to `event.type`, which is used as + a subcategory. + + This field is an array. This will allow proper categorization of some events + that fall in multiple categories.' + example: authentication + - name: code + level: extended + type: keyword + ignore_above: 1024 + description: 'Identification code for this event, if one exists. + + Some event sources use event codes to identify messages unambiguously, regardless + of message language or wording adjustments over time. An example of this is + the Windows Event ID.' + example: 4648 + - name: created + level: core + type: date + description: 'event.created contains the date/time when the event was first + read by an agent, or by your pipeline. + + This field is distinct from @timestamp in that @timestamp typically contain + the time extracted from the original event. + + In most situations, these two timestamps will be slightly different. The difference + can be used to calculate the delay between your source generating an event, + and the time when your agent first processed it. This can be used to monitor + your agent''s or pipeline''s ability to keep up with your event source. + + In case the two timestamps are identical, @timestamp should be used.' + example: '2016-05-23T08:05:34.857Z' + - name: dataset + level: core + type: keyword + ignore_above: 1024 + description: 'Name of the dataset. + + If an event source publishes more than one type of log or events (e.g. access + log, error log), the dataset is used to specify which one the event comes + from. + + It''s recommended but not required to start the dataset name with the module + name, followed by a dot, then the dataset name.' + example: apache.access + - name: duration + level: core + type: long + format: duration + input_format: nanoseconds + output_format: asMilliseconds + output_precision: 1 + description: 'Duration of the event in nanoseconds. + + If event.start and event.end are known this value should be the difference + between the end and start time.' + - name: end + level: extended + type: date + description: event.end contains the date when the event ended or when the activity + was last observed. + - name: hash + level: extended + type: keyword + ignore_above: 1024 + description: Hash (perhaps logstash fingerprint) of raw field to be able to + demonstrate log integrity. + example: 123456789012345678901234567890ABCD + - name: id + level: core + type: keyword + ignore_above: 1024 + description: Unique ID to describe the event. + example: 8a4f500d + - name: ingested + level: core + type: date + description: 'Timestamp when an event arrived in the central data store. + + This is different from `@timestamp`, which is when the event originally occurred. It''s + also different from `event.created`, which is meant to capture the first time + an agent saw the event. + + In normal conditions, assuming no tampering, the timestamps should chronologically + look like this: `@timestamp` < `event.created` < `event.ingested`.' + example: '2016-05-23T08:05:35.101Z' + default_field: false + - name: kind + level: core + type: keyword + ignore_above: 1024 + description: 'This is one of four ECS Categorization Fields, and indicates the + highest level in the ECS category hierarchy. + + `event.kind` gives high-level information about what type of information the + event contains, without being specific to the contents of the event. For example, + values of this field distinguish alert events from metric events. + + The value of this field can be used to inform how these kinds of events should + be handled. They may warrant different retention, different access control, + it may also help understand whether the data coming in at a regular interval + or not.' + example: alert + - name: module + level: core + type: keyword + ignore_above: 1024 + description: 'Name of the module this data is coming from. + + If your monitoring agent supports the concept of modules or plugins to process + events of a given source (e.g. Apache logs), `event.module` should contain + the name of this module.' + example: apache + - name: original + level: core + type: keyword + ignore_above: 1024 + description: 'Raw text message of entire event. Used to demonstrate log integrity. + + This field is not indexed and doc_values are disabled. It cannot be searched, + but it can be retrieved from `_source`.' + example: Sep 19 08:26:10 host CEF:0|Security| threatmanager|1.0|100| + worm successfully stopped|10|src=10.0.0.1 dst=2.1.2.2spt=1232 + index: false + - name: outcome + level: core + type: keyword + ignore_above: 1024 + description: 'This is one of four ECS Categorization Fields, and indicates the + lowest level in the ECS category hierarchy. + + `event.outcome` simply denotes whether the event represents a success or a + failure from the perspective of the entity that produced the event. + + Note that when a single transaction is described in multiple events, each + event may populate different values of `event.outcome`, according to their + perspective. + + Also note that in the case of a compound event (a single event that contains + multiple logical events), this field should be populated with the value that + best captures the overall success or failure from the perspective of the event + producer. + + Further note that not all events will have an associated outcome. For example, + this field is generally not populated for metric events, events with `event.type:info`, + or any events for which an outcome does not make logical sense.' + example: success + - name: provider + level: extended + type: keyword + ignore_above: 1024 + description: 'Source of the event. + + Event transports such as Syslog or the Windows Event Log typically mention + the source of an event. It can be the name of the software that generated + the event (e.g. Sysmon, httpd), or of a subsystem of the operating system + (kernel, Microsoft-Windows-Security-Auditing).' + example: kernel + - name: reason + level: extended + type: keyword + ignore_above: 1024 + description: 'Reason why this event happened, according to the source. + + This describes the why of a particular action or outcome captured in the event. + Where `event.action` captures the action from the event, `event.reason` describes + why that action was taken. For example, a web proxy with an `event.action` + which denied the request may also populate `event.reason` with the reason + why (e.g. `blocked site`).' + example: Terminated an unexpected process + default_field: false + - name: reference + level: extended + type: keyword + ignore_above: 1024 + description: 'Reference URL linking to additional information about this event. + + This URL links to a static definition of the this event. Alert events, indicated + by `event.kind:alert`, are a common use case for this field.' + example: https://system.example.com/event/#0001234 + default_field: false + - name: risk_score + level: core + type: float + description: Risk score or priority of the event (e.g. security solutions). + Use your system's original value here. + - name: risk_score_norm + level: extended + type: float + description: 'Normalized risk score or priority of the event, on a scale of + 0 to 100. + + This is mainly useful if you use more than one system that assigns risk scores, + and you want to see a normalized value across all systems.' + - name: sequence + level: extended + type: long + format: string + description: 'Sequence number of the event. + + The sequence number is a value published by some event sources, to make the + exact ordering of events unambiguous, regardless of the timestamp precision.' + - name: severity + level: core + type: long + format: string + description: 'The numeric severity of the event according to your event source. + + What the different severity values mean can be different between sources and + use cases. It''s up to the implementer to make sure severities are consistent + across events from the same source. + + The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` + is meant to represent the severity according to the event source (e.g. firewall, + IDS). If the event source does not publish its own severity, you may optionally + copy the `log.syslog.severity.code` to `event.severity`.' + example: 7 + - name: start + level: extended + type: date + description: event.start contains the date when the event started or when the + activity was first observed. + - name: timezone + level: extended + type: keyword + ignore_above: 1024 + description: 'This field should be populated when the event''s timestamp does + not include timezone information already (e.g. default Syslog timestamps). + It''s optional otherwise. + + Acceptable timezone formats are: a canonical ID (e.g. "Europe/Amsterdam"), + abbreviated (e.g. "EST") or an HH:mm differential (e.g. "-05:00").' + - name: type + level: core + type: keyword + ignore_above: 1024 + description: 'This is one of four ECS Categorization Fields, and indicates the + third level in the ECS category hierarchy. + + `event.type` represents a categorization "sub-bucket" that, when used along + with the `event.category` field values, enables filtering events down to a + level appropriate for single visualization. + + This field is an array. This will allow proper categorization of some events + that fall in multiple event types.' + - name: url + level: extended + type: keyword + ignore_above: 1024 + description: 'URL linking to an external system to continue investigation of + this event. + + This URL links to another system where in-depth investigation of the specific + occurrence of this event can take place. Alert events, indicated by `event.kind:alert`, + are a common use case for this field.' + example: https://mysystem.example.com/alert/5271dedb-f5b0-4218-87f0-4ac4870a38fe + default_field: false + - name: http + title: HTTP + group: 2 + description: Fields related to HTTP activity. Use the `url` field set to store + the url of the request. + type: group + fields: + - name: request.body.bytes + level: extended + type: long + format: bytes + description: Size in bytes of the request body. + example: 887 + - name: request.body.content + level: extended + type: keyword + ignore_above: 1024 + multi_fields: + - name: text + type: text + norms: false + default_field: false + description: The full HTTP request body. + example: Hello world + - name: request.bytes + level: extended + type: long + format: bytes + description: Total size in bytes of the request (body and headers). + example: 1437 + - name: request.method + level: extended + type: keyword + ignore_above: 1024 + description: 'HTTP request method. + + Prior to ECS 1.6.0 the following guidance was provided: + + "The field value must be normalized to lowercase for querying." + + As of ECS 1.6.0, the guidance is deprecated because the original case of the + method may be useful in anomaly detection. Original case will be mandated + in ECS 2.0.0' + example: GET, POST, PUT, PoST + - name: request.referrer + level: extended + type: keyword + ignore_above: 1024 + description: Referrer for this HTTP request. + example: https://blog.example.com/ + - name: response.body.bytes + level: extended + type: long + format: bytes + description: Size in bytes of the response body. + example: 887 + - name: response.body.content + level: extended + type: keyword + ignore_above: 1024 + multi_fields: + - name: text + type: text + norms: false + default_field: false + description: The full HTTP response body. + example: Hello world + - name: response.bytes + level: extended + type: long + format: bytes + description: Total size in bytes of the response (body and headers). + example: 1437 + - name: response.status_code + level: extended + type: long + format: string + description: HTTP response status code. + example: 404 + - name: version + level: extended + type: keyword + ignore_above: 1024 + description: HTTP version. + example: 1.1 + - name: network + title: Network + group: 2 + description: 'The network is defined as the communication path over which a host + or network event happens. + + The network.* fields should be populated with details about the network activity + associated with an event.' + type: group + fields: + - name: application + level: extended + type: keyword + ignore_above: 1024 + description: 'A name given to an application level protocol. This can be arbitrarily + assigned for things like microservices, but also apply to things like skype, + icq, facebook, twitter. This would be used in situations where the vendor + or service can be decoded such as from the source/dest IP owners, ports, or + wire format. + + The field value must be normalized to lowercase for querying. See the documentation + section "Implementing ECS".' + example: aim + - name: bytes + level: core + type: long + format: bytes + description: 'Total bytes transferred in both directions. + + If `source.bytes` and `destination.bytes` are known, `network.bytes` is their + sum.' + example: 368 + - name: community_id + level: extended + type: keyword + ignore_above: 1024 + description: 'A hash of source and destination IPs and ports, as well as the + protocol used in a communication. This is a tool-agnostic standard to identify + flows. + + Learn more at https://github.com/corelight/community-id-spec.' + example: 1:hO+sN4H+MG5MY/8hIrXPqc4ZQz0= + - name: direction + level: core + type: keyword + ignore_above: 1024 + description: "Direction of the network traffic.\nRecommended values are:\n \ + \ * inbound\n * outbound\n * internal\n * external\n * unknown\n\nWhen\ + \ mapping events from a host-based monitoring context, populate this field\ + \ from the host's point of view.\nWhen mapping events from a network or perimeter-based\ + \ monitoring context, populate this field from the point of view of your network\ + \ perimeter." + example: inbound + - name: forwarded_ip + level: core + type: ip + description: Host IP address when the source IP address is the proxy. + example: 192.1.1.2 + - name: iana_number + level: extended + type: keyword + ignore_above: 1024 + description: IANA Protocol Number (https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml). + Standardized list of protocols. This aligns well with NetFlow and sFlow related + logs which use the IANA Protocol Number. + example: 6 + - name: inner + level: extended + type: object + description: Network.inner fields are added in addition to network.vlan fields + to describe the innermost VLAN when q-in-q VLAN tagging is present. Allowed + fields include vlan.id and vlan.name. Inner vlan fields are typically used + when sending traffic with multiple 802.1q encapsulations to a network sensor + (e.g. Zeek, Wireshark.) + default_field: false + - name: inner.vlan.id + level: extended + type: keyword + ignore_above: 1024 + description: VLAN ID as reported by the observer. + example: 10 + default_field: false + - name: inner.vlan.name + level: extended + type: keyword + ignore_above: 1024 + description: Optional VLAN name as reported by the observer. + example: outside + default_field: false + - name: name + level: extended + type: keyword + ignore_above: 1024 + description: Name given by operators to sections of their network. + example: Guest Wifi + - name: packets + level: core + type: long + description: 'Total packets transferred in both directions. + + If `source.packets` and `destination.packets` are known, `network.packets` + is their sum.' + example: 24 + - name: protocol + level: core + type: keyword + ignore_above: 1024 + description: 'L7 Network protocol name. ex. http, lumberjack, transport protocol. + + The field value must be normalized to lowercase for querying. See the documentation + section "Implementing ECS".' + example: http + - name: transport + level: core + type: keyword + ignore_above: 1024 + description: 'Same as network.iana_number, but instead using the Keyword name + of the transport layer (udp, tcp, ipv6-icmp, etc.) + + The field value must be normalized to lowercase for querying. See the documentation + section "Implementing ECS".' + example: tcp + - name: type + level: core + type: keyword + ignore_above: 1024 + description: 'In the OSI Model this would be the Network Layer. ipv4, ipv6, + ipsec, pim, etc + + The field value must be normalized to lowercase for querying. See the documentation + section "Implementing ECS".' + example: ipv4 + - name: vlan.id + level: extended + type: keyword + ignore_above: 1024 + description: VLAN ID as reported by the observer. + example: 10 + default_field: false + - name: vlan.name + level: extended + type: keyword + ignore_above: 1024 + description: Optional VLAN name as reported by the observer. + example: outside + default_field: false + - name: related + title: Related + group: 2 + description: 'This field set is meant to facilitate pivoting around a piece of + data. + + Some pieces of information can be seen in many places in an ECS event. To facilitate + searching for them, store an array of all seen values to their corresponding + field in `related.`. + + A concrete example is IP addresses, which can be under host, observer, source, + destination, client, server, and network.forwarded_ip. If you append all IPs + to `related.ip`, you can then search for a given IP trivially, no matter where + it appeared, by querying `related.ip:192.0.2.15`.' + type: group + fields: + - name: ip + level: extended + type: ip + description: All of the IPs seen on your event. + - name: user + level: extended + type: keyword + ignore_above: 1024 + description: All the user names seen on your event. + default_field: false + - name: server + title: Server + group: 2 + description: 'A Server is defined as the responder in a network connection for + events regarding sessions, connections, or bidirectional flow records. + + For TCP events, the server is the receiver of the initial SYN packet(s) of the + TCP connection. For other protocols, the server is generally the responder in + the network transaction. Some systems actually use the term "responder" to refer + the server in TCP connections. The server fields describe details about the + system acting as the server in the network event. Server fields are usually + populated in conjunction with client fields. Server fields are generally not + populated for packet-level events. + + Client / server representations can add semantic context to an exchange, which + is helpful to visualize the data in certain situations. If your context falls + in that category, you should still ensure that source and destination are filled + appropriately.' + type: group + fields: + - name: address + level: extended + type: keyword + ignore_above: 1024 + description: 'Some event server addresses are defined ambiguously. The event + will sometimes list an IP, a domain or a unix socket. You should always store + the raw address in the `.address` field. + + Then it should be duplicated to `.ip` or `.domain`, depending on which one + it is.' + - name: as.number + level: extended + type: long + description: Unique number allocated to the autonomous system. The autonomous + system number (ASN) uniquely identifies each network on the Internet. + example: 15169 + - name: as.organization.name + level: extended + type: keyword + ignore_above: 1024 + multi_fields: + - name: text + type: text + norms: false + default_field: false + description: Organization name. + example: Google LLC + - name: bytes + level: core + type: long + format: bytes + description: Bytes sent from the server to the client. + example: 184 + - name: domain + level: core + type: keyword + ignore_above: 1024 + description: Server domain. + - name: geo.city_name + level: core + type: keyword + ignore_above: 1024 + description: City name. + example: Montreal + - name: geo.continent_name + level: core + type: keyword + ignore_above: 1024 + description: Name of the continent. + example: North America + - name: geo.country_iso_code + level: core + type: keyword + ignore_above: 1024 + description: Country ISO code. + example: CA + - name: geo.country_name + level: core + type: keyword + ignore_above: 1024 + description: Country name. + example: Canada + - name: geo.location + level: core + type: geo_point + description: Longitude and latitude. + example: '{ "lon": -73.614830, "lat": 45.505918 }' + - name: geo.name + level: extended + type: keyword + ignore_above: 1024 + description: 'User-defined description of a location, at the level of granularity + they care about. + + Could be the name of their data centers, the floor number, if this describes + a local physical entity, city names. + + Not typically used in automated geolocation.' + example: boston-dc + - name: geo.region_iso_code + level: core + type: keyword + ignore_above: 1024 + description: Region ISO code. + example: CA-QC + - name: geo.region_name + level: core + type: keyword + ignore_above: 1024 + description: Region name. + example: Quebec + - name: ip + level: core + type: ip + description: IP address of the server (IPv4 or IPv6). + - name: mac + level: core + type: keyword + ignore_above: 1024 + description: MAC address of the server. + - name: nat.ip + level: extended + type: ip + description: 'Translated ip of destination based NAT sessions (e.g. internet + to private DMZ) + + Typically used with load balancers, firewalls, or routers.' + - name: nat.port + level: extended + type: long + format: string + description: 'Translated port of destination based NAT sessions (e.g. internet + to private DMZ) + + Typically used with load balancers, firewalls, or routers.' + - name: packets + level: core + type: long + description: Packets sent from the server to the client. + example: 12 + - name: port + level: core + type: long + format: string + description: Port of the server. + - name: registered_domain + level: extended + type: keyword + ignore_above: 1024 + description: 'The highest registered server domain, stripped of the subdomain. + + For example, the registered domain for "foo.example.com" is "example.com". + + This value can be determined precisely with a list like the public suffix + list (http://publicsuffix.org). Trying to approximate this by simply taking + the last two labels will not work well for TLDs such as "co.uk".' + example: example.com + - name: top_level_domain + level: extended + type: keyword + ignore_above: 1024 + description: 'The effective top level domain (eTLD), also known as the domain + suffix, is the last part of the domain name. For example, the top level domain + for example.com is "com". + + This value can be determined precisely with a list like the public suffix + list (http://publicsuffix.org). Trying to approximate this by simply taking + the last label will not work well for effective TLDs such as "co.uk".' + example: co.uk + - name: user.domain + level: extended + type: keyword + ignore_above: 1024 + description: 'Name of the directory the user is a member of. + + For example, an LDAP or Active Directory domain name.' + - name: user.email + level: extended + type: keyword + ignore_above: 1024 + description: User email address. + - name: user.full_name + level: extended + type: keyword + ignore_above: 1024 + multi_fields: + - name: text + type: text + norms: false + default_field: false + description: User's full name, if available. + example: Albert Einstein + - name: user.group.domain + level: extended + type: keyword + ignore_above: 1024 + description: 'Name of the directory the group is a member of. + + For example, an LDAP or Active Directory domain name.' + - name: user.group.id + level: extended + type: keyword + ignore_above: 1024 + description: Unique identifier for the group on the system/platform. + - name: user.group.name + level: extended + type: keyword + ignore_above: 1024 + description: Name of the group. + - name: user.hash + level: extended + type: keyword + ignore_above: 1024 + description: 'Unique user hash to correlate information for a user in anonymized + form. + + Useful if `user.id` or `user.name` contain confidential information and cannot + be used.' + - name: user.id + level: core + type: keyword + ignore_above: 1024 + description: Unique identifier of the user. + - name: user.name + level: core + type: keyword + ignore_above: 1024 + multi_fields: + - name: text + type: text + norms: false + default_field: false + description: Short name or login of the user. + example: albert + - name: user.roles + level: extended + type: keyword + ignore_above: 1024 + description: Array of user roles at the time of the event. + example: '["kibana_admin", "reporting_user"]' + default_field: false + - name: source + title: Source + group: 2 + description: 'Source fields describe details about the source of a packet/event. + + Source fields are usually populated in conjunction with destination fields.' + type: group + fields: + - name: address + level: extended + type: keyword + ignore_above: 1024 + description: 'Some event source addresses are defined ambiguously. The event + will sometimes list an IP, a domain or a unix socket. You should always store + the raw address in the `.address` field. + + Then it should be duplicated to `.ip` or `.domain`, depending on which one + it is.' + - name: as.number + level: extended + type: long + description: Unique number allocated to the autonomous system. The autonomous + system number (ASN) uniquely identifies each network on the Internet. + example: 15169 + - name: as.organization.name + level: extended + type: keyword + ignore_above: 1024 + multi_fields: + - name: text + type: text + norms: false + default_field: false + description: Organization name. + example: Google LLC + - name: bytes + level: core + type: long + format: bytes + description: Bytes sent from the source to the destination. + example: 184 + - name: domain + level: core + type: keyword + ignore_above: 1024 + description: Source domain. + - name: geo.city_name + level: core + type: keyword + ignore_above: 1024 + description: City name. + example: Montreal + - name: geo.continent_name + level: core + type: keyword + ignore_above: 1024 + description: Name of the continent. + example: North America + - name: geo.country_iso_code + level: core + type: keyword + ignore_above: 1024 + description: Country ISO code. + example: CA + - name: geo.country_name + level: core + type: keyword + ignore_above: 1024 + description: Country name. + example: Canada + - name: geo.location + level: core + type: geo_point + description: Longitude and latitude. + example: '{ "lon": -73.614830, "lat": 45.505918 }' + - name: geo.name + level: extended + type: keyword + ignore_above: 1024 + description: 'User-defined description of a location, at the level of granularity + they care about. + + Could be the name of their data centers, the floor number, if this describes + a local physical entity, city names. + + Not typically used in automated geolocation.' + example: boston-dc + - name: geo.region_iso_code + level: core + type: keyword + ignore_above: 1024 + description: Region ISO code. + example: CA-QC + - name: geo.region_name + level: core + type: keyword + ignore_above: 1024 + description: Region name. + example: Quebec + - name: ip + level: core + type: ip + description: IP address of the source (IPv4 or IPv6). + - name: mac + level: core + type: keyword + ignore_above: 1024 + description: MAC address of the source. + - name: nat.ip + level: extended + type: ip + description: 'Translated ip of source based NAT sessions (e.g. internal client + to internet) + + Typically connections traversing load balancers, firewalls, or routers.' + - name: nat.port + level: extended + type: long + format: string + description: 'Translated port of source based NAT sessions. (e.g. internal client + to internet) + + Typically used with load balancers, firewalls, or routers.' + - name: packets + level: core + type: long + description: Packets sent from the source to the destination. + example: 12 + - name: port + level: core + type: long + format: string + description: Port of the source. + - name: registered_domain + level: extended + type: keyword + ignore_above: 1024 + description: 'The highest registered source domain, stripped of the subdomain. + + For example, the registered domain for "foo.example.com" is "example.com". + + This value can be determined precisely with a list like the public suffix + list (http://publicsuffix.org). Trying to approximate this by simply taking + the last two labels will not work well for TLDs such as "co.uk".' + example: example.com + - name: top_level_domain + level: extended + type: keyword + ignore_above: 1024 + description: 'The effective top level domain (eTLD), also known as the domain + suffix, is the last part of the domain name. For example, the top level domain + for example.com is "com". + + This value can be determined precisely with a list like the public suffix + list (http://publicsuffix.org). Trying to approximate this by simply taking + the last label will not work well for effective TLDs such as "co.uk".' + example: co.uk + - name: user.domain + level: extended + type: keyword + ignore_above: 1024 + description: 'Name of the directory the user is a member of. + + For example, an LDAP or Active Directory domain name.' + - name: user.email + level: extended + type: keyword + ignore_above: 1024 + description: User email address. + - name: user.full_name + level: extended + type: keyword + ignore_above: 1024 + multi_fields: + - name: text + type: text + norms: false + default_field: false + description: User's full name, if available. + example: Albert Einstein + - name: user.group.domain + level: extended + type: keyword + ignore_above: 1024 + description: 'Name of the directory the group is a member of. + + For example, an LDAP or Active Directory domain name.' + - name: user.group.id + level: extended + type: keyword + ignore_above: 1024 + description: Unique identifier for the group on the system/platform. + - name: user.group.name + level: extended + type: keyword + ignore_above: 1024 + description: Name of the group. + - name: user.hash + level: extended + type: keyword + ignore_above: 1024 + description: 'Unique user hash to correlate information for a user in anonymized + form. + + Useful if `user.id` or `user.name` contain confidential information and cannot + be used.' + - name: user.id + level: core + type: keyword + ignore_above: 1024 + description: Unique identifier of the user. + - name: user.name + level: core + type: keyword + ignore_above: 1024 + multi_fields: + - name: text + type: text + norms: false + default_field: false + description: Short name or login of the user. + example: albert + - name: user.roles + level: extended + type: keyword + ignore_above: 1024 + description: Array of user roles at the time of the event. + example: '["kibana_admin", "reporting_user"]' + default_field: false + - name: url + title: URL + group: 2 + description: URL fields provide support for complete or partial URLs, and supports + the breaking down into scheme, domain, path, and so on. + type: group + fields: + - name: domain + level: extended + type: keyword + ignore_above: 1024 + description: 'Domain of the url, such as "www.elastic.co". + + In some cases a URL may refer to an IP and/or port directly, without a domain + name. In this case, the IP address would go to the `domain` field.' + example: www.elastic.co + - name: extension + level: extended + type: keyword + ignore_above: 1024 + description: 'The field contains the file extension from the original request + url. + + The file extension is only set if it exists, as not every url has a file extension. + + The leading period must not be included. For example, the value must be "png", + not ".png".' + example: png + - name: fragment + level: extended + type: keyword + ignore_above: 1024 + description: 'Portion of the url after the `#`, such as "top". + + The `#` is not part of the fragment.' + - name: full + level: extended + type: keyword + ignore_above: 1024 + multi_fields: + - name: text + type: text + norms: false + default_field: false + description: If full URLs are important to your use case, they should be stored + in `url.full`, whether this field is reconstructed or present in the event + source. + example: https://www.elastic.co:443/search?q=elasticsearch#top + - name: original + level: extended + type: keyword + ignore_above: 1024 + multi_fields: + - name: text + type: text + norms: false + default_field: false + description: 'Unmodified original url as seen in the event source. + + Note that in network monitoring, the observed URL may be a full URL, whereas + in access logs, the URL is often just represented as a path. + + This field is meant to represent the URL as it was observed, complete or not.' + example: https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch + - name: password + level: extended + type: keyword + ignore_above: 1024 + description: Password of the request. + - name: path + level: extended + type: keyword + ignore_above: 1024 + description: Path of the request, such as "/search". + - name: port + level: extended + type: long + format: string + description: Port of the request, such as 443. + example: 443 + - name: query + level: extended + type: keyword + ignore_above: 1024 + description: 'The query field describes the query string of the request, such + as "q=elasticsearch". + + The `?` is excluded from the query string. If a URL contains no `?`, there + is no query field. If there is a `?` but no query, the query field exists + with an empty string. The `exists` query can be used to differentiate between + the two cases.' + - name: registered_domain + level: extended + type: keyword + ignore_above: 1024 + description: 'The highest registered url domain, stripped of the subdomain. + + For example, the registered domain for "foo.example.com" is "example.com". + + This value can be determined precisely with a list like the public suffix + list (http://publicsuffix.org). Trying to approximate this by simply taking + the last two labels will not work well for TLDs such as "co.uk".' + example: example.com + - name: scheme + level: extended + type: keyword + ignore_above: 1024 + description: 'Scheme of the request, such as "https". + + Note: The `:` is not part of the scheme.' + example: https + - name: top_level_domain + level: extended + type: keyword + ignore_above: 1024 + description: 'The effective top level domain (eTLD), also known as the domain + suffix, is the last part of the domain name. For example, the top level domain + for example.com is "com". + + This value can be determined precisely with a list like the public suffix + list (http://publicsuffix.org). Trying to approximate this by simply taking + the last label will not work well for effective TLDs such as "co.uk".' + example: co.uk + - name: username + level: extended + type: keyword + ignore_above: 1024 + description: Username of the request. + - name: user + title: User + group: 2 + description: 'The user fields describe information about the user that is relevant + to the event. + + Fields can have one entry or multiple entries. If a user has more than one id, + provide an array that includes all of them.' + type: group + fields: + - name: name + level: core + type: keyword + ignore_above: 1024 + multi_fields: + - name: text + type: text + norms: false + default_field: false + description: Short name or login of the user. + example: albert + - name: user_agent + title: User agent + group: 2 + description: 'The user_agent fields normally come from a browser request. + + They often show up in web service logs coming from the parsed user agent string.' + type: group + fields: + - name: device.name + level: extended + type: keyword + ignore_above: 1024 + description: Name of the device. + example: iPhone + - name: name + level: extended + type: keyword + ignore_above: 1024 + description: Name of the user agent. + example: Safari + - name: original + level: extended + type: keyword + ignore_above: 1024 + multi_fields: + - name: text + type: text + norms: false + description: Unparsed user_agent string. + example: Mozilla/5.0 (iPhone; CPU iPhone OS 12_1 like Mac OS X) AppleWebKit/605.1.15 + (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1 + - name: os.family + level: extended + type: keyword + ignore_above: 1024 + description: OS family (such as redhat, debian, freebsd, windows). + example: debian + - name: os.full + level: extended + type: keyword + ignore_above: 1024 + multi_fields: + - name: text + type: text + norms: false + default_field: false + description: Operating system name, including the version or code name. + example: Mac OS Mojave + - name: os.kernel + level: extended + type: keyword + ignore_above: 1024 + description: Operating system kernel version as a raw string. + example: 4.4.0-112-generic + - name: os.name + level: extended + type: keyword + ignore_above: 1024 + multi_fields: + - name: text + type: text + norms: false + default_field: false + description: Operating system name, without the version. + example: Mac OS X + - name: os.platform + level: extended + type: keyword + ignore_above: 1024 + description: Operating system platform (such centos, ubuntu, windows). + example: darwin + - name: os.version + level: extended + type: keyword + ignore_above: 1024 + description: Operating system version as a raw string. + example: 10.14.1 + - name: version + level: extended + type: keyword + ignore_above: 1024 + description: Version of the user agent. + example: 12.0 diff --git a/usage-example/generated/csv/fields.csv b/usage-example/generated/csv/fields.csv new file mode 100644 index 0000000000..8eb4127a49 --- /dev/null +++ b/usage-example/generated/csv/fields.csv @@ -0,0 +1,234 @@ +ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description +1.6.0,true,base,@timestamp,date,core,,2016-05-23T08:05:34.853Z,Date/time when the event originated. +1.6.0,true,base,labels,object,core,,"{""application"": ""foo-bar"", ""env"": ""production""}",Custom key/value pairs. +1.6.0,true,base,message,text,core,,Hello World,Log message optimized for viewing in a log viewer. +1.6.0,true,base,tags,keyword,core,array,"[""production"", ""env2""]",List of keywords used to tag each event. +1.6.0,true,acme,acme.account.id,keyword,custom,,,Customer account for this activity. +1.6.0,true,agent,agent.build.original,keyword,core,,"metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]",Extended build information for the agent. +1.6.0,true,agent,agent.ephemeral_id,keyword,extended,,8a4f500f,Ephemeral identifier of this agent. +1.6.0,true,agent,agent.id,keyword,core,,8a4f500d,Unique identifier of this agent. +1.6.0,true,agent,agent.name,keyword,core,,foo,Custom name of the agent. +1.6.0,true,agent,agent.type,keyword,core,,filebeat,Type of the agent. +1.6.0,true,agent,agent.version,keyword,core,,6.0.0-rc2,Version of the agent. +1.6.0,true,client,client.address,keyword,extended,,,Client network address. +1.6.0,true,client,client.as.number,long,extended,,15169,Unique number allocated to the autonomous system. +1.6.0,true,client,client.as.organization.name,keyword,extended,,Google LLC,Organization name. +1.6.0,true,client,client.as.organization.name.text,text,extended,,Google LLC,Organization name. +1.6.0,true,client,client.bytes,long,core,,184,Bytes sent from the client to the server. +1.6.0,true,client,client.domain,keyword,core,,,Client domain. +1.6.0,true,client,client.geo.city_name,keyword,core,,Montreal,City name. +1.6.0,true,client,client.geo.continent_name,keyword,core,,North America,Name of the continent. +1.6.0,true,client,client.geo.country_iso_code,keyword,core,,CA,Country ISO code. +1.6.0,true,client,client.geo.country_name,keyword,core,,Canada,Country name. +1.6.0,true,client,client.geo.location,geo_point,core,,"{ ""lon"": -73.614830, ""lat"": 45.505918 }",Longitude and latitude. +1.6.0,true,client,client.geo.name,keyword,extended,,boston-dc,User-defined description of a location. +1.6.0,true,client,client.geo.region_iso_code,keyword,core,,CA-QC,Region ISO code. +1.6.0,true,client,client.geo.region_name,keyword,core,,Quebec,Region name. +1.6.0,true,client,client.ip,ip,core,,,IP address of the client. +1.6.0,true,client,client.mac,keyword,core,,,MAC address of the client. +1.6.0,true,client,client.nat.ip,ip,extended,,,Client NAT ip address +1.6.0,true,client,client.nat.port,long,extended,,,Client NAT port +1.6.0,true,client,client.packets,long,core,,12,Packets sent from the client to the server. +1.6.0,true,client,client.port,long,core,,,Port of the client. +1.6.0,true,client,client.registered_domain,keyword,extended,,example.com,"The highest registered client domain, stripped of the subdomain." +1.6.0,true,client,client.top_level_domain,keyword,extended,,co.uk,"The effective top level domain (com, org, net, co.uk)." +1.6.0,true,client,client.user.domain,keyword,extended,,,Name of the directory the user is a member of. +1.6.0,true,client,client.user.email,keyword,extended,,,User email address. +1.6.0,true,client,client.user.full_name,keyword,extended,,Albert Einstein,"User's full name, if available." +1.6.0,true,client,client.user.full_name.text,text,extended,,Albert Einstein,"User's full name, if available." +1.6.0,true,client,client.user.group.domain,keyword,extended,,,Name of the directory the group is a member of. +1.6.0,true,client,client.user.group.id,keyword,extended,,,Unique identifier for the group on the system/platform. +1.6.0,true,client,client.user.group.name,keyword,extended,,,Name of the group. +1.6.0,true,client,client.user.hash,keyword,extended,,,Unique user hash to correlate information for a user in anonymized form. +1.6.0,true,client,client.user.id,keyword,core,,,Unique identifier of the user. +1.6.0,true,client,client.user.name,keyword,core,,albert,Short name or login of the user. +1.6.0,true,client,client.user.name.text,text,core,,albert,Short name or login of the user. +1.6.0,true,client,client.user.roles,keyword,extended,array,"[""kibana_admin"", ""reporting_user""]",Array of user roles at the time of the event. +1.6.0,true,destination,destination.address,keyword,extended,,,Destination network address. +1.6.0,true,destination,destination.as.number,long,extended,,15169,Unique number allocated to the autonomous system. +1.6.0,true,destination,destination.as.organization.name,keyword,extended,,Google LLC,Organization name. +1.6.0,true,destination,destination.as.organization.name.text,text,extended,,Google LLC,Organization name. +1.6.0,true,destination,destination.bytes,long,core,,184,Bytes sent from the destination to the source. +1.6.0,true,destination,destination.domain,keyword,core,,,Destination domain. +1.6.0,true,destination,destination.geo.city_name,keyword,core,,Montreal,City name. +1.6.0,true,destination,destination.geo.continent_name,keyword,core,,North America,Name of the continent. +1.6.0,true,destination,destination.geo.country_iso_code,keyword,core,,CA,Country ISO code. +1.6.0,true,destination,destination.geo.country_name,keyword,core,,Canada,Country name. +1.6.0,true,destination,destination.geo.location,geo_point,core,,"{ ""lon"": -73.614830, ""lat"": 45.505918 }",Longitude and latitude. +1.6.0,true,destination,destination.geo.name,keyword,extended,,boston-dc,User-defined description of a location. +1.6.0,true,destination,destination.geo.region_iso_code,keyword,core,,CA-QC,Region ISO code. +1.6.0,true,destination,destination.geo.region_name,keyword,core,,Quebec,Region name. +1.6.0,true,destination,destination.ip,ip,core,,,IP address of the destination. +1.6.0,true,destination,destination.mac,keyword,core,,,MAC address of the destination. +1.6.0,true,destination,destination.nat.ip,ip,extended,,,Destination NAT ip +1.6.0,true,destination,destination.nat.port,long,extended,,,Destination NAT Port +1.6.0,true,destination,destination.packets,long,core,,12,Packets sent from the destination to the source. +1.6.0,true,destination,destination.port,long,core,,,Port of the destination. +1.6.0,true,destination,destination.registered_domain,keyword,extended,,example.com,"The highest registered destination domain, stripped of the subdomain." +1.6.0,true,destination,destination.top_level_domain,keyword,extended,,co.uk,"The effective top level domain (com, org, net, co.uk)." +1.6.0,true,destination,destination.user.domain,keyword,extended,,,Name of the directory the user is a member of. +1.6.0,true,destination,destination.user.email,keyword,extended,,,User email address. +1.6.0,true,destination,destination.user.full_name,keyword,extended,,Albert Einstein,"User's full name, if available." +1.6.0,true,destination,destination.user.full_name.text,text,extended,,Albert Einstein,"User's full name, if available." +1.6.0,true,destination,destination.user.group.domain,keyword,extended,,,Name of the directory the group is a member of. +1.6.0,true,destination,destination.user.group.id,keyword,extended,,,Unique identifier for the group on the system/platform. +1.6.0,true,destination,destination.user.group.name,keyword,extended,,,Name of the group. +1.6.0,true,destination,destination.user.hash,keyword,extended,,,Unique user hash to correlate information for a user in anonymized form. +1.6.0,true,destination,destination.user.id,keyword,core,,,Unique identifier of the user. +1.6.0,true,destination,destination.user.name,keyword,core,,albert,Short name or login of the user. +1.6.0,true,destination,destination.user.name.text,text,core,,albert,Short name or login of the user. +1.6.0,true,destination,destination.user.roles,keyword,extended,array,"[""kibana_admin"", ""reporting_user""]",Array of user roles at the time of the event. +1.6.0,true,ecs,ecs.version,keyword,core,,1.0.0,ECS version this event conforms to. +1.6.0,true,event,event.action,keyword,core,,user-password-change,The action captured by the event. +1.6.0,true,event,event.category,keyword,core,array,authentication,Event category. The second categorization field in the hierarchy. +1.6.0,true,event,event.code,keyword,extended,,4648,Identification code for this event. +1.6.0,true,event,event.created,date,core,,2016-05-23T08:05:34.857Z,Time when the event was first read by an agent or by your pipeline. +1.6.0,true,event,event.dataset,keyword,core,,apache.access,Name of the dataset. +1.6.0,true,event,event.duration,long,core,,,Duration of the event in nanoseconds. +1.6.0,true,event,event.end,date,extended,,,event.end contains the date when the event ended or when the activity was last observed. +1.6.0,true,event,event.hash,keyword,extended,,123456789012345678901234567890ABCD,Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity. +1.6.0,true,event,event.id,keyword,core,,8a4f500d,Unique ID to describe the event. +1.6.0,true,event,event.ingested,date,core,,2016-05-23T08:05:35.101Z,Timestamp when an event arrived in the central data store. +1.6.0,true,event,event.kind,keyword,core,,alert,The kind of the event. The highest categorization field in the hierarchy. +1.6.0,true,event,event.module,keyword,core,,apache,Name of the module this data is coming from. +1.6.0,false,event,event.original,keyword,core,,Sep 19 08:26:10 host CEF:0|Security| threatmanager|1.0|100| worm successfully stopped|10|src=10.0.0.1 dst=2.1.2.2spt=1232,Raw text message of entire event. +1.6.0,true,event,event.outcome,keyword,core,,success,The outcome of the event. The lowest level categorization field in the hierarchy. +1.6.0,true,event,event.provider,keyword,extended,,kernel,Source of the event. +1.6.0,true,event,event.reason,keyword,extended,,Terminated an unexpected process,"Reason why this event happened, according to the source" +1.6.0,true,event,event.reference,keyword,extended,,https://system.example.com/event/#0001234,Event reference URL +1.6.0,true,event,event.risk_score,float,core,,,Risk score or priority of the event (e.g. security solutions). Use your system's original value here. +1.6.0,true,event,event.risk_score_norm,float,extended,,,Normalized risk score or priority of the event (0-100). +1.6.0,true,event,event.sequence,long,extended,,,Sequence number of the event. +1.6.0,true,event,event.severity,long,core,,7,Numeric severity of the event. +1.6.0,true,event,event.start,date,extended,,,event.start contains the date when the event started or when the activity was first observed. +1.6.0,true,event,event.timezone,keyword,extended,,,Event time zone. +1.6.0,true,event,event.type,keyword,core,array,,Event type. The third categorization field in the hierarchy. +1.6.0,true,event,event.url,keyword,extended,,https://mysystem.example.com/alert/5271dedb-f5b0-4218-87f0-4ac4870a38fe,Event investigation URL +1.6.0,true,http,http.request.body.bytes,long,extended,,887,Size in bytes of the request body. +1.6.0,true,http,http.request.body.content,keyword,extended,,Hello world,The full HTTP request body. +1.6.0,true,http,http.request.body.content.text,text,extended,,Hello world,The full HTTP request body. +1.6.0,true,http,http.request.bytes,long,extended,,1437,Total size in bytes of the request (body and headers). +1.6.0,true,http,http.request.method,keyword,extended,,"GET, POST, PUT, PoST",HTTP request method. +1.6.0,true,http,http.request.referrer,keyword,extended,,https://blog.example.com/,Referrer for this HTTP request. +1.6.0,true,http,http.response.body.bytes,long,extended,,887,Size in bytes of the response body. +1.6.0,true,http,http.response.body.content,keyword,extended,,Hello world,The full HTTP response body. +1.6.0,true,http,http.response.body.content.text,text,extended,,Hello world,The full HTTP response body. +1.6.0,true,http,http.response.bytes,long,extended,,1437,Total size in bytes of the response (body and headers). +1.6.0,true,http,http.response.status_code,long,extended,,404,HTTP response status code. +1.6.0,true,http,http.version,keyword,extended,,1.1,HTTP version. +1.6.0,true,network,network.application,keyword,extended,,aim,Application level protocol name. +1.6.0,true,network,network.bytes,long,core,,368,Total bytes transferred in both directions. +1.6.0,true,network,network.community_id,keyword,extended,,1:hO+sN4H+MG5MY/8hIrXPqc4ZQz0=,A hash of source and destination IPs and ports. +1.6.0,true,network,network.direction,keyword,core,,inbound,Direction of the network traffic. +1.6.0,true,network,network.forwarded_ip,ip,core,,192.1.1.2,Host IP address when the source IP address is the proxy. +1.6.0,true,network,network.iana_number,keyword,extended,,6,IANA Protocol Number. +1.6.0,true,network,network.inner,object,extended,,,Inner VLAN tag information +1.6.0,true,network,network.inner.vlan.id,keyword,extended,,10,VLAN ID as reported by the observer. +1.6.0,true,network,network.inner.vlan.name,keyword,extended,,outside,Optional VLAN name as reported by the observer. +1.6.0,true,network,network.name,keyword,extended,,Guest Wifi,Name given by operators to sections of their network. +1.6.0,true,network,network.packets,long,core,,24,Total packets transferred in both directions. +1.6.0,true,network,network.protocol,keyword,core,,http,L7 Network protocol name. +1.6.0,true,network,network.transport,keyword,core,,tcp,Protocol Name corresponding to the field `iana_number`. +1.6.0,true,network,network.type,keyword,core,,ipv4,"In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc" +1.6.0,true,network,network.vlan.id,keyword,extended,,10,VLAN ID as reported by the observer. +1.6.0,true,network,network.vlan.name,keyword,extended,,outside,Optional VLAN name as reported by the observer. +1.6.0,true,related,related.ip,ip,extended,array,,All of the IPs seen on your event. +1.6.0,true,related,related.user,keyword,extended,array,,All the user names seen on your event. +1.6.0,true,server,server.address,keyword,extended,,,Server network address. +1.6.0,true,server,server.as.number,long,extended,,15169,Unique number allocated to the autonomous system. +1.6.0,true,server,server.as.organization.name,keyword,extended,,Google LLC,Organization name. +1.6.0,true,server,server.as.organization.name.text,text,extended,,Google LLC,Organization name. +1.6.0,true,server,server.bytes,long,core,,184,Bytes sent from the server to the client. +1.6.0,true,server,server.domain,keyword,core,,,Server domain. +1.6.0,true,server,server.geo.city_name,keyword,core,,Montreal,City name. +1.6.0,true,server,server.geo.continent_name,keyword,core,,North America,Name of the continent. +1.6.0,true,server,server.geo.country_iso_code,keyword,core,,CA,Country ISO code. +1.6.0,true,server,server.geo.country_name,keyword,core,,Canada,Country name. +1.6.0,true,server,server.geo.location,geo_point,core,,"{ ""lon"": -73.614830, ""lat"": 45.505918 }",Longitude and latitude. +1.6.0,true,server,server.geo.name,keyword,extended,,boston-dc,User-defined description of a location. +1.6.0,true,server,server.geo.region_iso_code,keyword,core,,CA-QC,Region ISO code. +1.6.0,true,server,server.geo.region_name,keyword,core,,Quebec,Region name. +1.6.0,true,server,server.ip,ip,core,,,IP address of the server. +1.6.0,true,server,server.mac,keyword,core,,,MAC address of the server. +1.6.0,true,server,server.nat.ip,ip,extended,,,Server NAT ip +1.6.0,true,server,server.nat.port,long,extended,,,Server NAT port +1.6.0,true,server,server.packets,long,core,,12,Packets sent from the server to the client. +1.6.0,true,server,server.port,long,core,,,Port of the server. +1.6.0,true,server,server.registered_domain,keyword,extended,,example.com,"The highest registered server domain, stripped of the subdomain." +1.6.0,true,server,server.top_level_domain,keyword,extended,,co.uk,"The effective top level domain (com, org, net, co.uk)." +1.6.0,true,server,server.user.domain,keyword,extended,,,Name of the directory the user is a member of. +1.6.0,true,server,server.user.email,keyword,extended,,,User email address. +1.6.0,true,server,server.user.full_name,keyword,extended,,Albert Einstein,"User's full name, if available." +1.6.0,true,server,server.user.full_name.text,text,extended,,Albert Einstein,"User's full name, if available." +1.6.0,true,server,server.user.group.domain,keyword,extended,,,Name of the directory the group is a member of. +1.6.0,true,server,server.user.group.id,keyword,extended,,,Unique identifier for the group on the system/platform. +1.6.0,true,server,server.user.group.name,keyword,extended,,,Name of the group. +1.6.0,true,server,server.user.hash,keyword,extended,,,Unique user hash to correlate information for a user in anonymized form. +1.6.0,true,server,server.user.id,keyword,core,,,Unique identifier of the user. +1.6.0,true,server,server.user.name,keyword,core,,albert,Short name or login of the user. +1.6.0,true,server,server.user.name.text,text,core,,albert,Short name or login of the user. +1.6.0,true,server,server.user.roles,keyword,extended,array,"[""kibana_admin"", ""reporting_user""]",Array of user roles at the time of the event. +1.6.0,true,source,source.address,keyword,extended,,,Source network address. +1.6.0,true,source,source.as.number,long,extended,,15169,Unique number allocated to the autonomous system. +1.6.0,true,source,source.as.organization.name,keyword,extended,,Google LLC,Organization name. +1.6.0,true,source,source.as.organization.name.text,text,extended,,Google LLC,Organization name. +1.6.0,true,source,source.bytes,long,core,,184,Bytes sent from the source to the destination. +1.6.0,true,source,source.domain,keyword,core,,,Source domain. +1.6.0,true,source,source.geo.city_name,keyword,core,,Montreal,City name. +1.6.0,true,source,source.geo.continent_name,keyword,core,,North America,Name of the continent. +1.6.0,true,source,source.geo.country_iso_code,keyword,core,,CA,Country ISO code. +1.6.0,true,source,source.geo.country_name,keyword,core,,Canada,Country name. +1.6.0,true,source,source.geo.location,geo_point,core,,"{ ""lon"": -73.614830, ""lat"": 45.505918 }",Longitude and latitude. +1.6.0,true,source,source.geo.name,keyword,extended,,boston-dc,User-defined description of a location. +1.6.0,true,source,source.geo.region_iso_code,keyword,core,,CA-QC,Region ISO code. +1.6.0,true,source,source.geo.region_name,keyword,core,,Quebec,Region name. +1.6.0,true,source,source.ip,ip,core,,,IP address of the source. +1.6.0,true,source,source.mac,keyword,core,,,MAC address of the source. +1.6.0,true,source,source.nat.ip,ip,extended,,,Source NAT ip +1.6.0,true,source,source.nat.port,long,extended,,,Source NAT port +1.6.0,true,source,source.packets,long,core,,12,Packets sent from the source to the destination. +1.6.0,true,source,source.port,long,core,,,Port of the source. +1.6.0,true,source,source.registered_domain,keyword,extended,,example.com,"The highest registered source domain, stripped of the subdomain." +1.6.0,true,source,source.top_level_domain,keyword,extended,,co.uk,"The effective top level domain (com, org, net, co.uk)." +1.6.0,true,source,source.user.domain,keyword,extended,,,Name of the directory the user is a member of. +1.6.0,true,source,source.user.email,keyword,extended,,,User email address. +1.6.0,true,source,source.user.full_name,keyword,extended,,Albert Einstein,"User's full name, if available." +1.6.0,true,source,source.user.full_name.text,text,extended,,Albert Einstein,"User's full name, if available." +1.6.0,true,source,source.user.group.domain,keyword,extended,,,Name of the directory the group is a member of. +1.6.0,true,source,source.user.group.id,keyword,extended,,,Unique identifier for the group on the system/platform. +1.6.0,true,source,source.user.group.name,keyword,extended,,,Name of the group. +1.6.0,true,source,source.user.hash,keyword,extended,,,Unique user hash to correlate information for a user in anonymized form. +1.6.0,true,source,source.user.id,keyword,core,,,Unique identifier of the user. +1.6.0,true,source,source.user.name,keyword,core,,albert,Short name or login of the user. +1.6.0,true,source,source.user.name.text,text,core,,albert,Short name or login of the user. +1.6.0,true,source,source.user.roles,keyword,extended,array,"[""kibana_admin"", ""reporting_user""]",Array of user roles at the time of the event. +1.6.0,true,url,url.domain,keyword,extended,,www.elastic.co,Domain of the url. +1.6.0,true,url,url.extension,keyword,extended,,png,File extension from the original request url. +1.6.0,true,url,url.fragment,keyword,extended,,,Portion of the url after the `#`. +1.6.0,true,url,url.full,keyword,extended,,https://www.elastic.co:443/search?q=elasticsearch#top,Full unparsed URL. +1.6.0,true,url,url.full.text,text,extended,,https://www.elastic.co:443/search?q=elasticsearch#top,Full unparsed URL. +1.6.0,true,url,url.original,keyword,extended,,https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch,Unmodified original url as seen in the event source. +1.6.0,true,url,url.original.text,text,extended,,https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch,Unmodified original url as seen in the event source. +1.6.0,true,url,url.password,keyword,extended,,,Password of the request. +1.6.0,true,url,url.path,keyword,extended,,,"Path of the request, such as ""/search""." +1.6.0,true,url,url.port,long,extended,,443,"Port of the request, such as 443." +1.6.0,true,url,url.query,keyword,extended,,,Query string of the request. +1.6.0,true,url,url.registered_domain,keyword,extended,,example.com,"The highest registered url domain, stripped of the subdomain." +1.6.0,true,url,url.scheme,keyword,extended,,https,Scheme of the url. +1.6.0,true,url,url.top_level_domain,keyword,extended,,co.uk,"The effective top level domain (com, org, net, co.uk)." +1.6.0,true,url,url.username,keyword,extended,,,Username of the request. +1.6.0,true,user,user.name,keyword,core,,albert,Short name or login of the user. +1.6.0,true,user,user.name.text,text,core,,albert,Short name or login of the user. +1.6.0,true,user_agent,user_agent.device.name,keyword,extended,,iPhone,Name of the device. +1.6.0,true,user_agent,user_agent.name,keyword,extended,,Safari,Name of the user agent. +1.6.0,true,user_agent,user_agent.original,keyword,extended,,"Mozilla/5.0 (iPhone; CPU iPhone OS 12_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1",Unparsed user_agent string. +1.6.0,true,user_agent,user_agent.original.text,text,extended,,"Mozilla/5.0 (iPhone; CPU iPhone OS 12_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1",Unparsed user_agent string. +1.6.0,true,user_agent,user_agent.os.family,keyword,extended,,debian,"OS family (such as redhat, debian, freebsd, windows)." +1.6.0,true,user_agent,user_agent.os.full,keyword,extended,,Mac OS Mojave,"Operating system name, including the version or code name." +1.6.0,true,user_agent,user_agent.os.full.text,text,extended,,Mac OS Mojave,"Operating system name, including the version or code name." +1.6.0,true,user_agent,user_agent.os.kernel,keyword,extended,,4.4.0-112-generic,Operating system kernel version as a raw string. +1.6.0,true,user_agent,user_agent.os.name,keyword,extended,,Mac OS X,"Operating system name, without the version." +1.6.0,true,user_agent,user_agent.os.name.text,text,extended,,Mac OS X,"Operating system name, without the version." +1.6.0,true,user_agent,user_agent.os.platform,keyword,extended,,darwin,"Operating system platform (such centos, ubuntu, windows)." +1.6.0,true,user_agent,user_agent.os.version,keyword,extended,,10.14.1,Operating system version as a raw string. +1.6.0,true,user_agent,user_agent.version,keyword,extended,,12.0,Version of the user agent. diff --git a/usage-example/generated/ecs/ecs_flat.yml b/usage-example/generated/ecs/ecs_flat.yml new file mode 100644 index 0000000000..a2141c7ed2 --- /dev/null +++ b/usage-example/generated/ecs/ecs_flat.yml @@ -0,0 +1,3170 @@ +'@timestamp': + dashed_name: -timestamp + description: 'Date/time when the event originated. + + This is the date/time extracted from the event, typically representing when the + event was generated by the source. + + If the event source has no original timestamp, this value is typically populated + by the first time the event was received by the pipeline. + + Required field for all events.' + example: '2016-05-23T08:05:34.853Z' + flat_name: '@timestamp' + level: core + name: '@timestamp' + normalize: [] + required: true + short: Date/time when the event originated. + type: date +acme.account.id: + dashed_name: acme-account-id + description: Customer account for this activity. + flat_name: acme.account.id + ignore_above: 1024 + level: custom + name: account.id + normalize: [] + short: Customer account for this activity. + type: keyword +agent.build.original: + dashed_name: agent-build-original + description: 'Extended build information for the agent. + + This field is intended to contain any build information that a data source may + provide, no specific formatting is required.' + example: metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c + built 2020-02-05 23:10:10 +0000 UTC] + flat_name: agent.build.original + ignore_above: 1024 + level: core + name: build.original + normalize: [] + short: Extended build information for the agent. + type: keyword +agent.ephemeral_id: + dashed_name: agent-ephemeral-id + description: 'Ephemeral identifier of this agent (if one exists). + + This id normally changes across restarts, but `agent.id` does not.' + example: 8a4f500f + flat_name: agent.ephemeral_id + ignore_above: 1024 + level: extended + name: ephemeral_id + normalize: [] + short: Ephemeral identifier of this agent. + type: keyword +agent.id: + dashed_name: agent-id + description: 'Unique identifier of this agent (if one exists). + + Example: For Beats this would be beat.id.' + example: 8a4f500d + flat_name: agent.id + ignore_above: 1024 + level: core + name: id + normalize: [] + short: Unique identifier of this agent. + type: keyword +agent.name: + dashed_name: agent-name + description: 'Custom name of the agent. + + This is a name that can be given to an agent. This can be helpful if for example + two Filebeat instances are running on the same host but a human readable separation + is needed on which Filebeat instance data is coming from. + + If no name is given, the name is often left empty.' + example: foo + flat_name: agent.name + ignore_above: 1024 + level: core + name: name + normalize: [] + short: Custom name of the agent. + type: keyword +agent.type: + dashed_name: agent-type + description: 'Type of the agent. + + The agent type always stays the same and should be given by the agent used. In + case of Filebeat the agent would always be Filebeat also if two Filebeat instances + are run on the same machine.' + example: filebeat + flat_name: agent.type + ignore_above: 1024 + level: core + name: type + normalize: [] + short: Type of the agent. + type: keyword +agent.version: + dashed_name: agent-version + description: Version of the agent. + example: 6.0.0-rc2 + flat_name: agent.version + ignore_above: 1024 + level: core + name: version + normalize: [] + short: Version of the agent. + type: keyword +client.address: + dashed_name: client-address + description: 'Some event client addresses are defined ambiguously. The event will + sometimes list an IP, a domain or a unix socket. You should always store the + raw address in the `.address` field. + + Then it should be duplicated to `.ip` or `.domain`, depending on which one it + is.' + flat_name: client.address + ignore_above: 1024 + level: extended + name: address + normalize: [] + short: Client network address. + type: keyword +client.as.number: + dashed_name: client-as-number + description: Unique number allocated to the autonomous system. The autonomous system + number (ASN) uniquely identifies each network on the Internet. + example: 15169 + flat_name: client.as.number + level: extended + name: number + normalize: [] + original_fieldset: as + short: Unique number allocated to the autonomous system. + type: long +client.as.organization.name: + dashed_name: client-as-organization-name + description: Organization name. + example: Google LLC + flat_name: client.as.organization.name + ignore_above: 1024 + level: extended + multi_fields: + - flat_name: client.as.organization.name.text + name: text + norms: false + type: text + name: organization.name + normalize: [] + original_fieldset: as + short: Organization name. + type: keyword +client.bytes: + dashed_name: client-bytes + description: Bytes sent from the client to the server. + example: 184 + flat_name: client.bytes + format: bytes + level: core + name: bytes + normalize: [] + short: Bytes sent from the client to the server. + type: long +client.domain: + dashed_name: client-domain + description: Client domain. + flat_name: client.domain + ignore_above: 1024 + level: core + name: domain + normalize: [] + short: Client domain. + type: keyword +client.geo.city_name: + dashed_name: client-geo-city-name + description: City name. + example: Montreal + flat_name: client.geo.city_name + ignore_above: 1024 + level: core + name: city_name + normalize: [] + original_fieldset: geo + short: City name. + type: keyword +client.geo.continent_name: + dashed_name: client-geo-continent-name + description: Name of the continent. + example: North America + flat_name: client.geo.continent_name + ignore_above: 1024 + level: core + name: continent_name + normalize: [] + original_fieldset: geo + short: Name of the continent. + type: keyword +client.geo.country_iso_code: + dashed_name: client-geo-country-iso-code + description: Country ISO code. + example: CA + flat_name: client.geo.country_iso_code + ignore_above: 1024 + level: core + name: country_iso_code + normalize: [] + original_fieldset: geo + short: Country ISO code. + type: keyword +client.geo.country_name: + dashed_name: client-geo-country-name + description: Country name. + example: Canada + flat_name: client.geo.country_name + ignore_above: 1024 + level: core + name: country_name + normalize: [] + original_fieldset: geo + short: Country name. + type: keyword +client.geo.location: + dashed_name: client-geo-location + description: Longitude and latitude. + example: '{ "lon": -73.614830, "lat": 45.505918 }' + flat_name: client.geo.location + level: core + name: location + normalize: [] + original_fieldset: geo + short: Longitude and latitude. + type: geo_point +client.geo.name: + dashed_name: client-geo-name + description: 'User-defined description of a location, at the level of granularity + they care about. + + Could be the name of their data centers, the floor number, if this describes a + local physical entity, city names. + + Not typically used in automated geolocation.' + example: boston-dc + flat_name: client.geo.name + ignore_above: 1024 + level: extended + name: name + normalize: [] + original_fieldset: geo + short: User-defined description of a location. + type: keyword +client.geo.region_iso_code: + dashed_name: client-geo-region-iso-code + description: Region ISO code. + example: CA-QC + flat_name: client.geo.region_iso_code + ignore_above: 1024 + level: core + name: region_iso_code + normalize: [] + original_fieldset: geo + short: Region ISO code. + type: keyword +client.geo.region_name: + dashed_name: client-geo-region-name + description: Region name. + example: Quebec + flat_name: client.geo.region_name + ignore_above: 1024 + level: core + name: region_name + normalize: [] + original_fieldset: geo + short: Region name. + type: keyword +client.ip: + dashed_name: client-ip + description: IP address of the client (IPv4 or IPv6). + flat_name: client.ip + level: core + name: ip + normalize: [] + short: IP address of the client. + type: ip +client.mac: + dashed_name: client-mac + description: MAC address of the client. + flat_name: client.mac + ignore_above: 1024 + level: core + name: mac + normalize: [] + short: MAC address of the client. + type: keyword +client.nat.ip: + dashed_name: client-nat-ip + description: 'Translated IP of source based NAT sessions (e.g. internal client to + internet). + + Typically connections traversing load balancers, firewalls, or routers.' + flat_name: client.nat.ip + level: extended + name: nat.ip + normalize: [] + short: Client NAT ip address + type: ip +client.nat.port: + dashed_name: client-nat-port + description: 'Translated port of source based NAT sessions (e.g. internal client + to internet). + + Typically connections traversing load balancers, firewalls, or routers.' + flat_name: client.nat.port + format: string + level: extended + name: nat.port + normalize: [] + short: Client NAT port + type: long +client.packets: + dashed_name: client-packets + description: Packets sent from the client to the server. + example: 12 + flat_name: client.packets + level: core + name: packets + normalize: [] + short: Packets sent from the client to the server. + type: long +client.port: + dashed_name: client-port + description: Port of the client. + flat_name: client.port + format: string + level: core + name: port + normalize: [] + short: Port of the client. + type: long +client.registered_domain: + dashed_name: client-registered-domain + description: 'The highest registered client domain, stripped of the subdomain. + + For example, the registered domain for "foo.example.com" is "example.com". + + This value can be determined precisely with a list like the public suffix list + (http://publicsuffix.org). Trying to approximate this by simply taking the last + two labels will not work well for TLDs such as "co.uk".' + example: example.com + flat_name: client.registered_domain + ignore_above: 1024 + level: extended + name: registered_domain + normalize: [] + short: The highest registered client domain, stripped of the subdomain. + type: keyword +client.top_level_domain: + dashed_name: client-top-level-domain + description: 'The effective top level domain (eTLD), also known as the domain suffix, + is the last part of the domain name. For example, the top level domain for example.com + is "com". + + This value can be determined precisely with a list like the public suffix list + (http://publicsuffix.org). Trying to approximate this by simply taking the last + label will not work well for effective TLDs such as "co.uk".' + example: co.uk + flat_name: client.top_level_domain + ignore_above: 1024 + level: extended + name: top_level_domain + normalize: [] + short: The effective top level domain (com, org, net, co.uk). + type: keyword +client.user.domain: + dashed_name: client-user-domain + description: 'Name of the directory the user is a member of. + + For example, an LDAP or Active Directory domain name.' + flat_name: client.user.domain + ignore_above: 1024 + level: extended + name: domain + normalize: [] + original_fieldset: user + short: Name of the directory the user is a member of. + type: keyword +client.user.email: + dashed_name: client-user-email + description: User email address. + flat_name: client.user.email + ignore_above: 1024 + level: extended + name: email + normalize: [] + original_fieldset: user + short: User email address. + type: keyword +client.user.full_name: + dashed_name: client-user-full-name + description: User's full name, if available. + example: Albert Einstein + flat_name: client.user.full_name + ignore_above: 1024 + level: extended + multi_fields: + - flat_name: client.user.full_name.text + name: text + norms: false + type: text + name: full_name + normalize: [] + original_fieldset: user + short: User's full name, if available. + type: keyword +client.user.group.domain: + dashed_name: client-user-group-domain + description: 'Name of the directory the group is a member of. + + For example, an LDAP or Active Directory domain name.' + flat_name: client.user.group.domain + ignore_above: 1024 + level: extended + name: domain + normalize: [] + original_fieldset: group + short: Name of the directory the group is a member of. + type: keyword +client.user.group.id: + dashed_name: client-user-group-id + description: Unique identifier for the group on the system/platform. + flat_name: client.user.group.id + ignore_above: 1024 + level: extended + name: id + normalize: [] + original_fieldset: group + short: Unique identifier for the group on the system/platform. + type: keyword +client.user.group.name: + dashed_name: client-user-group-name + description: Name of the group. + flat_name: client.user.group.name + ignore_above: 1024 + level: extended + name: name + normalize: [] + original_fieldset: group + short: Name of the group. + type: keyword +client.user.hash: + dashed_name: client-user-hash + description: 'Unique user hash to correlate information for a user in anonymized + form. + + Useful if `user.id` or `user.name` contain confidential information and cannot + be used.' + flat_name: client.user.hash + ignore_above: 1024 + level: extended + name: hash + normalize: [] + original_fieldset: user + short: Unique user hash to correlate information for a user in anonymized form. + type: keyword +client.user.id: + dashed_name: client-user-id + description: Unique identifier of the user. + flat_name: client.user.id + ignore_above: 1024 + level: core + name: id + normalize: [] + original_fieldset: user + short: Unique identifier of the user. + type: keyword +client.user.name: + dashed_name: client-user-name + description: Short name or login of the user. + example: albert + flat_name: client.user.name + ignore_above: 1024 + level: core + multi_fields: + - flat_name: client.user.name.text + name: text + norms: false + type: text + name: name + normalize: [] + original_fieldset: user + short: Short name or login of the user. + type: keyword +client.user.roles: + dashed_name: client-user-roles + description: Array of user roles at the time of the event. + example: '["kibana_admin", "reporting_user"]' + flat_name: client.user.roles + ignore_above: 1024 + level: extended + name: roles + normalize: + - array + original_fieldset: user + short: Array of user roles at the time of the event. + type: keyword +destination.address: + dashed_name: destination-address + description: 'Some event destination addresses are defined ambiguously. The event + will sometimes list an IP, a domain or a unix socket. You should always store + the raw address in the `.address` field. + + Then it should be duplicated to `.ip` or `.domain`, depending on which one it + is.' + flat_name: destination.address + ignore_above: 1024 + level: extended + name: address + normalize: [] + short: Destination network address. + type: keyword +destination.as.number: + dashed_name: destination-as-number + description: Unique number allocated to the autonomous system. The autonomous system + number (ASN) uniquely identifies each network on the Internet. + example: 15169 + flat_name: destination.as.number + level: extended + name: number + normalize: [] + original_fieldset: as + short: Unique number allocated to the autonomous system. + type: long +destination.as.organization.name: + dashed_name: destination-as-organization-name + description: Organization name. + example: Google LLC + flat_name: destination.as.organization.name + ignore_above: 1024 + level: extended + multi_fields: + - flat_name: destination.as.organization.name.text + name: text + norms: false + type: text + name: organization.name + normalize: [] + original_fieldset: as + short: Organization name. + type: keyword +destination.bytes: + dashed_name: destination-bytes + description: Bytes sent from the destination to the source. + example: 184 + flat_name: destination.bytes + format: bytes + level: core + name: bytes + normalize: [] + short: Bytes sent from the destination to the source. + type: long +destination.domain: + dashed_name: destination-domain + description: Destination domain. + flat_name: destination.domain + ignore_above: 1024 + level: core + name: domain + normalize: [] + short: Destination domain. + type: keyword +destination.geo.city_name: + dashed_name: destination-geo-city-name + description: City name. + example: Montreal + flat_name: destination.geo.city_name + ignore_above: 1024 + level: core + name: city_name + normalize: [] + original_fieldset: geo + short: City name. + type: keyword +destination.geo.continent_name: + dashed_name: destination-geo-continent-name + description: Name of the continent. + example: North America + flat_name: destination.geo.continent_name + ignore_above: 1024 + level: core + name: continent_name + normalize: [] + original_fieldset: geo + short: Name of the continent. + type: keyword +destination.geo.country_iso_code: + dashed_name: destination-geo-country-iso-code + description: Country ISO code. + example: CA + flat_name: destination.geo.country_iso_code + ignore_above: 1024 + level: core + name: country_iso_code + normalize: [] + original_fieldset: geo + short: Country ISO code. + type: keyword +destination.geo.country_name: + dashed_name: destination-geo-country-name + description: Country name. + example: Canada + flat_name: destination.geo.country_name + ignore_above: 1024 + level: core + name: country_name + normalize: [] + original_fieldset: geo + short: Country name. + type: keyword +destination.geo.location: + dashed_name: destination-geo-location + description: Longitude and latitude. + example: '{ "lon": -73.614830, "lat": 45.505918 }' + flat_name: destination.geo.location + level: core + name: location + normalize: [] + original_fieldset: geo + short: Longitude and latitude. + type: geo_point +destination.geo.name: + dashed_name: destination-geo-name + description: 'User-defined description of a location, at the level of granularity + they care about. + + Could be the name of their data centers, the floor number, if this describes a + local physical entity, city names. + + Not typically used in automated geolocation.' + example: boston-dc + flat_name: destination.geo.name + ignore_above: 1024 + level: extended + name: name + normalize: [] + original_fieldset: geo + short: User-defined description of a location. + type: keyword +destination.geo.region_iso_code: + dashed_name: destination-geo-region-iso-code + description: Region ISO code. + example: CA-QC + flat_name: destination.geo.region_iso_code + ignore_above: 1024 + level: core + name: region_iso_code + normalize: [] + original_fieldset: geo + short: Region ISO code. + type: keyword +destination.geo.region_name: + dashed_name: destination-geo-region-name + description: Region name. + example: Quebec + flat_name: destination.geo.region_name + ignore_above: 1024 + level: core + name: region_name + normalize: [] + original_fieldset: geo + short: Region name. + type: keyword +destination.ip: + dashed_name: destination-ip + description: IP address of the destination (IPv4 or IPv6). + flat_name: destination.ip + level: core + name: ip + normalize: [] + short: IP address of the destination. + type: ip +destination.mac: + dashed_name: destination-mac + description: MAC address of the destination. + flat_name: destination.mac + ignore_above: 1024 + level: core + name: mac + normalize: [] + short: MAC address of the destination. + type: keyword +destination.nat.ip: + dashed_name: destination-nat-ip + description: 'Translated ip of destination based NAT sessions (e.g. internet to + private DMZ) + + Typically used with load balancers, firewalls, or routers.' + flat_name: destination.nat.ip + level: extended + name: nat.ip + normalize: [] + short: Destination NAT ip + type: ip +destination.nat.port: + dashed_name: destination-nat-port + description: 'Port the source session is translated to by NAT Device. + + Typically used with load balancers, firewalls, or routers.' + flat_name: destination.nat.port + format: string + level: extended + name: nat.port + normalize: [] + short: Destination NAT Port + type: long +destination.packets: + dashed_name: destination-packets + description: Packets sent from the destination to the source. + example: 12 + flat_name: destination.packets + level: core + name: packets + normalize: [] + short: Packets sent from the destination to the source. + type: long +destination.port: + dashed_name: destination-port + description: Port of the destination. + flat_name: destination.port + format: string + level: core + name: port + normalize: [] + short: Port of the destination. + type: long +destination.registered_domain: + dashed_name: destination-registered-domain + description: 'The highest registered destination domain, stripped of the subdomain. + + For example, the registered domain for "foo.example.com" is "example.com". + + This value can be determined precisely with a list like the public suffix list + (http://publicsuffix.org). Trying to approximate this by simply taking the last + two labels will not work well for TLDs such as "co.uk".' + example: example.com + flat_name: destination.registered_domain + ignore_above: 1024 + level: extended + name: registered_domain + normalize: [] + short: The highest registered destination domain, stripped of the subdomain. + type: keyword +destination.top_level_domain: + dashed_name: destination-top-level-domain + description: 'The effective top level domain (eTLD), also known as the domain suffix, + is the last part of the domain name. For example, the top level domain for example.com + is "com". + + This value can be determined precisely with a list like the public suffix list + (http://publicsuffix.org). Trying to approximate this by simply taking the last + label will not work well for effective TLDs such as "co.uk".' + example: co.uk + flat_name: destination.top_level_domain + ignore_above: 1024 + level: extended + name: top_level_domain + normalize: [] + short: The effective top level domain (com, org, net, co.uk). + type: keyword +destination.user.domain: + dashed_name: destination-user-domain + description: 'Name of the directory the user is a member of. + + For example, an LDAP or Active Directory domain name.' + flat_name: destination.user.domain + ignore_above: 1024 + level: extended + name: domain + normalize: [] + original_fieldset: user + short: Name of the directory the user is a member of. + type: keyword +destination.user.email: + dashed_name: destination-user-email + description: User email address. + flat_name: destination.user.email + ignore_above: 1024 + level: extended + name: email + normalize: [] + original_fieldset: user + short: User email address. + type: keyword +destination.user.full_name: + dashed_name: destination-user-full-name + description: User's full name, if available. + example: Albert Einstein + flat_name: destination.user.full_name + ignore_above: 1024 + level: extended + multi_fields: + - flat_name: destination.user.full_name.text + name: text + norms: false + type: text + name: full_name + normalize: [] + original_fieldset: user + short: User's full name, if available. + type: keyword +destination.user.group.domain: + dashed_name: destination-user-group-domain + description: 'Name of the directory the group is a member of. + + For example, an LDAP or Active Directory domain name.' + flat_name: destination.user.group.domain + ignore_above: 1024 + level: extended + name: domain + normalize: [] + original_fieldset: group + short: Name of the directory the group is a member of. + type: keyword +destination.user.group.id: + dashed_name: destination-user-group-id + description: Unique identifier for the group on the system/platform. + flat_name: destination.user.group.id + ignore_above: 1024 + level: extended + name: id + normalize: [] + original_fieldset: group + short: Unique identifier for the group on the system/platform. + type: keyword +destination.user.group.name: + dashed_name: destination-user-group-name + description: Name of the group. + flat_name: destination.user.group.name + ignore_above: 1024 + level: extended + name: name + normalize: [] + original_fieldset: group + short: Name of the group. + type: keyword +destination.user.hash: + dashed_name: destination-user-hash + description: 'Unique user hash to correlate information for a user in anonymized + form. + + Useful if `user.id` or `user.name` contain confidential information and cannot + be used.' + flat_name: destination.user.hash + ignore_above: 1024 + level: extended + name: hash + normalize: [] + original_fieldset: user + short: Unique user hash to correlate information for a user in anonymized form. + type: keyword +destination.user.id: + dashed_name: destination-user-id + description: Unique identifier of the user. + flat_name: destination.user.id + ignore_above: 1024 + level: core + name: id + normalize: [] + original_fieldset: user + short: Unique identifier of the user. + type: keyword +destination.user.name: + dashed_name: destination-user-name + description: Short name or login of the user. + example: albert + flat_name: destination.user.name + ignore_above: 1024 + level: core + multi_fields: + - flat_name: destination.user.name.text + name: text + norms: false + type: text + name: name + normalize: [] + original_fieldset: user + short: Short name or login of the user. + type: keyword +destination.user.roles: + dashed_name: destination-user-roles + description: Array of user roles at the time of the event. + example: '["kibana_admin", "reporting_user"]' + flat_name: destination.user.roles + ignore_above: 1024 + level: extended + name: roles + normalize: + - array + original_fieldset: user + short: Array of user roles at the time of the event. + type: keyword +ecs.version: + dashed_name: ecs-version + description: 'ECS version this event conforms to. `ecs.version` is a required field + and must exist in all events. + + When querying across multiple indices -- which may conform to slightly different + ECS versions -- this field lets integrations adjust to the schema version of the + events.' + example: 1.0.0 + flat_name: ecs.version + ignore_above: 1024 + level: core + name: version + normalize: [] + required: true + short: ECS version this event conforms to. + type: keyword +event.action: + dashed_name: event-action + description: 'The action captured by the event. + + This describes the information in the event. It is more specific than `event.category`. + Examples are `group-add`, `process-started`, `file-created`. The value is normally + defined by the implementer.' + example: user-password-change + flat_name: event.action + ignore_above: 1024 + level: core + name: action + normalize: [] + short: The action captured by the event. + type: keyword +event.category: + allowed_values: + - description: Events in this category are related to the challenge and response + process in which credentials are supplied and verified to allow the creation + of a session. Common sources for these logs are Windows event logs and ssh logs. + Visualize and analyze events in this category to look for failed logins, and + other authentication-related activity. + expected_event_types: + - start + - end + - info + name: authentication + - description: The database category denotes events and metrics relating to a data + storage and retrieval system. Note that use of this category is not limited + to relational database systems. Examples include event logs from MS SQL, MySQL, + Elasticsearch, MongoDB, etc. Use this category to visualize and analyze database + activity such as accesses and changes. + expected_event_types: + - access + - change + - info + - error + name: database + - description: 'Events in the driver category have to do with operating system device + drivers and similar software entities such as Windows drivers, kernel extensions, + kernel modules, etc. + + Use events and metrics in this category to visualize and analyze driver-related + activity and status on hosts.' + expected_event_types: + - change + - end + - info + - start + name: driver + - description: Relating to a set of information that has been created on, or has + existed on a filesystem. Use this category of events to visualize and analyze + the creation, access, and deletions of files. Events in this category can come + from both host-based and network-based sources. An example source of a network-based + detection of a file transfer would be the Zeek file.log. + expected_event_types: + - change + - creation + - deletion + - info + name: file + - description: 'Use this category to visualize and analyze information such as host + inventory or host lifecycle events. + + Most of the events in this category can usually be observed from the outside, + such as from a hypervisor or a control plane''s point of view. Some can also + be seen from within, such as "start" or "end". + + Note that this category is for information about hosts themselves; it is not + meant to capture activity "happening on a host".' + expected_event_types: + - access + - change + - end + - info + - start + name: host + - description: Identity and access management (IAM) events relating to users, groups, + and administration. Use this category to visualize and analyze IAM-related logs + and data from active directory, LDAP, Okta, Duo, and other IAM systems. + expected_event_types: + - admin + - change + - creation + - deletion + - group + - info + - user + name: iam + - description: Relating to intrusion detections from IDS/IPS systems and functions, + both network and host-based. Use this category to visualize and analyze intrusion + detection alerts from systems such as Snort, Suricata, and Palo Alto threat + detections. + expected_event_types: + - allowed + - denied + - info + name: intrusion_detection + - description: Malware detection events and alerts. Use this category to visualize + and analyze malware detections from EDR/EPP systems such as Elastic Endpoint + Security, Symantec Endpoint Protection, Crowdstrike, and network IDS/IPS systems + such as Suricata, or other sources of malware-related events such as Palo Alto + Networks threat logs and Wildfire logs. + expected_event_types: + - info + name: malware + - description: Relating to all network activity, including network connection lifecycle, + network traffic, and essentially any event that includes an IP address. Many + events containing decoded network protocol transactions fit into this category. + Use events in this category to visualize or analyze counts of network ports, + protocols, addresses, geolocation information, etc. + expected_event_types: + - access + - allowed + - connection + - denied + - end + - info + - protocol + - start + name: network + - description: Relating to software packages installed on hosts. Use this category + to visualize and analyze inventory of software installed on various hosts, or + to determine host vulnerability in the absence of vulnerability scan data. + expected_event_types: + - access + - change + - deletion + - info + - installation + - start + name: package + - description: Use this category of events to visualize and analyze process-specific + information such as lifecycle events or process ancestry. + expected_event_types: + - access + - change + - end + - info + - start + name: process + - description: 'Relating to web server access. Use this category to create a dashboard + of web server/proxy activity from apache, IIS, nginx web servers, etc. Note: + events from network observers such as Zeek http log may also be included in + this category.' + expected_event_types: + - access + - error + - info + name: web + dashed_name: event-category + description: 'This is one of four ECS Categorization Fields, and indicates the second + level in the ECS category hierarchy. + + `event.category` represents the "big buckets" of ECS categories. For example, + filtering on `event.category:process` yields all events relating to process activity. + This field is closely related to `event.type`, which is used as a subcategory. + + This field is an array. This will allow proper categorization of some events that + fall in multiple categories.' + example: authentication + flat_name: event.category + ignore_above: 1024 + level: core + name: category + normalize: + - array + short: Event category. The second categorization field in the hierarchy. + type: keyword +event.code: + dashed_name: event-code + description: 'Identification code for this event, if one exists. + + Some event sources use event codes to identify messages unambiguously, regardless + of message language or wording adjustments over time. An example of this is the + Windows Event ID.' + example: 4648 + flat_name: event.code + ignore_above: 1024 + level: extended + name: code + normalize: [] + short: Identification code for this event. + type: keyword +event.created: + dashed_name: event-created + description: 'event.created contains the date/time when the event was first read + by an agent, or by your pipeline. + + This field is distinct from @timestamp in that @timestamp typically contain the + time extracted from the original event. + + In most situations, these two timestamps will be slightly different. The difference + can be used to calculate the delay between your source generating an event, and + the time when your agent first processed it. This can be used to monitor your + agent''s or pipeline''s ability to keep up with your event source. + + In case the two timestamps are identical, @timestamp should be used.' + example: '2016-05-23T08:05:34.857Z' + flat_name: event.created + level: core + name: created + normalize: [] + short: Time when the event was first read by an agent or by your pipeline. + type: date +event.dataset: + dashed_name: event-dataset + description: 'Name of the dataset. + + If an event source publishes more than one type of log or events (e.g. access + log, error log), the dataset is used to specify which one the event comes from. + + It''s recommended but not required to start the dataset name with the module name, + followed by a dot, then the dataset name.' + example: apache.access + flat_name: event.dataset + ignore_above: 1024 + level: core + name: dataset + normalize: [] + short: Name of the dataset. + type: keyword +event.duration: + dashed_name: event-duration + description: 'Duration of the event in nanoseconds. + + If event.start and event.end are known this value should be the difference between + the end and start time.' + flat_name: event.duration + format: duration + input_format: nanoseconds + level: core + name: duration + normalize: [] + output_format: asMilliseconds + output_precision: 1 + short: Duration of the event in nanoseconds. + type: long +event.end: + dashed_name: event-end + description: event.end contains the date when the event ended or when the activity + was last observed. + flat_name: event.end + level: extended + name: end + normalize: [] + short: event.end contains the date when the event ended or when the activity was + last observed. + type: date +event.hash: + dashed_name: event-hash + description: Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate + log integrity. + example: 123456789012345678901234567890ABCD + flat_name: event.hash + ignore_above: 1024 + level: extended + name: hash + normalize: [] + short: Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate + log integrity. + type: keyword +event.id: + dashed_name: event-id + description: Unique ID to describe the event. + example: 8a4f500d + flat_name: event.id + ignore_above: 1024 + level: core + name: id + normalize: [] + short: Unique ID to describe the event. + type: keyword +event.ingested: + dashed_name: event-ingested + description: 'Timestamp when an event arrived in the central data store. + + This is different from `@timestamp`, which is when the event originally occurred. It''s + also different from `event.created`, which is meant to capture the first time + an agent saw the event. + + In normal conditions, assuming no tampering, the timestamps should chronologically + look like this: `@timestamp` < `event.created` < `event.ingested`.' + example: '2016-05-23T08:05:35.101Z' + flat_name: event.ingested + level: core + name: ingested + normalize: [] + short: Timestamp when an event arrived in the central data store. + type: date +event.kind: + allowed_values: + - description: 'This value indicates an event that describes an alert or notable + event, triggered by a detection rule. + + `event.kind:alert` is often populated for events coming from firewalls, intrusion + detection systems, endpoint detection and response systems, and so on.' + name: alert + - description: This value is the most general and most common value for this field. + It is used to represent events that indicate that something happened. + name: event + - description: 'This value is used to indicate that this event describes a numeric + measurement taken at given point in time. + + Examples include CPU utilization, memory usage, or device temperature. + + Metric events are often collected on a predictable frequency, such as once every + few seconds, or once a minute, but can also be used to describe ad-hoc numeric + metric queries.' + name: metric + - description: 'The state value is similar to metric, indicating that this event + describes a measurement taken at given point in time, except that the measurement + does not result in a numeric value, but rather one of a fixed set of categorical + values that represent conditions or states. + + Examples include periodic events reporting Elasticsearch cluster state (green/yellow/red), + the state of a TCP connection (open, closed, fin_wait, etc.), the state of a + host with respect to a software vulnerability (vulnerable, not vulnerable), + and the state of a system regarding compliance with a regulatory standard (compliant, + not compliant). + + Note that an event that describes a change of state would not use `event.kind:state`, + but instead would use ''event.kind:event'' since a state change fits the more + general event definition of something that happened. + + State events are often collected on a predictable frequency, such as once every + few seconds, once a minute, once an hour, or once a day, but can also be used + to describe ad-hoc state queries.' + name: state + - description: This value indicates that an error occurred during the ingestion + of this event, and that event data may be missing, inconsistent, or incorrect. + `event.kind:pipeline_error` is often associated with parsing errors. + name: pipeline_error + - description: 'This value is used by the Elastic SIEM app to denote an Elasticsearch + document that was created by a SIEM detection engine rule. + + A signal will typically trigger a notification that something meaningful happened + and should be investigated. + + Usage of this value is reserved, and pipelines should not populate `event.kind` + with the value "signal".' + name: signal + dashed_name: event-kind + description: 'This is one of four ECS Categorization Fields, and indicates the highest + level in the ECS category hierarchy. + + `event.kind` gives high-level information about what type of information the event + contains, without being specific to the contents of the event. For example, values + of this field distinguish alert events from metric events. + + The value of this field can be used to inform how these kinds of events should + be handled. They may warrant different retention, different access control, it + may also help understand whether the data coming in at a regular interval or not.' + example: alert + flat_name: event.kind + ignore_above: 1024 + level: core + name: kind + normalize: [] + short: The kind of the event. The highest categorization field in the hierarchy. + type: keyword +event.module: + dashed_name: event-module + description: 'Name of the module this data is coming from. + + If your monitoring agent supports the concept of modules or plugins to process + events of a given source (e.g. Apache logs), `event.module` should contain the + name of this module.' + example: apache + flat_name: event.module + ignore_above: 1024 + level: core + name: module + normalize: [] + short: Name of the module this data is coming from. + type: keyword +event.original: + dashed_name: event-original + description: 'Raw text message of entire event. Used to demonstrate log integrity. + + This field is not indexed and doc_values are disabled. It cannot be searched, + but it can be retrieved from `_source`.' + doc_values: false + example: Sep 19 08:26:10 host CEF:0|Security| threatmanager|1.0|100| + worm successfully stopped|10|src=10.0.0.1 dst=2.1.2.2spt=1232 + flat_name: event.original + ignore_above: 1024 + index: false + level: core + name: original + normalize: [] + short: Raw text message of entire event. + type: keyword +event.outcome: + allowed_values: + - description: Indicates that this event describes a failed result. A common example + is `event.category:file AND event.type:access AND event.outcome:failure` to + indicate that a file access was attempted, but was not successful. + name: failure + - description: Indicates that this event describes a successful result. A common + example is `event.category:file AND event.type:create AND event.outcome:success` + to indicate that a file was successfully created. + name: success + - description: Indicates that this event describes only an attempt for which the + result is unknown from the perspective of the event producer. For example, if + the event contains information only about the request side of a transaction + that results in a response, populating `event.outcome:unknown` in the request + event is appropriate. The unknown value should not be used when an outcome doesn't + make logical sense for the event. In such cases `event.outcome` should not be + populated. + name: unknown + dashed_name: event-outcome + description: 'This is one of four ECS Categorization Fields, and indicates the lowest + level in the ECS category hierarchy. + + `event.outcome` simply denotes whether the event represents a success or a failure + from the perspective of the entity that produced the event. + + Note that when a single transaction is described in multiple events, each event + may populate different values of `event.outcome`, according to their perspective. + + Also note that in the case of a compound event (a single event that contains multiple + logical events), this field should be populated with the value that best captures + the overall success or failure from the perspective of the event producer. + + Further note that not all events will have an associated outcome. For example, + this field is generally not populated for metric events, events with `event.type:info`, + or any events for which an outcome does not make logical sense.' + example: success + flat_name: event.outcome + ignore_above: 1024 + level: core + name: outcome + normalize: [] + short: The outcome of the event. The lowest level categorization field in the hierarchy. + type: keyword +event.provider: + dashed_name: event-provider + description: 'Source of the event. + + Event transports such as Syslog or the Windows Event Log typically mention the + source of an event. It can be the name of the software that generated the event + (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).' + example: kernel + flat_name: event.provider + ignore_above: 1024 + level: extended + name: provider + normalize: [] + short: Source of the event. + type: keyword +event.reason: + dashed_name: event-reason + description: 'Reason why this event happened, according to the source. + + This describes the why of a particular action or outcome captured in the event. + Where `event.action` captures the action from the event, `event.reason` describes + why that action was taken. For example, a web proxy with an `event.action` which + denied the request may also populate `event.reason` with the reason why (e.g. + `blocked site`).' + example: Terminated an unexpected process + flat_name: event.reason + ignore_above: 1024 + level: extended + name: reason + normalize: [] + short: Reason why this event happened, according to the source + type: keyword +event.reference: + dashed_name: event-reference + description: 'Reference URL linking to additional information about this event. + + This URL links to a static definition of the this event. Alert events, indicated + by `event.kind:alert`, are a common use case for this field.' + example: https://system.example.com/event/#0001234 + flat_name: event.reference + ignore_above: 1024 + level: extended + name: reference + normalize: [] + short: Event reference URL + type: keyword +event.risk_score: + dashed_name: event-risk-score + description: Risk score or priority of the event (e.g. security solutions). Use + your system's original value here. + flat_name: event.risk_score + level: core + name: risk_score + normalize: [] + short: Risk score or priority of the event (e.g. security solutions). Use your system's + original value here. + type: float +event.risk_score_norm: + dashed_name: event-risk-score-norm + description: 'Normalized risk score or priority of the event, on a scale of 0 to + 100. + + This is mainly useful if you use more than one system that assigns risk scores, + and you want to see a normalized value across all systems.' + flat_name: event.risk_score_norm + level: extended + name: risk_score_norm + normalize: [] + short: Normalized risk score or priority of the event (0-100). + type: float +event.sequence: + dashed_name: event-sequence + description: 'Sequence number of the event. + + The sequence number is a value published by some event sources, to make the exact + ordering of events unambiguous, regardless of the timestamp precision.' + flat_name: event.sequence + format: string + level: extended + name: sequence + normalize: [] + short: Sequence number of the event. + type: long +event.severity: + dashed_name: event-severity + description: 'The numeric severity of the event according to your event source. + + What the different severity values mean can be different between sources and use + cases. It''s up to the implementer to make sure severities are consistent across + events from the same source. + + The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is + meant to represent the severity according to the event source (e.g. firewall, + IDS). If the event source does not publish its own severity, you may optionally + copy the `log.syslog.severity.code` to `event.severity`.' + example: 7 + flat_name: event.severity + format: string + level: core + name: severity + normalize: [] + short: Numeric severity of the event. + type: long +event.start: + dashed_name: event-start + description: event.start contains the date when the event started or when the activity + was first observed. + flat_name: event.start + level: extended + name: start + normalize: [] + short: event.start contains the date when the event started or when the activity + was first observed. + type: date +event.timezone: + dashed_name: event-timezone + description: 'This field should be populated when the event''s timestamp does not + include timezone information already (e.g. default Syslog timestamps). It''s optional + otherwise. + + Acceptable timezone formats are: a canonical ID (e.g. "Europe/Amsterdam"), abbreviated + (e.g. "EST") or an HH:mm differential (e.g. "-05:00").' + flat_name: event.timezone + ignore_above: 1024 + level: extended + name: timezone + normalize: [] + short: Event time zone. + type: keyword +event.type: + allowed_values: + - description: The access event type is used for the subset of events within a category + that indicate that something was accessed. Common examples include `event.category:database + AND event.type:access`, or `event.category:file AND event.type:access`. Note + for file access, both directory listings and file opens should be included in + this subcategory. You can further distinguish access operations using the ECS + `event.action` field. + name: access + - description: 'The admin event type is used for the subset of events within a category + that are related to admin objects. For example, administrative changes within + an IAM framework that do not specifically affect a user or group (e.g., adding + new applications to a federation solution or connecting discrete forests in + Active Directory) would fall into this subcategory. Common example: `event.category:iam + AND event.type:change AND event.type:admin`. You can further distinguish admin + operations using the ECS `event.action` field.' + name: admin + - description: The allowed event type is used for the subset of events within a + category that indicate that something was allowed. Common examples include `event.category:network + AND event.type:connection AND event.type:allowed` (to indicate a network firewall + event for which the firewall disposition was to allow the connection to complete) + and `event.category:intrusion_detection AND event.type:allowed` (to indicate + a network intrusion prevention system event for which the IPS disposition was + to allow the connection to complete). You can further distinguish allowed operations + using the ECS `event.action` field, populating with values of your choosing, + such as "allow", "detect", or "pass". + name: allowed + - description: The change event type is used for the subset of events within a category + that indicate that something has changed. If semantics best describe an event + as modified, then include them in this subcategory. Common examples include + `event.category:process AND event.type:change`, and `event.category:file AND + event.type:change`. You can further distinguish change operations using the + ECS `event.action` field. + name: change + - description: Used primarily with `event.category:network` this value is used for + the subset of network traffic that includes sufficient information for the event + to be included in flow or connection analysis. Events in this subcategory will + contain at least source and destination IP addresses, source and destination + TCP/UDP ports, and will usually contain counts of bytes and/or packets transferred. + Events in this subcategory may contain unidirectional or bidirectional information, + including summary information. Use this subcategory to visualize and analyze + network connections. Flow analysis, including Netflow, IPFIX, and other flow-related + events fit in this subcategory. Note that firewall events from many Next-Generation + Firewall (NGFW) devices will also fit into this subcategory. A common filter + for flow/connection information would be `event.category:network AND event.type:connection + AND event.type:end` (to view or analyze all completed network connections, ignoring + mid-flow reports). You can further distinguish connection events using the ECS + `event.action` field, populating with values of your choosing, such as "timeout", + or "reset". + name: connection + - description: The "creation" event type is used for the subset of events within + a category that indicate that something was created. A common example is `event.category:file + AND event.type:creation`. + name: creation + - description: The deletion event type is used for the subset of events within a + category that indicate that something was deleted. A common example is `event.category:file + AND event.type:deletion` to indicate that a file has been deleted. + name: deletion + - description: The denied event type is used for the subset of events within a category + that indicate that something was denied. Common examples include `event.category:network + AND event.type:denied` (to indicate a network firewall event for which the firewall + disposition was to deny the connection) and `event.category:intrusion_detection + AND event.type:denied` (to indicate a network intrusion prevention system event + for which the IPS disposition was to deny the connection to complete). You can + further distinguish denied operations using the ECS `event.action` field, populating + with values of your choosing, such as "blocked", "dropped", or "quarantined". + name: denied + - description: The end event type is used for the subset of events within a category + that indicate something has ended. A common example is `event.category:process + AND event.type:end`. + name: end + - description: The error event type is used for the subset of events within a category + that indicate or describe an error. A common example is `event.category:database + AND event.type:error`. Note that pipeline errors that occur during the event + ingestion process should not use this `event.type` value. Instead, they should + use `event.kind:pipeline_error`. + name: error + - description: 'The group event type is used for the subset of events within a category + that are related to group objects. Common example: `event.category:iam AND event.type:creation + AND event.type:group`. You can further distinguish group operations using the + ECS `event.action` field.' + name: group + - description: The info event type is used for the subset of events within a category + that indicate that they are purely informational, and don't report a state change, + or any type of action. For example, an initial run of a file integrity monitoring + system (FIM), where an agent reports all files under management, would fall + into the "info" subcategory. Similarly, an event containing a dump of all currently + running processes (as opposed to reporting that a process started/ended) would + fall into the "info" subcategory. An additional common examples is `event.category:intrusion_detection + AND event.type:info`. + name: info + - description: The installation event type is used for the subset of events within + a category that indicate that something was installed. A common example is `event.category:package` + AND `event.type:installation`. + name: installation + - description: The protocol event type is used for the subset of events within a + category that indicate that they contain protocol details or analysis, beyond + simply identifying the protocol. Generally, network events that contain specific + protocol details will fall into this subcategory. A common example is `event.category:network + AND event.type:protocol AND event.type:connection AND event.type:end` (to indicate + that the event is a network connection event sent at the end of a connection + that also includes a protocol detail breakdown). Note that events that only + indicate the name or id of the protocol should not use the protocol value. Further + note that when the protocol subcategory is used, the identified protocol is + populated in the ECS `network.protocol` field. + expected_event_types: + - access + - change + - end + - info + - start + name: protocol + - description: The start event type is used for the subset of events within a category + that indicate something has started. A common example is `event.category:process + AND event.type:start`. + name: start + - description: 'The user event type is used for the subset of events within a category + that are related to user objects. Common example: `event.category:iam AND event.type:deletion + AND event.type:user`. You can further distinguish user operations using the + ECS `event.action` field.' + name: user + dashed_name: event-type + description: 'This is one of four ECS Categorization Fields, and indicates the third + level in the ECS category hierarchy. + + `event.type` represents a categorization "sub-bucket" that, when used along with + the `event.category` field values, enables filtering events down to a level appropriate + for single visualization. + + This field is an array. This will allow proper categorization of some events that + fall in multiple event types.' + flat_name: event.type + ignore_above: 1024 + level: core + name: type + normalize: + - array + short: Event type. The third categorization field in the hierarchy. + type: keyword +event.url: + dashed_name: event-url + description: 'URL linking to an external system to continue investigation of this + event. + + This URL links to another system where in-depth investigation of the specific + occurrence of this event can take place. Alert events, indicated by `event.kind:alert`, + are a common use case for this field.' + example: https://mysystem.example.com/alert/5271dedb-f5b0-4218-87f0-4ac4870a38fe + flat_name: event.url + ignore_above: 1024 + level: extended + name: url + normalize: [] + short: Event investigation URL + type: keyword +http.request.body.bytes: + dashed_name: http-request-body-bytes + description: Size in bytes of the request body. + example: 887 + flat_name: http.request.body.bytes + format: bytes + level: extended + name: request.body.bytes + normalize: [] + short: Size in bytes of the request body. + type: long +http.request.body.content: + dashed_name: http-request-body-content + description: The full HTTP request body. + example: Hello world + flat_name: http.request.body.content + ignore_above: 1024 + level: extended + multi_fields: + - flat_name: http.request.body.content.text + name: text + norms: false + type: text + name: request.body.content + normalize: [] + short: The full HTTP request body. + type: keyword +http.request.bytes: + dashed_name: http-request-bytes + description: Total size in bytes of the request (body and headers). + example: 1437 + flat_name: http.request.bytes + format: bytes + level: extended + name: request.bytes + normalize: [] + short: Total size in bytes of the request (body and headers). + type: long +http.request.method: + dashed_name: http-request-method + description: 'HTTP request method. + + Prior to ECS 1.6.0 the following guidance was provided: + + "The field value must be normalized to lowercase for querying." + + As of ECS 1.6.0, the guidance is deprecated because the original case of the method + may be useful in anomaly detection. Original case will be mandated in ECS 2.0.0' + example: GET, POST, PUT, PoST + flat_name: http.request.method + ignore_above: 1024 + level: extended + name: request.method + normalize: [] + short: HTTP request method. + type: keyword +http.request.referrer: + dashed_name: http-request-referrer + description: Referrer for this HTTP request. + example: https://blog.example.com/ + flat_name: http.request.referrer + ignore_above: 1024 + level: extended + name: request.referrer + normalize: [] + short: Referrer for this HTTP request. + type: keyword +http.response.body.bytes: + dashed_name: http-response-body-bytes + description: Size in bytes of the response body. + example: 887 + flat_name: http.response.body.bytes + format: bytes + level: extended + name: response.body.bytes + normalize: [] + short: Size in bytes of the response body. + type: long +http.response.body.content: + dashed_name: http-response-body-content + description: The full HTTP response body. + example: Hello world + flat_name: http.response.body.content + ignore_above: 1024 + level: extended + multi_fields: + - flat_name: http.response.body.content.text + name: text + norms: false + type: text + name: response.body.content + normalize: [] + short: The full HTTP response body. + type: keyword +http.response.bytes: + dashed_name: http-response-bytes + description: Total size in bytes of the response (body and headers). + example: 1437 + flat_name: http.response.bytes + format: bytes + level: extended + name: response.bytes + normalize: [] + short: Total size in bytes of the response (body and headers). + type: long +http.response.status_code: + dashed_name: http-response-status-code + description: HTTP response status code. + example: 404 + flat_name: http.response.status_code + format: string + level: extended + name: response.status_code + normalize: [] + short: HTTP response status code. + type: long +http.version: + dashed_name: http-version + description: HTTP version. + example: 1.1 + flat_name: http.version + ignore_above: 1024 + level: extended + name: version + normalize: [] + short: HTTP version. + type: keyword +labels: + dashed_name: labels + description: 'Custom key/value pairs. + + Can be used to add meta information to events. Should not contain nested objects. + All values are stored as keyword. + + Example: `docker` and `k8s` labels.' + example: '{"application": "foo-bar", "env": "production"}' + flat_name: labels + level: core + name: labels + normalize: [] + object_type: keyword + short: Custom key/value pairs. + type: object +message: + dashed_name: message + description: 'For log events the message field contains the log message, optimized + for viewing in a log viewer. + + For structured logs without an original message field, other fields can be concatenated + to form a human-readable summary of the event. + + If multiple messages exist, they can be combined into one message.' + example: Hello World + flat_name: message + level: core + name: message + normalize: [] + norms: false + short: Log message optimized for viewing in a log viewer. + type: text +network.application: + dashed_name: network-application + description: 'A name given to an application level protocol. This can be arbitrarily + assigned for things like microservices, but also apply to things like skype, icq, + facebook, twitter. This would be used in situations where the vendor or service + can be decoded such as from the source/dest IP owners, ports, or wire format. + + The field value must be normalized to lowercase for querying. See the documentation + section "Implementing ECS".' + example: aim + flat_name: network.application + ignore_above: 1024 + level: extended + name: application + normalize: [] + short: Application level protocol name. + type: keyword +network.bytes: + dashed_name: network-bytes + description: 'Total bytes transferred in both directions. + + If `source.bytes` and `destination.bytes` are known, `network.bytes` is their + sum.' + example: 368 + flat_name: network.bytes + format: bytes + level: core + name: bytes + normalize: [] + short: Total bytes transferred in both directions. + type: long +network.community_id: + dashed_name: network-community-id + description: 'A hash of source and destination IPs and ports, as well as the protocol + used in a communication. This is a tool-agnostic standard to identify flows. + + Learn more at https://github.com/corelight/community-id-spec.' + example: 1:hO+sN4H+MG5MY/8hIrXPqc4ZQz0= + flat_name: network.community_id + ignore_above: 1024 + level: extended + name: community_id + normalize: [] + short: A hash of source and destination IPs and ports. + type: keyword +network.direction: + dashed_name: network-direction + description: "Direction of the network traffic.\nRecommended values are:\n * inbound\n\ + \ * outbound\n * internal\n * external\n * unknown\n\nWhen mapping events\ + \ from a host-based monitoring context, populate this field from the host's point\ + \ of view.\nWhen mapping events from a network or perimeter-based monitoring context,\ + \ populate this field from the point of view of your network perimeter." + example: inbound + flat_name: network.direction + ignore_above: 1024 + level: core + name: direction + normalize: [] + short: Direction of the network traffic. + type: keyword +network.forwarded_ip: + dashed_name: network-forwarded-ip + description: Host IP address when the source IP address is the proxy. + example: 192.1.1.2 + flat_name: network.forwarded_ip + level: core + name: forwarded_ip + normalize: [] + short: Host IP address when the source IP address is the proxy. + type: ip +network.iana_number: + dashed_name: network-iana-number + description: IANA Protocol Number (https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml). + Standardized list of protocols. This aligns well with NetFlow and sFlow related + logs which use the IANA Protocol Number. + example: 6 + flat_name: network.iana_number + ignore_above: 1024 + level: extended + name: iana_number + normalize: [] + short: IANA Protocol Number. + type: keyword +network.inner: + dashed_name: network-inner + description: Network.inner fields are added in addition to network.vlan fields to + describe the innermost VLAN when q-in-q VLAN tagging is present. Allowed fields + include vlan.id and vlan.name. Inner vlan fields are typically used when sending + traffic with multiple 802.1q encapsulations to a network sensor (e.g. Zeek, Wireshark.) + flat_name: network.inner + level: extended + name: inner + normalize: [] + short: Inner VLAN tag information + type: object +network.inner.vlan.id: + dashed_name: network-inner-vlan-id + description: VLAN ID as reported by the observer. + example: 10 + flat_name: network.inner.vlan.id + ignore_above: 1024 + level: extended + name: id + normalize: [] + original_fieldset: vlan + short: VLAN ID as reported by the observer. + type: keyword +network.inner.vlan.name: + dashed_name: network-inner-vlan-name + description: Optional VLAN name as reported by the observer. + example: outside + flat_name: network.inner.vlan.name + ignore_above: 1024 + level: extended + name: name + normalize: [] + original_fieldset: vlan + short: Optional VLAN name as reported by the observer. + type: keyword +network.name: + dashed_name: network-name + description: Name given by operators to sections of their network. + example: Guest Wifi + flat_name: network.name + ignore_above: 1024 + level: extended + name: name + normalize: [] + short: Name given by operators to sections of their network. + type: keyword +network.packets: + dashed_name: network-packets + description: 'Total packets transferred in both directions. + + If `source.packets` and `destination.packets` are known, `network.packets` is + their sum.' + example: 24 + flat_name: network.packets + level: core + name: packets + normalize: [] + short: Total packets transferred in both directions. + type: long +network.protocol: + dashed_name: network-protocol + description: 'L7 Network protocol name. ex. http, lumberjack, transport protocol. + + The field value must be normalized to lowercase for querying. See the documentation + section "Implementing ECS".' + example: http + flat_name: network.protocol + ignore_above: 1024 + level: core + name: protocol + normalize: [] + short: L7 Network protocol name. + type: keyword +network.transport: + dashed_name: network-transport + description: 'Same as network.iana_number, but instead using the Keyword name of + the transport layer (udp, tcp, ipv6-icmp, etc.) + + The field value must be normalized to lowercase for querying. See the documentation + section "Implementing ECS".' + example: tcp + flat_name: network.transport + ignore_above: 1024 + level: core + name: transport + normalize: [] + short: Protocol Name corresponding to the field `iana_number`. + type: keyword +network.type: + dashed_name: network-type + description: 'In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, + pim, etc + + The field value must be normalized to lowercase for querying. See the documentation + section "Implementing ECS".' + example: ipv4 + flat_name: network.type + ignore_above: 1024 + level: core + name: type + normalize: [] + short: In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, + etc + type: keyword +network.vlan.id: + dashed_name: network-vlan-id + description: VLAN ID as reported by the observer. + example: 10 + flat_name: network.vlan.id + ignore_above: 1024 + level: extended + name: id + normalize: [] + original_fieldset: vlan + short: VLAN ID as reported by the observer. + type: keyword +network.vlan.name: + dashed_name: network-vlan-name + description: Optional VLAN name as reported by the observer. + example: outside + flat_name: network.vlan.name + ignore_above: 1024 + level: extended + name: name + normalize: [] + original_fieldset: vlan + short: Optional VLAN name as reported by the observer. + type: keyword +related.ip: + dashed_name: related-ip + description: All of the IPs seen on your event. + flat_name: related.ip + level: extended + name: ip + normalize: + - array + short: All of the IPs seen on your event. + type: ip +related.user: + dashed_name: related-user + description: All the user names seen on your event. + flat_name: related.user + ignore_above: 1024 + level: extended + name: user + normalize: + - array + short: All the user names seen on your event. + type: keyword +server.address: + dashed_name: server-address + description: 'Some event server addresses are defined ambiguously. The event will + sometimes list an IP, a domain or a unix socket. You should always store the + raw address in the `.address` field. + + Then it should be duplicated to `.ip` or `.domain`, depending on which one it + is.' + flat_name: server.address + ignore_above: 1024 + level: extended + name: address + normalize: [] + short: Server network address. + type: keyword +server.as.number: + dashed_name: server-as-number + description: Unique number allocated to the autonomous system. The autonomous system + number (ASN) uniquely identifies each network on the Internet. + example: 15169 + flat_name: server.as.number + level: extended + name: number + normalize: [] + original_fieldset: as + short: Unique number allocated to the autonomous system. + type: long +server.as.organization.name: + dashed_name: server-as-organization-name + description: Organization name. + example: Google LLC + flat_name: server.as.organization.name + ignore_above: 1024 + level: extended + multi_fields: + - flat_name: server.as.organization.name.text + name: text + norms: false + type: text + name: organization.name + normalize: [] + original_fieldset: as + short: Organization name. + type: keyword +server.bytes: + dashed_name: server-bytes + description: Bytes sent from the server to the client. + example: 184 + flat_name: server.bytes + format: bytes + level: core + name: bytes + normalize: [] + short: Bytes sent from the server to the client. + type: long +server.domain: + dashed_name: server-domain + description: Server domain. + flat_name: server.domain + ignore_above: 1024 + level: core + name: domain + normalize: [] + short: Server domain. + type: keyword +server.geo.city_name: + dashed_name: server-geo-city-name + description: City name. + example: Montreal + flat_name: server.geo.city_name + ignore_above: 1024 + level: core + name: city_name + normalize: [] + original_fieldset: geo + short: City name. + type: keyword +server.geo.continent_name: + dashed_name: server-geo-continent-name + description: Name of the continent. + example: North America + flat_name: server.geo.continent_name + ignore_above: 1024 + level: core + name: continent_name + normalize: [] + original_fieldset: geo + short: Name of the continent. + type: keyword +server.geo.country_iso_code: + dashed_name: server-geo-country-iso-code + description: Country ISO code. + example: CA + flat_name: server.geo.country_iso_code + ignore_above: 1024 + level: core + name: country_iso_code + normalize: [] + original_fieldset: geo + short: Country ISO code. + type: keyword +server.geo.country_name: + dashed_name: server-geo-country-name + description: Country name. + example: Canada + flat_name: server.geo.country_name + ignore_above: 1024 + level: core + name: country_name + normalize: [] + original_fieldset: geo + short: Country name. + type: keyword +server.geo.location: + dashed_name: server-geo-location + description: Longitude and latitude. + example: '{ "lon": -73.614830, "lat": 45.505918 }' + flat_name: server.geo.location + level: core + name: location + normalize: [] + original_fieldset: geo + short: Longitude and latitude. + type: geo_point +server.geo.name: + dashed_name: server-geo-name + description: 'User-defined description of a location, at the level of granularity + they care about. + + Could be the name of their data centers, the floor number, if this describes a + local physical entity, city names. + + Not typically used in automated geolocation.' + example: boston-dc + flat_name: server.geo.name + ignore_above: 1024 + level: extended + name: name + normalize: [] + original_fieldset: geo + short: User-defined description of a location. + type: keyword +server.geo.region_iso_code: + dashed_name: server-geo-region-iso-code + description: Region ISO code. + example: CA-QC + flat_name: server.geo.region_iso_code + ignore_above: 1024 + level: core + name: region_iso_code + normalize: [] + original_fieldset: geo + short: Region ISO code. + type: keyword +server.geo.region_name: + dashed_name: server-geo-region-name + description: Region name. + example: Quebec + flat_name: server.geo.region_name + ignore_above: 1024 + level: core + name: region_name + normalize: [] + original_fieldset: geo + short: Region name. + type: keyword +server.ip: + dashed_name: server-ip + description: IP address of the server (IPv4 or IPv6). + flat_name: server.ip + level: core + name: ip + normalize: [] + short: IP address of the server. + type: ip +server.mac: + dashed_name: server-mac + description: MAC address of the server. + flat_name: server.mac + ignore_above: 1024 + level: core + name: mac + normalize: [] + short: MAC address of the server. + type: keyword +server.nat.ip: + dashed_name: server-nat-ip + description: 'Translated ip of destination based NAT sessions (e.g. internet to + private DMZ) + + Typically used with load balancers, firewalls, or routers.' + flat_name: server.nat.ip + level: extended + name: nat.ip + normalize: [] + short: Server NAT ip + type: ip +server.nat.port: + dashed_name: server-nat-port + description: 'Translated port of destination based NAT sessions (e.g. internet to + private DMZ) + + Typically used with load balancers, firewalls, or routers.' + flat_name: server.nat.port + format: string + level: extended + name: nat.port + normalize: [] + short: Server NAT port + type: long +server.packets: + dashed_name: server-packets + description: Packets sent from the server to the client. + example: 12 + flat_name: server.packets + level: core + name: packets + normalize: [] + short: Packets sent from the server to the client. + type: long +server.port: + dashed_name: server-port + description: Port of the server. + flat_name: server.port + format: string + level: core + name: port + normalize: [] + short: Port of the server. + type: long +server.registered_domain: + dashed_name: server-registered-domain + description: 'The highest registered server domain, stripped of the subdomain. + + For example, the registered domain for "foo.example.com" is "example.com". + + This value can be determined precisely with a list like the public suffix list + (http://publicsuffix.org). Trying to approximate this by simply taking the last + two labels will not work well for TLDs such as "co.uk".' + example: example.com + flat_name: server.registered_domain + ignore_above: 1024 + level: extended + name: registered_domain + normalize: [] + short: The highest registered server domain, stripped of the subdomain. + type: keyword +server.top_level_domain: + dashed_name: server-top-level-domain + description: 'The effective top level domain (eTLD), also known as the domain suffix, + is the last part of the domain name. For example, the top level domain for example.com + is "com". + + This value can be determined precisely with a list like the public suffix list + (http://publicsuffix.org). Trying to approximate this by simply taking the last + label will not work well for effective TLDs such as "co.uk".' + example: co.uk + flat_name: server.top_level_domain + ignore_above: 1024 + level: extended + name: top_level_domain + normalize: [] + short: The effective top level domain (com, org, net, co.uk). + type: keyword +server.user.domain: + dashed_name: server-user-domain + description: 'Name of the directory the user is a member of. + + For example, an LDAP or Active Directory domain name.' + flat_name: server.user.domain + ignore_above: 1024 + level: extended + name: domain + normalize: [] + original_fieldset: user + short: Name of the directory the user is a member of. + type: keyword +server.user.email: + dashed_name: server-user-email + description: User email address. + flat_name: server.user.email + ignore_above: 1024 + level: extended + name: email + normalize: [] + original_fieldset: user + short: User email address. + type: keyword +server.user.full_name: + dashed_name: server-user-full-name + description: User's full name, if available. + example: Albert Einstein + flat_name: server.user.full_name + ignore_above: 1024 + level: extended + multi_fields: + - flat_name: server.user.full_name.text + name: text + norms: false + type: text + name: full_name + normalize: [] + original_fieldset: user + short: User's full name, if available. + type: keyword +server.user.group.domain: + dashed_name: server-user-group-domain + description: 'Name of the directory the group is a member of. + + For example, an LDAP or Active Directory domain name.' + flat_name: server.user.group.domain + ignore_above: 1024 + level: extended + name: domain + normalize: [] + original_fieldset: group + short: Name of the directory the group is a member of. + type: keyword +server.user.group.id: + dashed_name: server-user-group-id + description: Unique identifier for the group on the system/platform. + flat_name: server.user.group.id + ignore_above: 1024 + level: extended + name: id + normalize: [] + original_fieldset: group + short: Unique identifier for the group on the system/platform. + type: keyword +server.user.group.name: + dashed_name: server-user-group-name + description: Name of the group. + flat_name: server.user.group.name + ignore_above: 1024 + level: extended + name: name + normalize: [] + original_fieldset: group + short: Name of the group. + type: keyword +server.user.hash: + dashed_name: server-user-hash + description: 'Unique user hash to correlate information for a user in anonymized + form. + + Useful if `user.id` or `user.name` contain confidential information and cannot + be used.' + flat_name: server.user.hash + ignore_above: 1024 + level: extended + name: hash + normalize: [] + original_fieldset: user + short: Unique user hash to correlate information for a user in anonymized form. + type: keyword +server.user.id: + dashed_name: server-user-id + description: Unique identifier of the user. + flat_name: server.user.id + ignore_above: 1024 + level: core + name: id + normalize: [] + original_fieldset: user + short: Unique identifier of the user. + type: keyword +server.user.name: + dashed_name: server-user-name + description: Short name or login of the user. + example: albert + flat_name: server.user.name + ignore_above: 1024 + level: core + multi_fields: + - flat_name: server.user.name.text + name: text + norms: false + type: text + name: name + normalize: [] + original_fieldset: user + short: Short name or login of the user. + type: keyword +server.user.roles: + dashed_name: server-user-roles + description: Array of user roles at the time of the event. + example: '["kibana_admin", "reporting_user"]' + flat_name: server.user.roles + ignore_above: 1024 + level: extended + name: roles + normalize: + - array + original_fieldset: user + short: Array of user roles at the time of the event. + type: keyword +source.address: + dashed_name: source-address + description: 'Some event source addresses are defined ambiguously. The event will + sometimes list an IP, a domain or a unix socket. You should always store the + raw address in the `.address` field. + + Then it should be duplicated to `.ip` or `.domain`, depending on which one it + is.' + flat_name: source.address + ignore_above: 1024 + level: extended + name: address + normalize: [] + short: Source network address. + type: keyword +source.as.number: + dashed_name: source-as-number + description: Unique number allocated to the autonomous system. The autonomous system + number (ASN) uniquely identifies each network on the Internet. + example: 15169 + flat_name: source.as.number + level: extended + name: number + normalize: [] + original_fieldset: as + short: Unique number allocated to the autonomous system. + type: long +source.as.organization.name: + dashed_name: source-as-organization-name + description: Organization name. + example: Google LLC + flat_name: source.as.organization.name + ignore_above: 1024 + level: extended + multi_fields: + - flat_name: source.as.organization.name.text + name: text + norms: false + type: text + name: organization.name + normalize: [] + original_fieldset: as + short: Organization name. + type: keyword +source.bytes: + dashed_name: source-bytes + description: Bytes sent from the source to the destination. + example: 184 + flat_name: source.bytes + format: bytes + level: core + name: bytes + normalize: [] + short: Bytes sent from the source to the destination. + type: long +source.domain: + dashed_name: source-domain + description: Source domain. + flat_name: source.domain + ignore_above: 1024 + level: core + name: domain + normalize: [] + short: Source domain. + type: keyword +source.geo.city_name: + dashed_name: source-geo-city-name + description: City name. + example: Montreal + flat_name: source.geo.city_name + ignore_above: 1024 + level: core + name: city_name + normalize: [] + original_fieldset: geo + short: City name. + type: keyword +source.geo.continent_name: + dashed_name: source-geo-continent-name + description: Name of the continent. + example: North America + flat_name: source.geo.continent_name + ignore_above: 1024 + level: core + name: continent_name + normalize: [] + original_fieldset: geo + short: Name of the continent. + type: keyword +source.geo.country_iso_code: + dashed_name: source-geo-country-iso-code + description: Country ISO code. + example: CA + flat_name: source.geo.country_iso_code + ignore_above: 1024 + level: core + name: country_iso_code + normalize: [] + original_fieldset: geo + short: Country ISO code. + type: keyword +source.geo.country_name: + dashed_name: source-geo-country-name + description: Country name. + example: Canada + flat_name: source.geo.country_name + ignore_above: 1024 + level: core + name: country_name + normalize: [] + original_fieldset: geo + short: Country name. + type: keyword +source.geo.location: + dashed_name: source-geo-location + description: Longitude and latitude. + example: '{ "lon": -73.614830, "lat": 45.505918 }' + flat_name: source.geo.location + level: core + name: location + normalize: [] + original_fieldset: geo + short: Longitude and latitude. + type: geo_point +source.geo.name: + dashed_name: source-geo-name + description: 'User-defined description of a location, at the level of granularity + they care about. + + Could be the name of their data centers, the floor number, if this describes a + local physical entity, city names. + + Not typically used in automated geolocation.' + example: boston-dc + flat_name: source.geo.name + ignore_above: 1024 + level: extended + name: name + normalize: [] + original_fieldset: geo + short: User-defined description of a location. + type: keyword +source.geo.region_iso_code: + dashed_name: source-geo-region-iso-code + description: Region ISO code. + example: CA-QC + flat_name: source.geo.region_iso_code + ignore_above: 1024 + level: core + name: region_iso_code + normalize: [] + original_fieldset: geo + short: Region ISO code. + type: keyword +source.geo.region_name: + dashed_name: source-geo-region-name + description: Region name. + example: Quebec + flat_name: source.geo.region_name + ignore_above: 1024 + level: core + name: region_name + normalize: [] + original_fieldset: geo + short: Region name. + type: keyword +source.ip: + dashed_name: source-ip + description: IP address of the source (IPv4 or IPv6). + flat_name: source.ip + level: core + name: ip + normalize: [] + short: IP address of the source. + type: ip +source.mac: + dashed_name: source-mac + description: MAC address of the source. + flat_name: source.mac + ignore_above: 1024 + level: core + name: mac + normalize: [] + short: MAC address of the source. + type: keyword +source.nat.ip: + dashed_name: source-nat-ip + description: 'Translated ip of source based NAT sessions (e.g. internal client to + internet) + + Typically connections traversing load balancers, firewalls, or routers.' + flat_name: source.nat.ip + level: extended + name: nat.ip + normalize: [] + short: Source NAT ip + type: ip +source.nat.port: + dashed_name: source-nat-port + description: 'Translated port of source based NAT sessions. (e.g. internal client + to internet) + + Typically used with load balancers, firewalls, or routers.' + flat_name: source.nat.port + format: string + level: extended + name: nat.port + normalize: [] + short: Source NAT port + type: long +source.packets: + dashed_name: source-packets + description: Packets sent from the source to the destination. + example: 12 + flat_name: source.packets + level: core + name: packets + normalize: [] + short: Packets sent from the source to the destination. + type: long +source.port: + dashed_name: source-port + description: Port of the source. + flat_name: source.port + format: string + level: core + name: port + normalize: [] + short: Port of the source. + type: long +source.registered_domain: + dashed_name: source-registered-domain + description: 'The highest registered source domain, stripped of the subdomain. + + For example, the registered domain for "foo.example.com" is "example.com". + + This value can be determined precisely with a list like the public suffix list + (http://publicsuffix.org). Trying to approximate this by simply taking the last + two labels will not work well for TLDs such as "co.uk".' + example: example.com + flat_name: source.registered_domain + ignore_above: 1024 + level: extended + name: registered_domain + normalize: [] + short: The highest registered source domain, stripped of the subdomain. + type: keyword +source.top_level_domain: + dashed_name: source-top-level-domain + description: 'The effective top level domain (eTLD), also known as the domain suffix, + is the last part of the domain name. For example, the top level domain for example.com + is "com". + + This value can be determined precisely with a list like the public suffix list + (http://publicsuffix.org). Trying to approximate this by simply taking the last + label will not work well for effective TLDs such as "co.uk".' + example: co.uk + flat_name: source.top_level_domain + ignore_above: 1024 + level: extended + name: top_level_domain + normalize: [] + short: The effective top level domain (com, org, net, co.uk). + type: keyword +source.user.domain: + dashed_name: source-user-domain + description: 'Name of the directory the user is a member of. + + For example, an LDAP or Active Directory domain name.' + flat_name: source.user.domain + ignore_above: 1024 + level: extended + name: domain + normalize: [] + original_fieldset: user + short: Name of the directory the user is a member of. + type: keyword +source.user.email: + dashed_name: source-user-email + description: User email address. + flat_name: source.user.email + ignore_above: 1024 + level: extended + name: email + normalize: [] + original_fieldset: user + short: User email address. + type: keyword +source.user.full_name: + dashed_name: source-user-full-name + description: User's full name, if available. + example: Albert Einstein + flat_name: source.user.full_name + ignore_above: 1024 + level: extended + multi_fields: + - flat_name: source.user.full_name.text + name: text + norms: false + type: text + name: full_name + normalize: [] + original_fieldset: user + short: User's full name, if available. + type: keyword +source.user.group.domain: + dashed_name: source-user-group-domain + description: 'Name of the directory the group is a member of. + + For example, an LDAP or Active Directory domain name.' + flat_name: source.user.group.domain + ignore_above: 1024 + level: extended + name: domain + normalize: [] + original_fieldset: group + short: Name of the directory the group is a member of. + type: keyword +source.user.group.id: + dashed_name: source-user-group-id + description: Unique identifier for the group on the system/platform. + flat_name: source.user.group.id + ignore_above: 1024 + level: extended + name: id + normalize: [] + original_fieldset: group + short: Unique identifier for the group on the system/platform. + type: keyword +source.user.group.name: + dashed_name: source-user-group-name + description: Name of the group. + flat_name: source.user.group.name + ignore_above: 1024 + level: extended + name: name + normalize: [] + original_fieldset: group + short: Name of the group. + type: keyword +source.user.hash: + dashed_name: source-user-hash + description: 'Unique user hash to correlate information for a user in anonymized + form. + + Useful if `user.id` or `user.name` contain confidential information and cannot + be used.' + flat_name: source.user.hash + ignore_above: 1024 + level: extended + name: hash + normalize: [] + original_fieldset: user + short: Unique user hash to correlate information for a user in anonymized form. + type: keyword +source.user.id: + dashed_name: source-user-id + description: Unique identifier of the user. + flat_name: source.user.id + ignore_above: 1024 + level: core + name: id + normalize: [] + original_fieldset: user + short: Unique identifier of the user. + type: keyword +source.user.name: + dashed_name: source-user-name + description: Short name or login of the user. + example: albert + flat_name: source.user.name + ignore_above: 1024 + level: core + multi_fields: + - flat_name: source.user.name.text + name: text + norms: false + type: text + name: name + normalize: [] + original_fieldset: user + short: Short name or login of the user. + type: keyword +source.user.roles: + dashed_name: source-user-roles + description: Array of user roles at the time of the event. + example: '["kibana_admin", "reporting_user"]' + flat_name: source.user.roles + ignore_above: 1024 + level: extended + name: roles + normalize: + - array + original_fieldset: user + short: Array of user roles at the time of the event. + type: keyword +tags: + dashed_name: tags + description: List of keywords used to tag each event. + example: '["production", "env2"]' + flat_name: tags + ignore_above: 1024 + level: core + name: tags + normalize: + - array + short: List of keywords used to tag each event. + type: keyword +url.domain: + dashed_name: url-domain + description: 'Domain of the url, such as "www.elastic.co". + + In some cases a URL may refer to an IP and/or port directly, without a domain + name. In this case, the IP address would go to the `domain` field.' + example: www.elastic.co + flat_name: url.domain + ignore_above: 1024 + level: extended + name: domain + normalize: [] + short: Domain of the url. + type: keyword +url.extension: + dashed_name: url-extension + description: 'The field contains the file extension from the original request url. + + The file extension is only set if it exists, as not every url has a file extension. + + The leading period must not be included. For example, the value must be "png", + not ".png".' + example: png + flat_name: url.extension + ignore_above: 1024 + level: extended + name: extension + normalize: [] + short: File extension from the original request url. + type: keyword +url.fragment: + dashed_name: url-fragment + description: 'Portion of the url after the `#`, such as "top". + + The `#` is not part of the fragment.' + flat_name: url.fragment + ignore_above: 1024 + level: extended + name: fragment + normalize: [] + short: Portion of the url after the `#`. + type: keyword +url.full: + dashed_name: url-full + description: If full URLs are important to your use case, they should be stored + in `url.full`, whether this field is reconstructed or present in the event source. + example: https://www.elastic.co:443/search?q=elasticsearch#top + flat_name: url.full + ignore_above: 1024 + level: extended + multi_fields: + - flat_name: url.full.text + name: text + norms: false + type: text + name: full + normalize: [] + short: Full unparsed URL. + type: keyword +url.original: + dashed_name: url-original + description: 'Unmodified original url as seen in the event source. + + Note that in network monitoring, the observed URL may be a full URL, whereas in + access logs, the URL is often just represented as a path. + + This field is meant to represent the URL as it was observed, complete or not.' + example: https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch + flat_name: url.original + ignore_above: 1024 + level: extended + multi_fields: + - flat_name: url.original.text + name: text + norms: false + type: text + name: original + normalize: [] + short: Unmodified original url as seen in the event source. + type: keyword +url.password: + dashed_name: url-password + description: Password of the request. + flat_name: url.password + ignore_above: 1024 + level: extended + name: password + normalize: [] + short: Password of the request. + type: keyword +url.path: + dashed_name: url-path + description: Path of the request, such as "/search". + flat_name: url.path + ignore_above: 1024 + level: extended + name: path + normalize: [] + short: Path of the request, such as "/search". + type: keyword +url.port: + dashed_name: url-port + description: Port of the request, such as 443. + example: 443 + flat_name: url.port + format: string + level: extended + name: port + normalize: [] + short: Port of the request, such as 443. + type: long +url.query: + dashed_name: url-query + description: 'The query field describes the query string of the request, such as + "q=elasticsearch". + + The `?` is excluded from the query string. If a URL contains no `?`, there is + no query field. If there is a `?` but no query, the query field exists with an + empty string. The `exists` query can be used to differentiate between the two + cases.' + flat_name: url.query + ignore_above: 1024 + level: extended + name: query + normalize: [] + short: Query string of the request. + type: keyword +url.registered_domain: + dashed_name: url-registered-domain + description: 'The highest registered url domain, stripped of the subdomain. + + For example, the registered domain for "foo.example.com" is "example.com". + + This value can be determined precisely with a list like the public suffix list + (http://publicsuffix.org). Trying to approximate this by simply taking the last + two labels will not work well for TLDs such as "co.uk".' + example: example.com + flat_name: url.registered_domain + ignore_above: 1024 + level: extended + name: registered_domain + normalize: [] + short: The highest registered url domain, stripped of the subdomain. + type: keyword +url.scheme: + dashed_name: url-scheme + description: 'Scheme of the request, such as "https". + + Note: The `:` is not part of the scheme.' + example: https + flat_name: url.scheme + ignore_above: 1024 + level: extended + name: scheme + normalize: [] + short: Scheme of the url. + type: keyword +url.top_level_domain: + dashed_name: url-top-level-domain + description: 'The effective top level domain (eTLD), also known as the domain suffix, + is the last part of the domain name. For example, the top level domain for example.com + is "com". + + This value can be determined precisely with a list like the public suffix list + (http://publicsuffix.org). Trying to approximate this by simply taking the last + label will not work well for effective TLDs such as "co.uk".' + example: co.uk + flat_name: url.top_level_domain + ignore_above: 1024 + level: extended + name: top_level_domain + normalize: [] + short: The effective top level domain (com, org, net, co.uk). + type: keyword +url.username: + dashed_name: url-username + description: Username of the request. + flat_name: url.username + ignore_above: 1024 + level: extended + name: username + normalize: [] + short: Username of the request. + type: keyword +user.name: + dashed_name: user-name + description: Short name or login of the user. + example: albert + flat_name: user.name + ignore_above: 1024 + level: core + multi_fields: + - flat_name: user.name.text + name: text + norms: false + type: text + name: name + normalize: [] + short: Short name or login of the user. + type: keyword +user_agent.device.name: + dashed_name: user-agent-device-name + description: Name of the device. + example: iPhone + flat_name: user_agent.device.name + ignore_above: 1024 + level: extended + name: device.name + normalize: [] + short: Name of the device. + type: keyword +user_agent.name: + dashed_name: user-agent-name + description: Name of the user agent. + example: Safari + flat_name: user_agent.name + ignore_above: 1024 + level: extended + name: name + normalize: [] + short: Name of the user agent. + type: keyword +user_agent.original: + dashed_name: user-agent-original + description: Unparsed user_agent string. + example: Mozilla/5.0 (iPhone; CPU iPhone OS 12_1 like Mac OS X) AppleWebKit/605.1.15 + (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1 + flat_name: user_agent.original + ignore_above: 1024 + level: extended + multi_fields: + - flat_name: user_agent.original.text + name: text + norms: false + type: text + name: original + normalize: [] + short: Unparsed user_agent string. + type: keyword +user_agent.os.family: + dashed_name: user-agent-os-family + description: OS family (such as redhat, debian, freebsd, windows). + example: debian + flat_name: user_agent.os.family + ignore_above: 1024 + level: extended + name: family + normalize: [] + original_fieldset: os + short: OS family (such as redhat, debian, freebsd, windows). + type: keyword +user_agent.os.full: + dashed_name: user-agent-os-full + description: Operating system name, including the version or code name. + example: Mac OS Mojave + flat_name: user_agent.os.full + ignore_above: 1024 + level: extended + multi_fields: + - flat_name: user_agent.os.full.text + name: text + norms: false + type: text + name: full + normalize: [] + original_fieldset: os + short: Operating system name, including the version or code name. + type: keyword +user_agent.os.kernel: + dashed_name: user-agent-os-kernel + description: Operating system kernel version as a raw string. + example: 4.4.0-112-generic + flat_name: user_agent.os.kernel + ignore_above: 1024 + level: extended + name: kernel + normalize: [] + original_fieldset: os + short: Operating system kernel version as a raw string. + type: keyword +user_agent.os.name: + dashed_name: user-agent-os-name + description: Operating system name, without the version. + example: Mac OS X + flat_name: user_agent.os.name + ignore_above: 1024 + level: extended + multi_fields: + - flat_name: user_agent.os.name.text + name: text + norms: false + type: text + name: name + normalize: [] + original_fieldset: os + short: Operating system name, without the version. + type: keyword +user_agent.os.platform: + dashed_name: user-agent-os-platform + description: Operating system platform (such centos, ubuntu, windows). + example: darwin + flat_name: user_agent.os.platform + ignore_above: 1024 + level: extended + name: platform + normalize: [] + original_fieldset: os + short: Operating system platform (such centos, ubuntu, windows). + type: keyword +user_agent.os.version: + dashed_name: user-agent-os-version + description: Operating system version as a raw string. + example: 10.14.1 + flat_name: user_agent.os.version + ignore_above: 1024 + level: extended + name: version + normalize: [] + original_fieldset: os + short: Operating system version as a raw string. + type: keyword +user_agent.version: + dashed_name: user-agent-version + description: Version of the user agent. + example: 12.0 + flat_name: user_agent.version + ignore_above: 1024 + level: extended + name: version + normalize: [] + short: Version of the user agent. + type: keyword diff --git a/usage-example/generated/ecs/ecs_nested.yml b/usage-example/generated/ecs/ecs_nested.yml new file mode 100644 index 0000000000..82675ddcfc --- /dev/null +++ b/usage-example/generated/ecs/ecs_nested.yml @@ -0,0 +1,3500 @@ +acme: + description: Acme Inc. custom fields + fields: + acme.account.id: + dashed_name: acme-account-id + description: Customer account for this activity. + flat_name: acme.account.id + ignore_above: 1024 + level: custom + name: account.id + normalize: [] + short: Customer account for this activity. + type: keyword + group: 2 + name: acme + prefix: acme. + short: Acme Inc. custom fields + title: ACME + type: group +agent: + description: 'The agent fields contain the data about the software entity, if any, + that collects, detects, or observes events on a host, or takes measurements on + a host. + + Examples include Beats. Agents may also run on observers. ECS agent.* fields shall + be populated with details of the agent running on the host or observer where the + event happened or the measurement was taken.' + fields: + agent.build.original: + dashed_name: agent-build-original + description: 'Extended build information for the agent. + + This field is intended to contain any build information that a data source + may provide, no specific formatting is required.' + example: metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c + built 2020-02-05 23:10:10 +0000 UTC] + flat_name: agent.build.original + ignore_above: 1024 + level: core + name: build.original + normalize: [] + short: Extended build information for the agent. + type: keyword + agent.ephemeral_id: + dashed_name: agent-ephemeral-id + description: 'Ephemeral identifier of this agent (if one exists). + + This id normally changes across restarts, but `agent.id` does not.' + example: 8a4f500f + flat_name: agent.ephemeral_id + ignore_above: 1024 + level: extended + name: ephemeral_id + normalize: [] + short: Ephemeral identifier of this agent. + type: keyword + agent.id: + dashed_name: agent-id + description: 'Unique identifier of this agent (if one exists). + + Example: For Beats this would be beat.id.' + example: 8a4f500d + flat_name: agent.id + ignore_above: 1024 + level: core + name: id + normalize: [] + short: Unique identifier of this agent. + type: keyword + agent.name: + dashed_name: agent-name + description: 'Custom name of the agent. + + This is a name that can be given to an agent. This can be helpful if for example + two Filebeat instances are running on the same host but a human readable separation + is needed on which Filebeat instance data is coming from. + + If no name is given, the name is often left empty.' + example: foo + flat_name: agent.name + ignore_above: 1024 + level: core + name: name + normalize: [] + short: Custom name of the agent. + type: keyword + agent.type: + dashed_name: agent-type + description: 'Type of the agent. + + The agent type always stays the same and should be given by the agent used. + In case of Filebeat the agent would always be Filebeat also if two Filebeat + instances are run on the same machine.' + example: filebeat + flat_name: agent.type + ignore_above: 1024 + level: core + name: type + normalize: [] + short: Type of the agent. + type: keyword + agent.version: + dashed_name: agent-version + description: Version of the agent. + example: 6.0.0-rc2 + flat_name: agent.version + ignore_above: 1024 + level: core + name: version + normalize: [] + short: Version of the agent. + type: keyword + footnote: 'Examples: In the case of Beats for logs, the agent.name is filebeat. + For APM, it is the agent running in the app/service. The agent information does + not change if data is sent through queuing systems like Kafka, Redis, or processing + systems such as Logstash or APM Server.' + group: 2 + name: agent + prefix: agent. + short: Fields about the monitoring agent. + title: Agent + type: group +base: + description: The `base` field set contains all fields which are at the root of the + events. These fields are common across all types of events. + fields: + '@timestamp': + dashed_name: -timestamp + description: 'Date/time when the event originated. + + This is the date/time extracted from the event, typically representing when + the event was generated by the source. + + If the event source has no original timestamp, this value is typically populated + by the first time the event was received by the pipeline. + + Required field for all events.' + example: '2016-05-23T08:05:34.853Z' + flat_name: '@timestamp' + level: core + name: '@timestamp' + normalize: [] + required: true + short: Date/time when the event originated. + type: date + labels: + dashed_name: labels + description: 'Custom key/value pairs. + + Can be used to add meta information to events. Should not contain nested objects. + All values are stored as keyword. + + Example: `docker` and `k8s` labels.' + example: '{"application": "foo-bar", "env": "production"}' + flat_name: labels + level: core + name: labels + normalize: [] + object_type: keyword + short: Custom key/value pairs. + type: object + message: + dashed_name: message + description: 'For log events the message field contains the log message, optimized + for viewing in a log viewer. + + For structured logs without an original message field, other fields can be + concatenated to form a human-readable summary of the event. + + If multiple messages exist, they can be combined into one message.' + example: Hello World + flat_name: message + level: core + name: message + normalize: [] + norms: false + short: Log message optimized for viewing in a log viewer. + type: text + tags: + dashed_name: tags + description: List of keywords used to tag each event. + example: '["production", "env2"]' + flat_name: tags + ignore_above: 1024 + level: core + name: tags + normalize: + - array + short: List of keywords used to tag each event. + type: keyword + group: 1 + name: base + prefix: '' + root: true + short: All fields defined directly at the root of the events. + title: Base + type: group +client: + description: 'A client is defined as the initiator of a network connection for events + regarding sessions, connections, or bidirectional flow records. + + For TCP events, the client is the initiator of the TCP connection that sends the + SYN packet(s). For other protocols, the client is generally the initiator or requestor + in the network transaction. Some systems use the term "originator" to refer the + client in TCP connections. The client fields describe details about the system + acting as the client in the network event. Client fields are usually populated + in conjunction with server fields. Client fields are generally not populated for + packet-level events. + + Client / server representations can add semantic context to an exchange, which + is helpful to visualize the data in certain situations. If your context falls + in that category, you should still ensure that source and destination are filled + appropriately.' + fields: + client.address: + dashed_name: client-address + description: 'Some event client addresses are defined ambiguously. The event + will sometimes list an IP, a domain or a unix socket. You should always store + the raw address in the `.address` field. + + Then it should be duplicated to `.ip` or `.domain`, depending on which one + it is.' + flat_name: client.address + ignore_above: 1024 + level: extended + name: address + normalize: [] + short: Client network address. + type: keyword + client.as.number: + dashed_name: client-as-number + description: Unique number allocated to the autonomous system. The autonomous + system number (ASN) uniquely identifies each network on the Internet. + example: 15169 + flat_name: client.as.number + level: extended + name: number + normalize: [] + original_fieldset: as + short: Unique number allocated to the autonomous system. + type: long + client.as.organization.name: + dashed_name: client-as-organization-name + description: Organization name. + example: Google LLC + flat_name: client.as.organization.name + ignore_above: 1024 + level: extended + multi_fields: + - flat_name: client.as.organization.name.text + name: text + norms: false + type: text + name: organization.name + normalize: [] + original_fieldset: as + short: Organization name. + type: keyword + client.bytes: + dashed_name: client-bytes + description: Bytes sent from the client to the server. + example: 184 + flat_name: client.bytes + format: bytes + level: core + name: bytes + normalize: [] + short: Bytes sent from the client to the server. + type: long + client.domain: + dashed_name: client-domain + description: Client domain. + flat_name: client.domain + ignore_above: 1024 + level: core + name: domain + normalize: [] + short: Client domain. + type: keyword + client.geo.city_name: + dashed_name: client-geo-city-name + description: City name. + example: Montreal + flat_name: client.geo.city_name + ignore_above: 1024 + level: core + name: city_name + normalize: [] + original_fieldset: geo + short: City name. + type: keyword + client.geo.continent_name: + dashed_name: client-geo-continent-name + description: Name of the continent. + example: North America + flat_name: client.geo.continent_name + ignore_above: 1024 + level: core + name: continent_name + normalize: [] + original_fieldset: geo + short: Name of the continent. + type: keyword + client.geo.country_iso_code: + dashed_name: client-geo-country-iso-code + description: Country ISO code. + example: CA + flat_name: client.geo.country_iso_code + ignore_above: 1024 + level: core + name: country_iso_code + normalize: [] + original_fieldset: geo + short: Country ISO code. + type: keyword + client.geo.country_name: + dashed_name: client-geo-country-name + description: Country name. + example: Canada + flat_name: client.geo.country_name + ignore_above: 1024 + level: core + name: country_name + normalize: [] + original_fieldset: geo + short: Country name. + type: keyword + client.geo.location: + dashed_name: client-geo-location + description: Longitude and latitude. + example: '{ "lon": -73.614830, "lat": 45.505918 }' + flat_name: client.geo.location + level: core + name: location + normalize: [] + original_fieldset: geo + short: Longitude and latitude. + type: geo_point + client.geo.name: + dashed_name: client-geo-name + description: 'User-defined description of a location, at the level of granularity + they care about. + + Could be the name of their data centers, the floor number, if this describes + a local physical entity, city names. + + Not typically used in automated geolocation.' + example: boston-dc + flat_name: client.geo.name + ignore_above: 1024 + level: extended + name: name + normalize: [] + original_fieldset: geo + short: User-defined description of a location. + type: keyword + client.geo.region_iso_code: + dashed_name: client-geo-region-iso-code + description: Region ISO code. + example: CA-QC + flat_name: client.geo.region_iso_code + ignore_above: 1024 + level: core + name: region_iso_code + normalize: [] + original_fieldset: geo + short: Region ISO code. + type: keyword + client.geo.region_name: + dashed_name: client-geo-region-name + description: Region name. + example: Quebec + flat_name: client.geo.region_name + ignore_above: 1024 + level: core + name: region_name + normalize: [] + original_fieldset: geo + short: Region name. + type: keyword + client.ip: + dashed_name: client-ip + description: IP address of the client (IPv4 or IPv6). + flat_name: client.ip + level: core + name: ip + normalize: [] + short: IP address of the client. + type: ip + client.mac: + dashed_name: client-mac + description: MAC address of the client. + flat_name: client.mac + ignore_above: 1024 + level: core + name: mac + normalize: [] + short: MAC address of the client. + type: keyword + client.nat.ip: + dashed_name: client-nat-ip + description: 'Translated IP of source based NAT sessions (e.g. internal client + to internet). + + Typically connections traversing load balancers, firewalls, or routers.' + flat_name: client.nat.ip + level: extended + name: nat.ip + normalize: [] + short: Client NAT ip address + type: ip + client.nat.port: + dashed_name: client-nat-port + description: 'Translated port of source based NAT sessions (e.g. internal client + to internet). + + Typically connections traversing load balancers, firewalls, or routers.' + flat_name: client.nat.port + format: string + level: extended + name: nat.port + normalize: [] + short: Client NAT port + type: long + client.packets: + dashed_name: client-packets + description: Packets sent from the client to the server. + example: 12 + flat_name: client.packets + level: core + name: packets + normalize: [] + short: Packets sent from the client to the server. + type: long + client.port: + dashed_name: client-port + description: Port of the client. + flat_name: client.port + format: string + level: core + name: port + normalize: [] + short: Port of the client. + type: long + client.registered_domain: + dashed_name: client-registered-domain + description: 'The highest registered client domain, stripped of the subdomain. + + For example, the registered domain for "foo.example.com" is "example.com". + + This value can be determined precisely with a list like the public suffix + list (http://publicsuffix.org). Trying to approximate this by simply taking + the last two labels will not work well for TLDs such as "co.uk".' + example: example.com + flat_name: client.registered_domain + ignore_above: 1024 + level: extended + name: registered_domain + normalize: [] + short: The highest registered client domain, stripped of the subdomain. + type: keyword + client.top_level_domain: + dashed_name: client-top-level-domain + description: 'The effective top level domain (eTLD), also known as the domain + suffix, is the last part of the domain name. For example, the top level domain + for example.com is "com". + + This value can be determined precisely with a list like the public suffix + list (http://publicsuffix.org). Trying to approximate this by simply taking + the last label will not work well for effective TLDs such as "co.uk".' + example: co.uk + flat_name: client.top_level_domain + ignore_above: 1024 + level: extended + name: top_level_domain + normalize: [] + short: The effective top level domain (com, org, net, co.uk). + type: keyword + client.user.domain: + dashed_name: client-user-domain + description: 'Name of the directory the user is a member of. + + For example, an LDAP or Active Directory domain name.' + flat_name: client.user.domain + ignore_above: 1024 + level: extended + name: domain + normalize: [] + original_fieldset: user + short: Name of the directory the user is a member of. + type: keyword + client.user.email: + dashed_name: client-user-email + description: User email address. + flat_name: client.user.email + ignore_above: 1024 + level: extended + name: email + normalize: [] + original_fieldset: user + short: User email address. + type: keyword + client.user.full_name: + dashed_name: client-user-full-name + description: User's full name, if available. + example: Albert Einstein + flat_name: client.user.full_name + ignore_above: 1024 + level: extended + multi_fields: + - flat_name: client.user.full_name.text + name: text + norms: false + type: text + name: full_name + normalize: [] + original_fieldset: user + short: User's full name, if available. + type: keyword + client.user.group.domain: + dashed_name: client-user-group-domain + description: 'Name of the directory the group is a member of. + + For example, an LDAP or Active Directory domain name.' + flat_name: client.user.group.domain + ignore_above: 1024 + level: extended + name: domain + normalize: [] + original_fieldset: group + short: Name of the directory the group is a member of. + type: keyword + client.user.group.id: + dashed_name: client-user-group-id + description: Unique identifier for the group on the system/platform. + flat_name: client.user.group.id + ignore_above: 1024 + level: extended + name: id + normalize: [] + original_fieldset: group + short: Unique identifier for the group on the system/platform. + type: keyword + client.user.group.name: + dashed_name: client-user-group-name + description: Name of the group. + flat_name: client.user.group.name + ignore_above: 1024 + level: extended + name: name + normalize: [] + original_fieldset: group + short: Name of the group. + type: keyword + client.user.hash: + dashed_name: client-user-hash + description: 'Unique user hash to correlate information for a user in anonymized + form. + + Useful if `user.id` or `user.name` contain confidential information and cannot + be used.' + flat_name: client.user.hash + ignore_above: 1024 + level: extended + name: hash + normalize: [] + original_fieldset: user + short: Unique user hash to correlate information for a user in anonymized form. + type: keyword + client.user.id: + dashed_name: client-user-id + description: Unique identifier of the user. + flat_name: client.user.id + ignore_above: 1024 + level: core + name: id + normalize: [] + original_fieldset: user + short: Unique identifier of the user. + type: keyword + client.user.name: + dashed_name: client-user-name + description: Short name or login of the user. + example: albert + flat_name: client.user.name + ignore_above: 1024 + level: core + multi_fields: + - flat_name: client.user.name.text + name: text + norms: false + type: text + name: name + normalize: [] + original_fieldset: user + short: Short name or login of the user. + type: keyword + client.user.roles: + dashed_name: client-user-roles + description: Array of user roles at the time of the event. + example: '["kibana_admin", "reporting_user"]' + flat_name: client.user.roles + ignore_above: 1024 + level: extended + name: roles + normalize: + - array + original_fieldset: user + short: Array of user roles at the time of the event. + type: keyword + group: 2 + name: client + nestings: + - client.as + - client.geo + - client.user + prefix: client. + reused_here: + - full: client.as + schema_name: as + short: Fields describing an Autonomous System (Internet routing prefix). + - full: client.geo + schema_name: geo + short: Fields describing a location. + - full: client.user + schema_name: user + short: Fields to describe the user relevant to the event. + short: Fields about the client side of a network connection, used with server. + title: Client + type: group +destination: + description: 'Destination fields describe details about the destination of a packet/event. + + Destination fields are usually populated in conjunction with source fields.' + fields: + destination.address: + dashed_name: destination-address + description: 'Some event destination addresses are defined ambiguously. The + event will sometimes list an IP, a domain or a unix socket. You should always + store the raw address in the `.address` field. + + Then it should be duplicated to `.ip` or `.domain`, depending on which one + it is.' + flat_name: destination.address + ignore_above: 1024 + level: extended + name: address + normalize: [] + short: Destination network address. + type: keyword + destination.as.number: + dashed_name: destination-as-number + description: Unique number allocated to the autonomous system. The autonomous + system number (ASN) uniquely identifies each network on the Internet. + example: 15169 + flat_name: destination.as.number + level: extended + name: number + normalize: [] + original_fieldset: as + short: Unique number allocated to the autonomous system. + type: long + destination.as.organization.name: + dashed_name: destination-as-organization-name + description: Organization name. + example: Google LLC + flat_name: destination.as.organization.name + ignore_above: 1024 + level: extended + multi_fields: + - flat_name: destination.as.organization.name.text + name: text + norms: false + type: text + name: organization.name + normalize: [] + original_fieldset: as + short: Organization name. + type: keyword + destination.bytes: + dashed_name: destination-bytes + description: Bytes sent from the destination to the source. + example: 184 + flat_name: destination.bytes + format: bytes + level: core + name: bytes + normalize: [] + short: Bytes sent from the destination to the source. + type: long + destination.domain: + dashed_name: destination-domain + description: Destination domain. + flat_name: destination.domain + ignore_above: 1024 + level: core + name: domain + normalize: [] + short: Destination domain. + type: keyword + destination.geo.city_name: + dashed_name: destination-geo-city-name + description: City name. + example: Montreal + flat_name: destination.geo.city_name + ignore_above: 1024 + level: core + name: city_name + normalize: [] + original_fieldset: geo + short: City name. + type: keyword + destination.geo.continent_name: + dashed_name: destination-geo-continent-name + description: Name of the continent. + example: North America + flat_name: destination.geo.continent_name + ignore_above: 1024 + level: core + name: continent_name + normalize: [] + original_fieldset: geo + short: Name of the continent. + type: keyword + destination.geo.country_iso_code: + dashed_name: destination-geo-country-iso-code + description: Country ISO code. + example: CA + flat_name: destination.geo.country_iso_code + ignore_above: 1024 + level: core + name: country_iso_code + normalize: [] + original_fieldset: geo + short: Country ISO code. + type: keyword + destination.geo.country_name: + dashed_name: destination-geo-country-name + description: Country name. + example: Canada + flat_name: destination.geo.country_name + ignore_above: 1024 + level: core + name: country_name + normalize: [] + original_fieldset: geo + short: Country name. + type: keyword + destination.geo.location: + dashed_name: destination-geo-location + description: Longitude and latitude. + example: '{ "lon": -73.614830, "lat": 45.505918 }' + flat_name: destination.geo.location + level: core + name: location + normalize: [] + original_fieldset: geo + short: Longitude and latitude. + type: geo_point + destination.geo.name: + dashed_name: destination-geo-name + description: 'User-defined description of a location, at the level of granularity + they care about. + + Could be the name of their data centers, the floor number, if this describes + a local physical entity, city names. + + Not typically used in automated geolocation.' + example: boston-dc + flat_name: destination.geo.name + ignore_above: 1024 + level: extended + name: name + normalize: [] + original_fieldset: geo + short: User-defined description of a location. + type: keyword + destination.geo.region_iso_code: + dashed_name: destination-geo-region-iso-code + description: Region ISO code. + example: CA-QC + flat_name: destination.geo.region_iso_code + ignore_above: 1024 + level: core + name: region_iso_code + normalize: [] + original_fieldset: geo + short: Region ISO code. + type: keyword + destination.geo.region_name: + dashed_name: destination-geo-region-name + description: Region name. + example: Quebec + flat_name: destination.geo.region_name + ignore_above: 1024 + level: core + name: region_name + normalize: [] + original_fieldset: geo + short: Region name. + type: keyword + destination.ip: + dashed_name: destination-ip + description: IP address of the destination (IPv4 or IPv6). + flat_name: destination.ip + level: core + name: ip + normalize: [] + short: IP address of the destination. + type: ip + destination.mac: + dashed_name: destination-mac + description: MAC address of the destination. + flat_name: destination.mac + ignore_above: 1024 + level: core + name: mac + normalize: [] + short: MAC address of the destination. + type: keyword + destination.nat.ip: + dashed_name: destination-nat-ip + description: 'Translated ip of destination based NAT sessions (e.g. internet + to private DMZ) + + Typically used with load balancers, firewalls, or routers.' + flat_name: destination.nat.ip + level: extended + name: nat.ip + normalize: [] + short: Destination NAT ip + type: ip + destination.nat.port: + dashed_name: destination-nat-port + description: 'Port the source session is translated to by NAT Device. + + Typically used with load balancers, firewalls, or routers.' + flat_name: destination.nat.port + format: string + level: extended + name: nat.port + normalize: [] + short: Destination NAT Port + type: long + destination.packets: + dashed_name: destination-packets + description: Packets sent from the destination to the source. + example: 12 + flat_name: destination.packets + level: core + name: packets + normalize: [] + short: Packets sent from the destination to the source. + type: long + destination.port: + dashed_name: destination-port + description: Port of the destination. + flat_name: destination.port + format: string + level: core + name: port + normalize: [] + short: Port of the destination. + type: long + destination.registered_domain: + dashed_name: destination-registered-domain + description: 'The highest registered destination domain, stripped of the subdomain. + + For example, the registered domain for "foo.example.com" is "example.com". + + This value can be determined precisely with a list like the public suffix + list (http://publicsuffix.org). Trying to approximate this by simply taking + the last two labels will not work well for TLDs such as "co.uk".' + example: example.com + flat_name: destination.registered_domain + ignore_above: 1024 + level: extended + name: registered_domain + normalize: [] + short: The highest registered destination domain, stripped of the subdomain. + type: keyword + destination.top_level_domain: + dashed_name: destination-top-level-domain + description: 'The effective top level domain (eTLD), also known as the domain + suffix, is the last part of the domain name. For example, the top level domain + for example.com is "com". + + This value can be determined precisely with a list like the public suffix + list (http://publicsuffix.org). Trying to approximate this by simply taking + the last label will not work well for effective TLDs such as "co.uk".' + example: co.uk + flat_name: destination.top_level_domain + ignore_above: 1024 + level: extended + name: top_level_domain + normalize: [] + short: The effective top level domain (com, org, net, co.uk). + type: keyword + destination.user.domain: + dashed_name: destination-user-domain + description: 'Name of the directory the user is a member of. + + For example, an LDAP or Active Directory domain name.' + flat_name: destination.user.domain + ignore_above: 1024 + level: extended + name: domain + normalize: [] + original_fieldset: user + short: Name of the directory the user is a member of. + type: keyword + destination.user.email: + dashed_name: destination-user-email + description: User email address. + flat_name: destination.user.email + ignore_above: 1024 + level: extended + name: email + normalize: [] + original_fieldset: user + short: User email address. + type: keyword + destination.user.full_name: + dashed_name: destination-user-full-name + description: User's full name, if available. + example: Albert Einstein + flat_name: destination.user.full_name + ignore_above: 1024 + level: extended + multi_fields: + - flat_name: destination.user.full_name.text + name: text + norms: false + type: text + name: full_name + normalize: [] + original_fieldset: user + short: User's full name, if available. + type: keyword + destination.user.group.domain: + dashed_name: destination-user-group-domain + description: 'Name of the directory the group is a member of. + + For example, an LDAP or Active Directory domain name.' + flat_name: destination.user.group.domain + ignore_above: 1024 + level: extended + name: domain + normalize: [] + original_fieldset: group + short: Name of the directory the group is a member of. + type: keyword + destination.user.group.id: + dashed_name: destination-user-group-id + description: Unique identifier for the group on the system/platform. + flat_name: destination.user.group.id + ignore_above: 1024 + level: extended + name: id + normalize: [] + original_fieldset: group + short: Unique identifier for the group on the system/platform. + type: keyword + destination.user.group.name: + dashed_name: destination-user-group-name + description: Name of the group. + flat_name: destination.user.group.name + ignore_above: 1024 + level: extended + name: name + normalize: [] + original_fieldset: group + short: Name of the group. + type: keyword + destination.user.hash: + dashed_name: destination-user-hash + description: 'Unique user hash to correlate information for a user in anonymized + form. + + Useful if `user.id` or `user.name` contain confidential information and cannot + be used.' + flat_name: destination.user.hash + ignore_above: 1024 + level: extended + name: hash + normalize: [] + original_fieldset: user + short: Unique user hash to correlate information for a user in anonymized form. + type: keyword + destination.user.id: + dashed_name: destination-user-id + description: Unique identifier of the user. + flat_name: destination.user.id + ignore_above: 1024 + level: core + name: id + normalize: [] + original_fieldset: user + short: Unique identifier of the user. + type: keyword + destination.user.name: + dashed_name: destination-user-name + description: Short name or login of the user. + example: albert + flat_name: destination.user.name + ignore_above: 1024 + level: core + multi_fields: + - flat_name: destination.user.name.text + name: text + norms: false + type: text + name: name + normalize: [] + original_fieldset: user + short: Short name or login of the user. + type: keyword + destination.user.roles: + dashed_name: destination-user-roles + description: Array of user roles at the time of the event. + example: '["kibana_admin", "reporting_user"]' + flat_name: destination.user.roles + ignore_above: 1024 + level: extended + name: roles + normalize: + - array + original_fieldset: user + short: Array of user roles at the time of the event. + type: keyword + group: 2 + name: destination + nestings: + - destination.as + - destination.geo + - destination.user + prefix: destination. + reused_here: + - full: destination.as + schema_name: as + short: Fields describing an Autonomous System (Internet routing prefix). + - full: destination.geo + schema_name: geo + short: Fields describing a location. + - full: destination.user + schema_name: user + short: Fields to describe the user relevant to the event. + short: Fields about the destination side of a network connection, used with source. + title: Destination + type: group +ecs: + description: Meta-information specific to ECS. + fields: + ecs.version: + dashed_name: ecs-version + description: 'ECS version this event conforms to. `ecs.version` is a required + field and must exist in all events. + + When querying across multiple indices -- which may conform to slightly different + ECS versions -- this field lets integrations adjust to the schema version + of the events.' + example: 1.0.0 + flat_name: ecs.version + ignore_above: 1024 + level: core + name: version + normalize: [] + required: true + short: ECS version this event conforms to. + type: keyword + group: 2 + name: ecs + prefix: ecs. + short: Meta-information specific to ECS. + title: ECS + type: group +event: + description: 'The event fields are used for context information about the log or + metric event itself. + + A log is defined as an event containing details of something that happened. Log + events must include the time at which the thing happened. Examples of log events + include a process starting on a host, a network packet being sent from a source + to a destination, or a network connection between a client and a server being + initiated or closed. A metric is defined as an event containing one or more numerical + measurements and the time at which the measurement was taken. Examples of metric + events include memory pressure measured on a host and device temperature. See + the `event.kind` definition in this section for additional details about metric + and state events.' + fields: + event.action: + dashed_name: event-action + description: 'The action captured by the event. + + This describes the information in the event. It is more specific than `event.category`. + Examples are `group-add`, `process-started`, `file-created`. The value is + normally defined by the implementer.' + example: user-password-change + flat_name: event.action + ignore_above: 1024 + level: core + name: action + normalize: [] + short: The action captured by the event. + type: keyword + event.category: + allowed_values: + - description: Events in this category are related to the challenge and response + process in which credentials are supplied and verified to allow the creation + of a session. Common sources for these logs are Windows event logs and ssh + logs. Visualize and analyze events in this category to look for failed logins, + and other authentication-related activity. + expected_event_types: + - start + - end + - info + name: authentication + - description: The database category denotes events and metrics relating to + a data storage and retrieval system. Note that use of this category is not + limited to relational database systems. Examples include event logs from + MS SQL, MySQL, Elasticsearch, MongoDB, etc. Use this category to visualize + and analyze database activity such as accesses and changes. + expected_event_types: + - access + - change + - info + - error + name: database + - description: 'Events in the driver category have to do with operating system + device drivers and similar software entities such as Windows drivers, kernel + extensions, kernel modules, etc. + + Use events and metrics in this category to visualize and analyze driver-related + activity and status on hosts.' + expected_event_types: + - change + - end + - info + - start + name: driver + - description: Relating to a set of information that has been created on, or + has existed on a filesystem. Use this category of events to visualize and + analyze the creation, access, and deletions of files. Events in this category + can come from both host-based and network-based sources. An example source + of a network-based detection of a file transfer would be the Zeek file.log. + expected_event_types: + - change + - creation + - deletion + - info + name: file + - description: 'Use this category to visualize and analyze information such + as host inventory or host lifecycle events. + + Most of the events in this category can usually be observed from the outside, + such as from a hypervisor or a control plane''s point of view. Some can + also be seen from within, such as "start" or "end". + + Note that this category is for information about hosts themselves; it is + not meant to capture activity "happening on a host".' + expected_event_types: + - access + - change + - end + - info + - start + name: host + - description: Identity and access management (IAM) events relating to users, + groups, and administration. Use this category to visualize and analyze IAM-related + logs and data from active directory, LDAP, Okta, Duo, and other IAM systems. + expected_event_types: + - admin + - change + - creation + - deletion + - group + - info + - user + name: iam + - description: Relating to intrusion detections from IDS/IPS systems and functions, + both network and host-based. Use this category to visualize and analyze + intrusion detection alerts from systems such as Snort, Suricata, and Palo + Alto threat detections. + expected_event_types: + - allowed + - denied + - info + name: intrusion_detection + - description: Malware detection events and alerts. Use this category to visualize + and analyze malware detections from EDR/EPP systems such as Elastic Endpoint + Security, Symantec Endpoint Protection, Crowdstrike, and network IDS/IPS + systems such as Suricata, or other sources of malware-related events such + as Palo Alto Networks threat logs and Wildfire logs. + expected_event_types: + - info + name: malware + - description: Relating to all network activity, including network connection + lifecycle, network traffic, and essentially any event that includes an IP + address. Many events containing decoded network protocol transactions fit + into this category. Use events in this category to visualize or analyze + counts of network ports, protocols, addresses, geolocation information, + etc. + expected_event_types: + - access + - allowed + - connection + - denied + - end + - info + - protocol + - start + name: network + - description: Relating to software packages installed on hosts. Use this category + to visualize and analyze inventory of software installed on various hosts, + or to determine host vulnerability in the absence of vulnerability scan + data. + expected_event_types: + - access + - change + - deletion + - info + - installation + - start + name: package + - description: Use this category of events to visualize and analyze process-specific + information such as lifecycle events or process ancestry. + expected_event_types: + - access + - change + - end + - info + - start + name: process + - description: 'Relating to web server access. Use this category to create a + dashboard of web server/proxy activity from apache, IIS, nginx web servers, + etc. Note: events from network observers such as Zeek http log may also + be included in this category.' + expected_event_types: + - access + - error + - info + name: web + dashed_name: event-category + description: 'This is one of four ECS Categorization Fields, and indicates the + second level in the ECS category hierarchy. + + `event.category` represents the "big buckets" of ECS categories. For example, + filtering on `event.category:process` yields all events relating to process + activity. This field is closely related to `event.type`, which is used as + a subcategory. + + This field is an array. This will allow proper categorization of some events + that fall in multiple categories.' + example: authentication + flat_name: event.category + ignore_above: 1024 + level: core + name: category + normalize: + - array + short: Event category. The second categorization field in the hierarchy. + type: keyword + event.code: + dashed_name: event-code + description: 'Identification code for this event, if one exists. + + Some event sources use event codes to identify messages unambiguously, regardless + of message language or wording adjustments over time. An example of this is + the Windows Event ID.' + example: 4648 + flat_name: event.code + ignore_above: 1024 + level: extended + name: code + normalize: [] + short: Identification code for this event. + type: keyword + event.created: + dashed_name: event-created + description: 'event.created contains the date/time when the event was first + read by an agent, or by your pipeline. + + This field is distinct from @timestamp in that @timestamp typically contain + the time extracted from the original event. + + In most situations, these two timestamps will be slightly different. The difference + can be used to calculate the delay between your source generating an event, + and the time when your agent first processed it. This can be used to monitor + your agent''s or pipeline''s ability to keep up with your event source. + + In case the two timestamps are identical, @timestamp should be used.' + example: '2016-05-23T08:05:34.857Z' + flat_name: event.created + level: core + name: created + normalize: [] + short: Time when the event was first read by an agent or by your pipeline. + type: date + event.dataset: + dashed_name: event-dataset + description: 'Name of the dataset. + + If an event source publishes more than one type of log or events (e.g. access + log, error log), the dataset is used to specify which one the event comes + from. + + It''s recommended but not required to start the dataset name with the module + name, followed by a dot, then the dataset name.' + example: apache.access + flat_name: event.dataset + ignore_above: 1024 + level: core + name: dataset + normalize: [] + short: Name of the dataset. + type: keyword + event.duration: + dashed_name: event-duration + description: 'Duration of the event in nanoseconds. + + If event.start and event.end are known this value should be the difference + between the end and start time.' + flat_name: event.duration + format: duration + input_format: nanoseconds + level: core + name: duration + normalize: [] + output_format: asMilliseconds + output_precision: 1 + short: Duration of the event in nanoseconds. + type: long + event.end: + dashed_name: event-end + description: event.end contains the date when the event ended or when the activity + was last observed. + flat_name: event.end + level: extended + name: end + normalize: [] + short: event.end contains the date when the event ended or when the activity + was last observed. + type: date + event.hash: + dashed_name: event-hash + description: Hash (perhaps logstash fingerprint) of raw field to be able to + demonstrate log integrity. + example: 123456789012345678901234567890ABCD + flat_name: event.hash + ignore_above: 1024 + level: extended + name: hash + normalize: [] + short: Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate + log integrity. + type: keyword + event.id: + dashed_name: event-id + description: Unique ID to describe the event. + example: 8a4f500d + flat_name: event.id + ignore_above: 1024 + level: core + name: id + normalize: [] + short: Unique ID to describe the event. + type: keyword + event.ingested: + dashed_name: event-ingested + description: 'Timestamp when an event arrived in the central data store. + + This is different from `@timestamp`, which is when the event originally occurred. It''s + also different from `event.created`, which is meant to capture the first time + an agent saw the event. + + In normal conditions, assuming no tampering, the timestamps should chronologically + look like this: `@timestamp` < `event.created` < `event.ingested`.' + example: '2016-05-23T08:05:35.101Z' + flat_name: event.ingested + level: core + name: ingested + normalize: [] + short: Timestamp when an event arrived in the central data store. + type: date + event.kind: + allowed_values: + - description: 'This value indicates an event that describes an alert or notable + event, triggered by a detection rule. + + `event.kind:alert` is often populated for events coming from firewalls, + intrusion detection systems, endpoint detection and response systems, and + so on.' + name: alert + - description: This value is the most general and most common value for this + field. It is used to represent events that indicate that something happened. + name: event + - description: 'This value is used to indicate that this event describes a numeric + measurement taken at given point in time. + + Examples include CPU utilization, memory usage, or device temperature. + + Metric events are often collected on a predictable frequency, such as once + every few seconds, or once a minute, but can also be used to describe ad-hoc + numeric metric queries.' + name: metric + - description: 'The state value is similar to metric, indicating that this event + describes a measurement taken at given point in time, except that the measurement + does not result in a numeric value, but rather one of a fixed set of categorical + values that represent conditions or states. + + Examples include periodic events reporting Elasticsearch cluster state (green/yellow/red), + the state of a TCP connection (open, closed, fin_wait, etc.), the state + of a host with respect to a software vulnerability (vulnerable, not vulnerable), + and the state of a system regarding compliance with a regulatory standard + (compliant, not compliant). + + Note that an event that describes a change of state would not use `event.kind:state`, + but instead would use ''event.kind:event'' since a state change fits the + more general event definition of something that happened. + + State events are often collected on a predictable frequency, such as once + every few seconds, once a minute, once an hour, or once a day, but can also + be used to describe ad-hoc state queries.' + name: state + - description: This value indicates that an error occurred during the ingestion + of this event, and that event data may be missing, inconsistent, or incorrect. + `event.kind:pipeline_error` is often associated with parsing errors. + name: pipeline_error + - description: 'This value is used by the Elastic SIEM app to denote an Elasticsearch + document that was created by a SIEM detection engine rule. + + A signal will typically trigger a notification that something meaningful + happened and should be investigated. + + Usage of this value is reserved, and pipelines should not populate `event.kind` + with the value "signal".' + name: signal + dashed_name: event-kind + description: 'This is one of four ECS Categorization Fields, and indicates the + highest level in the ECS category hierarchy. + + `event.kind` gives high-level information about what type of information the + event contains, without being specific to the contents of the event. For example, + values of this field distinguish alert events from metric events. + + The value of this field can be used to inform how these kinds of events should + be handled. They may warrant different retention, different access control, + it may also help understand whether the data coming in at a regular interval + or not.' + example: alert + flat_name: event.kind + ignore_above: 1024 + level: core + name: kind + normalize: [] + short: The kind of the event. The highest categorization field in the hierarchy. + type: keyword + event.module: + dashed_name: event-module + description: 'Name of the module this data is coming from. + + If your monitoring agent supports the concept of modules or plugins to process + events of a given source (e.g. Apache logs), `event.module` should contain + the name of this module.' + example: apache + flat_name: event.module + ignore_above: 1024 + level: core + name: module + normalize: [] + short: Name of the module this data is coming from. + type: keyword + event.original: + dashed_name: event-original + description: 'Raw text message of entire event. Used to demonstrate log integrity. + + This field is not indexed and doc_values are disabled. It cannot be searched, + but it can be retrieved from `_source`.' + doc_values: false + example: Sep 19 08:26:10 host CEF:0|Security| threatmanager|1.0|100| + worm successfully stopped|10|src=10.0.0.1 dst=2.1.2.2spt=1232 + flat_name: event.original + ignore_above: 1024 + index: false + level: core + name: original + normalize: [] + short: Raw text message of entire event. + type: keyword + event.outcome: + allowed_values: + - description: Indicates that this event describes a failed result. A common + example is `event.category:file AND event.type:access AND event.outcome:failure` + to indicate that a file access was attempted, but was not successful. + name: failure + - description: Indicates that this event describes a successful result. A common + example is `event.category:file AND event.type:create AND event.outcome:success` + to indicate that a file was successfully created. + name: success + - description: Indicates that this event describes only an attempt for which + the result is unknown from the perspective of the event producer. For example, + if the event contains information only about the request side of a transaction + that results in a response, populating `event.outcome:unknown` in the request + event is appropriate. The unknown value should not be used when an outcome + doesn't make logical sense for the event. In such cases `event.outcome` + should not be populated. + name: unknown + dashed_name: event-outcome + description: 'This is one of four ECS Categorization Fields, and indicates the + lowest level in the ECS category hierarchy. + + `event.outcome` simply denotes whether the event represents a success or a + failure from the perspective of the entity that produced the event. + + Note that when a single transaction is described in multiple events, each + event may populate different values of `event.outcome`, according to their + perspective. + + Also note that in the case of a compound event (a single event that contains + multiple logical events), this field should be populated with the value that + best captures the overall success or failure from the perspective of the event + producer. + + Further note that not all events will have an associated outcome. For example, + this field is generally not populated for metric events, events with `event.type:info`, + or any events for which an outcome does not make logical sense.' + example: success + flat_name: event.outcome + ignore_above: 1024 + level: core + name: outcome + normalize: [] + short: The outcome of the event. The lowest level categorization field in the + hierarchy. + type: keyword + event.provider: + dashed_name: event-provider + description: 'Source of the event. + + Event transports such as Syslog or the Windows Event Log typically mention + the source of an event. It can be the name of the software that generated + the event (e.g. Sysmon, httpd), or of a subsystem of the operating system + (kernel, Microsoft-Windows-Security-Auditing).' + example: kernel + flat_name: event.provider + ignore_above: 1024 + level: extended + name: provider + normalize: [] + short: Source of the event. + type: keyword + event.reason: + dashed_name: event-reason + description: 'Reason why this event happened, according to the source. + + This describes the why of a particular action or outcome captured in the event. + Where `event.action` captures the action from the event, `event.reason` describes + why that action was taken. For example, a web proxy with an `event.action` + which denied the request may also populate `event.reason` with the reason + why (e.g. `blocked site`).' + example: Terminated an unexpected process + flat_name: event.reason + ignore_above: 1024 + level: extended + name: reason + normalize: [] + short: Reason why this event happened, according to the source + type: keyword + event.reference: + dashed_name: event-reference + description: 'Reference URL linking to additional information about this event. + + This URL links to a static definition of the this event. Alert events, indicated + by `event.kind:alert`, are a common use case for this field.' + example: https://system.example.com/event/#0001234 + flat_name: event.reference + ignore_above: 1024 + level: extended + name: reference + normalize: [] + short: Event reference URL + type: keyword + event.risk_score: + dashed_name: event-risk-score + description: Risk score or priority of the event (e.g. security solutions). + Use your system's original value here. + flat_name: event.risk_score + level: core + name: risk_score + normalize: [] + short: Risk score or priority of the event (e.g. security solutions). Use your + system's original value here. + type: float + event.risk_score_norm: + dashed_name: event-risk-score-norm + description: 'Normalized risk score or priority of the event, on a scale of + 0 to 100. + + This is mainly useful if you use more than one system that assigns risk scores, + and you want to see a normalized value across all systems.' + flat_name: event.risk_score_norm + level: extended + name: risk_score_norm + normalize: [] + short: Normalized risk score or priority of the event (0-100). + type: float + event.sequence: + dashed_name: event-sequence + description: 'Sequence number of the event. + + The sequence number is a value published by some event sources, to make the + exact ordering of events unambiguous, regardless of the timestamp precision.' + flat_name: event.sequence + format: string + level: extended + name: sequence + normalize: [] + short: Sequence number of the event. + type: long + event.severity: + dashed_name: event-severity + description: 'The numeric severity of the event according to your event source. + + What the different severity values mean can be different between sources and + use cases. It''s up to the implementer to make sure severities are consistent + across events from the same source. + + The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` + is meant to represent the severity according to the event source (e.g. firewall, + IDS). If the event source does not publish its own severity, you may optionally + copy the `log.syslog.severity.code` to `event.severity`.' + example: 7 + flat_name: event.severity + format: string + level: core + name: severity + normalize: [] + short: Numeric severity of the event. + type: long + event.start: + dashed_name: event-start + description: event.start contains the date when the event started or when the + activity was first observed. + flat_name: event.start + level: extended + name: start + normalize: [] + short: event.start contains the date when the event started or when the activity + was first observed. + type: date + event.timezone: + dashed_name: event-timezone + description: 'This field should be populated when the event''s timestamp does + not include timezone information already (e.g. default Syslog timestamps). + It''s optional otherwise. + + Acceptable timezone formats are: a canonical ID (e.g. "Europe/Amsterdam"), + abbreviated (e.g. "EST") or an HH:mm differential (e.g. "-05:00").' + flat_name: event.timezone + ignore_above: 1024 + level: extended + name: timezone + normalize: [] + short: Event time zone. + type: keyword + event.type: + allowed_values: + - description: The access event type is used for the subset of events within + a category that indicate that something was accessed. Common examples include + `event.category:database AND event.type:access`, or `event.category:file + AND event.type:access`. Note for file access, both directory listings and + file opens should be included in this subcategory. You can further distinguish + access operations using the ECS `event.action` field. + name: access + - description: 'The admin event type is used for the subset of events within + a category that are related to admin objects. For example, administrative + changes within an IAM framework that do not specifically affect a user or + group (e.g., adding new applications to a federation solution or connecting + discrete forests in Active Directory) would fall into this subcategory. + Common example: `event.category:iam AND event.type:change AND event.type:admin`. + You can further distinguish admin operations using the ECS `event.action` + field.' + name: admin + - description: The allowed event type is used for the subset of events within + a category that indicate that something was allowed. Common examples include + `event.category:network AND event.type:connection AND event.type:allowed` + (to indicate a network firewall event for which the firewall disposition + was to allow the connection to complete) and `event.category:intrusion_detection + AND event.type:allowed` (to indicate a network intrusion prevention system + event for which the IPS disposition was to allow the connection to complete). + You can further distinguish allowed operations using the ECS `event.action` + field, populating with values of your choosing, such as "allow", "detect", + or "pass". + name: allowed + - description: The change event type is used for the subset of events within + a category that indicate that something has changed. If semantics best describe + an event as modified, then include them in this subcategory. Common examples + include `event.category:process AND event.type:change`, and `event.category:file + AND event.type:change`. You can further distinguish change operations using + the ECS `event.action` field. + name: change + - description: Used primarily with `event.category:network` this value is used + for the subset of network traffic that includes sufficient information for + the event to be included in flow or connection analysis. Events in this + subcategory will contain at least source and destination IP addresses, source + and destination TCP/UDP ports, and will usually contain counts of bytes + and/or packets transferred. Events in this subcategory may contain unidirectional + or bidirectional information, including summary information. Use this subcategory + to visualize and analyze network connections. Flow analysis, including Netflow, + IPFIX, and other flow-related events fit in this subcategory. Note that + firewall events from many Next-Generation Firewall (NGFW) devices will also + fit into this subcategory. A common filter for flow/connection information + would be `event.category:network AND event.type:connection AND event.type:end` + (to view or analyze all completed network connections, ignoring mid-flow + reports). You can further distinguish connection events using the ECS `event.action` + field, populating with values of your choosing, such as "timeout", or "reset". + name: connection + - description: The "creation" event type is used for the subset of events within + a category that indicate that something was created. A common example is + `event.category:file AND event.type:creation`. + name: creation + - description: The deletion event type is used for the subset of events within + a category that indicate that something was deleted. A common example is + `event.category:file AND event.type:deletion` to indicate that a file has + been deleted. + name: deletion + - description: The denied event type is used for the subset of events within + a category that indicate that something was denied. Common examples include + `event.category:network AND event.type:denied` (to indicate a network firewall + event for which the firewall disposition was to deny the connection) and + `event.category:intrusion_detection AND event.type:denied` (to indicate + a network intrusion prevention system event for which the IPS disposition + was to deny the connection to complete). You can further distinguish denied + operations using the ECS `event.action` field, populating with values of + your choosing, such as "blocked", "dropped", or "quarantined". + name: denied + - description: The end event type is used for the subset of events within a + category that indicate something has ended. A common example is `event.category:process + AND event.type:end`. + name: end + - description: The error event type is used for the subset of events within + a category that indicate or describe an error. A common example is `event.category:database + AND event.type:error`. Note that pipeline errors that occur during the event + ingestion process should not use this `event.type` value. Instead, they + should use `event.kind:pipeline_error`. + name: error + - description: 'The group event type is used for the subset of events within + a category that are related to group objects. Common example: `event.category:iam + AND event.type:creation AND event.type:group`. You can further distinguish + group operations using the ECS `event.action` field.' + name: group + - description: The info event type is used for the subset of events within a + category that indicate that they are purely informational, and don't report + a state change, or any type of action. For example, an initial run of a + file integrity monitoring system (FIM), where an agent reports all files + under management, would fall into the "info" subcategory. Similarly, an + event containing a dump of all currently running processes (as opposed to + reporting that a process started/ended) would fall into the "info" subcategory. + An additional common examples is `event.category:intrusion_detection AND + event.type:info`. + name: info + - description: The installation event type is used for the subset of events + within a category that indicate that something was installed. A common example + is `event.category:package` AND `event.type:installation`. + name: installation + - description: The protocol event type is used for the subset of events within + a category that indicate that they contain protocol details or analysis, + beyond simply identifying the protocol. Generally, network events that contain + specific protocol details will fall into this subcategory. A common example + is `event.category:network AND event.type:protocol AND event.type:connection + AND event.type:end` (to indicate that the event is a network connection + event sent at the end of a connection that also includes a protocol detail + breakdown). Note that events that only indicate the name or id of the protocol + should not use the protocol value. Further note that when the protocol subcategory + is used, the identified protocol is populated in the ECS `network.protocol` + field. + expected_event_types: + - access + - change + - end + - info + - start + name: protocol + - description: The start event type is used for the subset of events within + a category that indicate something has started. A common example is `event.category:process + AND event.type:start`. + name: start + - description: 'The user event type is used for the subset of events within + a category that are related to user objects. Common example: `event.category:iam + AND event.type:deletion AND event.type:user`. You can further distinguish + user operations using the ECS `event.action` field.' + name: user + dashed_name: event-type + description: 'This is one of four ECS Categorization Fields, and indicates the + third level in the ECS category hierarchy. + + `event.type` represents a categorization "sub-bucket" that, when used along + with the `event.category` field values, enables filtering events down to a + level appropriate for single visualization. + + This field is an array. This will allow proper categorization of some events + that fall in multiple event types.' + flat_name: event.type + ignore_above: 1024 + level: core + name: type + normalize: + - array + short: Event type. The third categorization field in the hierarchy. + type: keyword + event.url: + dashed_name: event-url + description: 'URL linking to an external system to continue investigation of + this event. + + This URL links to another system where in-depth investigation of the specific + occurrence of this event can take place. Alert events, indicated by `event.kind:alert`, + are a common use case for this field.' + example: https://mysystem.example.com/alert/5271dedb-f5b0-4218-87f0-4ac4870a38fe + flat_name: event.url + ignore_above: 1024 + level: extended + name: url + normalize: [] + short: Event investigation URL + type: keyword + group: 2 + name: event + prefix: event. + short: Fields breaking down the event details. + title: Event + type: group +http: + description: Fields related to HTTP activity. Use the `url` field set to store the + url of the request. + fields: + http.request.body.bytes: + dashed_name: http-request-body-bytes + description: Size in bytes of the request body. + example: 887 + flat_name: http.request.body.bytes + format: bytes + level: extended + name: request.body.bytes + normalize: [] + short: Size in bytes of the request body. + type: long + http.request.body.content: + dashed_name: http-request-body-content + description: The full HTTP request body. + example: Hello world + flat_name: http.request.body.content + ignore_above: 1024 + level: extended + multi_fields: + - flat_name: http.request.body.content.text + name: text + norms: false + type: text + name: request.body.content + normalize: [] + short: The full HTTP request body. + type: keyword + http.request.bytes: + dashed_name: http-request-bytes + description: Total size in bytes of the request (body and headers). + example: 1437 + flat_name: http.request.bytes + format: bytes + level: extended + name: request.bytes + normalize: [] + short: Total size in bytes of the request (body and headers). + type: long + http.request.method: + dashed_name: http-request-method + description: 'HTTP request method. + + Prior to ECS 1.6.0 the following guidance was provided: + + "The field value must be normalized to lowercase for querying." + + As of ECS 1.6.0, the guidance is deprecated because the original case of the + method may be useful in anomaly detection. Original case will be mandated + in ECS 2.0.0' + example: GET, POST, PUT, PoST + flat_name: http.request.method + ignore_above: 1024 + level: extended + name: request.method + normalize: [] + short: HTTP request method. + type: keyword + http.request.referrer: + dashed_name: http-request-referrer + description: Referrer for this HTTP request. + example: https://blog.example.com/ + flat_name: http.request.referrer + ignore_above: 1024 + level: extended + name: request.referrer + normalize: [] + short: Referrer for this HTTP request. + type: keyword + http.response.body.bytes: + dashed_name: http-response-body-bytes + description: Size in bytes of the response body. + example: 887 + flat_name: http.response.body.bytes + format: bytes + level: extended + name: response.body.bytes + normalize: [] + short: Size in bytes of the response body. + type: long + http.response.body.content: + dashed_name: http-response-body-content + description: The full HTTP response body. + example: Hello world + flat_name: http.response.body.content + ignore_above: 1024 + level: extended + multi_fields: + - flat_name: http.response.body.content.text + name: text + norms: false + type: text + name: response.body.content + normalize: [] + short: The full HTTP response body. + type: keyword + http.response.bytes: + dashed_name: http-response-bytes + description: Total size in bytes of the response (body and headers). + example: 1437 + flat_name: http.response.bytes + format: bytes + level: extended + name: response.bytes + normalize: [] + short: Total size in bytes of the response (body and headers). + type: long + http.response.status_code: + dashed_name: http-response-status-code + description: HTTP response status code. + example: 404 + flat_name: http.response.status_code + format: string + level: extended + name: response.status_code + normalize: [] + short: HTTP response status code. + type: long + http.version: + dashed_name: http-version + description: HTTP version. + example: 1.1 + flat_name: http.version + ignore_above: 1024 + level: extended + name: version + normalize: [] + short: HTTP version. + type: keyword + group: 2 + name: http + prefix: http. + short: Fields describing an HTTP request. + title: HTTP + type: group +network: + description: 'The network is defined as the communication path over which a host + or network event happens. + + The network.* fields should be populated with details about the network activity + associated with an event.' + fields: + network.application: + dashed_name: network-application + description: 'A name given to an application level protocol. This can be arbitrarily + assigned for things like microservices, but also apply to things like skype, + icq, facebook, twitter. This would be used in situations where the vendor + or service can be decoded such as from the source/dest IP owners, ports, or + wire format. + + The field value must be normalized to lowercase for querying. See the documentation + section "Implementing ECS".' + example: aim + flat_name: network.application + ignore_above: 1024 + level: extended + name: application + normalize: [] + short: Application level protocol name. + type: keyword + network.bytes: + dashed_name: network-bytes + description: 'Total bytes transferred in both directions. + + If `source.bytes` and `destination.bytes` are known, `network.bytes` is their + sum.' + example: 368 + flat_name: network.bytes + format: bytes + level: core + name: bytes + normalize: [] + short: Total bytes transferred in both directions. + type: long + network.community_id: + dashed_name: network-community-id + description: 'A hash of source and destination IPs and ports, as well as the + protocol used in a communication. This is a tool-agnostic standard to identify + flows. + + Learn more at https://github.com/corelight/community-id-spec.' + example: 1:hO+sN4H+MG5MY/8hIrXPqc4ZQz0= + flat_name: network.community_id + ignore_above: 1024 + level: extended + name: community_id + normalize: [] + short: A hash of source and destination IPs and ports. + type: keyword + network.direction: + dashed_name: network-direction + description: "Direction of the network traffic.\nRecommended values are:\n \ + \ * inbound\n * outbound\n * internal\n * external\n * unknown\n\nWhen\ + \ mapping events from a host-based monitoring context, populate this field\ + \ from the host's point of view.\nWhen mapping events from a network or perimeter-based\ + \ monitoring context, populate this field from the point of view of your network\ + \ perimeter." + example: inbound + flat_name: network.direction + ignore_above: 1024 + level: core + name: direction + normalize: [] + short: Direction of the network traffic. + type: keyword + network.forwarded_ip: + dashed_name: network-forwarded-ip + description: Host IP address when the source IP address is the proxy. + example: 192.1.1.2 + flat_name: network.forwarded_ip + level: core + name: forwarded_ip + normalize: [] + short: Host IP address when the source IP address is the proxy. + type: ip + network.iana_number: + dashed_name: network-iana-number + description: IANA Protocol Number (https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml). + Standardized list of protocols. This aligns well with NetFlow and sFlow related + logs which use the IANA Protocol Number. + example: 6 + flat_name: network.iana_number + ignore_above: 1024 + level: extended + name: iana_number + normalize: [] + short: IANA Protocol Number. + type: keyword + network.inner: + dashed_name: network-inner + description: Network.inner fields are added in addition to network.vlan fields + to describe the innermost VLAN when q-in-q VLAN tagging is present. Allowed + fields include vlan.id and vlan.name. Inner vlan fields are typically used + when sending traffic with multiple 802.1q encapsulations to a network sensor + (e.g. Zeek, Wireshark.) + flat_name: network.inner + level: extended + name: inner + normalize: [] + short: Inner VLAN tag information + type: object + network.inner.vlan.id: + dashed_name: network-inner-vlan-id + description: VLAN ID as reported by the observer. + example: 10 + flat_name: network.inner.vlan.id + ignore_above: 1024 + level: extended + name: id + normalize: [] + original_fieldset: vlan + short: VLAN ID as reported by the observer. + type: keyword + network.inner.vlan.name: + dashed_name: network-inner-vlan-name + description: Optional VLAN name as reported by the observer. + example: outside + flat_name: network.inner.vlan.name + ignore_above: 1024 + level: extended + name: name + normalize: [] + original_fieldset: vlan + short: Optional VLAN name as reported by the observer. + type: keyword + network.name: + dashed_name: network-name + description: Name given by operators to sections of their network. + example: Guest Wifi + flat_name: network.name + ignore_above: 1024 + level: extended + name: name + normalize: [] + short: Name given by operators to sections of their network. + type: keyword + network.packets: + dashed_name: network-packets + description: 'Total packets transferred in both directions. + + If `source.packets` and `destination.packets` are known, `network.packets` + is their sum.' + example: 24 + flat_name: network.packets + level: core + name: packets + normalize: [] + short: Total packets transferred in both directions. + type: long + network.protocol: + dashed_name: network-protocol + description: 'L7 Network protocol name. ex. http, lumberjack, transport protocol. + + The field value must be normalized to lowercase for querying. See the documentation + section "Implementing ECS".' + example: http + flat_name: network.protocol + ignore_above: 1024 + level: core + name: protocol + normalize: [] + short: L7 Network protocol name. + type: keyword + network.transport: + dashed_name: network-transport + description: 'Same as network.iana_number, but instead using the Keyword name + of the transport layer (udp, tcp, ipv6-icmp, etc.) + + The field value must be normalized to lowercase for querying. See the documentation + section "Implementing ECS".' + example: tcp + flat_name: network.transport + ignore_above: 1024 + level: core + name: transport + normalize: [] + short: Protocol Name corresponding to the field `iana_number`. + type: keyword + network.type: + dashed_name: network-type + description: 'In the OSI Model this would be the Network Layer. ipv4, ipv6, + ipsec, pim, etc + + The field value must be normalized to lowercase for querying. See the documentation + section "Implementing ECS".' + example: ipv4 + flat_name: network.type + ignore_above: 1024 + level: core + name: type + normalize: [] + short: In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, + pim, etc + type: keyword + network.vlan.id: + dashed_name: network-vlan-id + description: VLAN ID as reported by the observer. + example: 10 + flat_name: network.vlan.id + ignore_above: 1024 + level: extended + name: id + normalize: [] + original_fieldset: vlan + short: VLAN ID as reported by the observer. + type: keyword + network.vlan.name: + dashed_name: network-vlan-name + description: Optional VLAN name as reported by the observer. + example: outside + flat_name: network.vlan.name + ignore_above: 1024 + level: extended + name: name + normalize: [] + original_fieldset: vlan + short: Optional VLAN name as reported by the observer. + type: keyword + group: 2 + name: network + nestings: + - network.inner.vlan + - network.vlan + prefix: network. + reused_here: + - full: network.vlan + schema_name: vlan + short: Fields to describe observed VLAN information. + - full: network.inner.vlan + schema_name: vlan + short: Fields to describe observed VLAN information. + short: Fields describing the communication path over which the event happened. + title: Network + type: group +related: + description: 'This field set is meant to facilitate pivoting around a piece of data. + + Some pieces of information can be seen in many places in an ECS event. To facilitate + searching for them, store an array of all seen values to their corresponding field + in `related.`. + + A concrete example is IP addresses, which can be under host, observer, source, + destination, client, server, and network.forwarded_ip. If you append all IPs to + `related.ip`, you can then search for a given IP trivially, no matter where it + appeared, by querying `related.ip:192.0.2.15`.' + fields: + related.ip: + dashed_name: related-ip + description: All of the IPs seen on your event. + flat_name: related.ip + level: extended + name: ip + normalize: + - array + short: All of the IPs seen on your event. + type: ip + related.user: + dashed_name: related-user + description: All the user names seen on your event. + flat_name: related.user + ignore_above: 1024 + level: extended + name: user + normalize: + - array + short: All the user names seen on your event. + type: keyword + group: 2 + name: related + prefix: related. + short: Fields meant to facilitate pivoting around a piece of data. + title: Related + type: group +server: + description: 'A Server is defined as the responder in a network connection for events + regarding sessions, connections, or bidirectional flow records. + + For TCP events, the server is the receiver of the initial SYN packet(s) of the + TCP connection. For other protocols, the server is generally the responder in + the network transaction. Some systems actually use the term "responder" to refer + the server in TCP connections. The server fields describe details about the system + acting as the server in the network event. Server fields are usually populated + in conjunction with client fields. Server fields are generally not populated for + packet-level events. + + Client / server representations can add semantic context to an exchange, which + is helpful to visualize the data in certain situations. If your context falls + in that category, you should still ensure that source and destination are filled + appropriately.' + fields: + server.address: + dashed_name: server-address + description: 'Some event server addresses are defined ambiguously. The event + will sometimes list an IP, a domain or a unix socket. You should always store + the raw address in the `.address` field. + + Then it should be duplicated to `.ip` or `.domain`, depending on which one + it is.' + flat_name: server.address + ignore_above: 1024 + level: extended + name: address + normalize: [] + short: Server network address. + type: keyword + server.as.number: + dashed_name: server-as-number + description: Unique number allocated to the autonomous system. The autonomous + system number (ASN) uniquely identifies each network on the Internet. + example: 15169 + flat_name: server.as.number + level: extended + name: number + normalize: [] + original_fieldset: as + short: Unique number allocated to the autonomous system. + type: long + server.as.organization.name: + dashed_name: server-as-organization-name + description: Organization name. + example: Google LLC + flat_name: server.as.organization.name + ignore_above: 1024 + level: extended + multi_fields: + - flat_name: server.as.organization.name.text + name: text + norms: false + type: text + name: organization.name + normalize: [] + original_fieldset: as + short: Organization name. + type: keyword + server.bytes: + dashed_name: server-bytes + description: Bytes sent from the server to the client. + example: 184 + flat_name: server.bytes + format: bytes + level: core + name: bytes + normalize: [] + short: Bytes sent from the server to the client. + type: long + server.domain: + dashed_name: server-domain + description: Server domain. + flat_name: server.domain + ignore_above: 1024 + level: core + name: domain + normalize: [] + short: Server domain. + type: keyword + server.geo.city_name: + dashed_name: server-geo-city-name + description: City name. + example: Montreal + flat_name: server.geo.city_name + ignore_above: 1024 + level: core + name: city_name + normalize: [] + original_fieldset: geo + short: City name. + type: keyword + server.geo.continent_name: + dashed_name: server-geo-continent-name + description: Name of the continent. + example: North America + flat_name: server.geo.continent_name + ignore_above: 1024 + level: core + name: continent_name + normalize: [] + original_fieldset: geo + short: Name of the continent. + type: keyword + server.geo.country_iso_code: + dashed_name: server-geo-country-iso-code + description: Country ISO code. + example: CA + flat_name: server.geo.country_iso_code + ignore_above: 1024 + level: core + name: country_iso_code + normalize: [] + original_fieldset: geo + short: Country ISO code. + type: keyword + server.geo.country_name: + dashed_name: server-geo-country-name + description: Country name. + example: Canada + flat_name: server.geo.country_name + ignore_above: 1024 + level: core + name: country_name + normalize: [] + original_fieldset: geo + short: Country name. + type: keyword + server.geo.location: + dashed_name: server-geo-location + description: Longitude and latitude. + example: '{ "lon": -73.614830, "lat": 45.505918 }' + flat_name: server.geo.location + level: core + name: location + normalize: [] + original_fieldset: geo + short: Longitude and latitude. + type: geo_point + server.geo.name: + dashed_name: server-geo-name + description: 'User-defined description of a location, at the level of granularity + they care about. + + Could be the name of their data centers, the floor number, if this describes + a local physical entity, city names. + + Not typically used in automated geolocation.' + example: boston-dc + flat_name: server.geo.name + ignore_above: 1024 + level: extended + name: name + normalize: [] + original_fieldset: geo + short: User-defined description of a location. + type: keyword + server.geo.region_iso_code: + dashed_name: server-geo-region-iso-code + description: Region ISO code. + example: CA-QC + flat_name: server.geo.region_iso_code + ignore_above: 1024 + level: core + name: region_iso_code + normalize: [] + original_fieldset: geo + short: Region ISO code. + type: keyword + server.geo.region_name: + dashed_name: server-geo-region-name + description: Region name. + example: Quebec + flat_name: server.geo.region_name + ignore_above: 1024 + level: core + name: region_name + normalize: [] + original_fieldset: geo + short: Region name. + type: keyword + server.ip: + dashed_name: server-ip + description: IP address of the server (IPv4 or IPv6). + flat_name: server.ip + level: core + name: ip + normalize: [] + short: IP address of the server. + type: ip + server.mac: + dashed_name: server-mac + description: MAC address of the server. + flat_name: server.mac + ignore_above: 1024 + level: core + name: mac + normalize: [] + short: MAC address of the server. + type: keyword + server.nat.ip: + dashed_name: server-nat-ip + description: 'Translated ip of destination based NAT sessions (e.g. internet + to private DMZ) + + Typically used with load balancers, firewalls, or routers.' + flat_name: server.nat.ip + level: extended + name: nat.ip + normalize: [] + short: Server NAT ip + type: ip + server.nat.port: + dashed_name: server-nat-port + description: 'Translated port of destination based NAT sessions (e.g. internet + to private DMZ) + + Typically used with load balancers, firewalls, or routers.' + flat_name: server.nat.port + format: string + level: extended + name: nat.port + normalize: [] + short: Server NAT port + type: long + server.packets: + dashed_name: server-packets + description: Packets sent from the server to the client. + example: 12 + flat_name: server.packets + level: core + name: packets + normalize: [] + short: Packets sent from the server to the client. + type: long + server.port: + dashed_name: server-port + description: Port of the server. + flat_name: server.port + format: string + level: core + name: port + normalize: [] + short: Port of the server. + type: long + server.registered_domain: + dashed_name: server-registered-domain + description: 'The highest registered server domain, stripped of the subdomain. + + For example, the registered domain for "foo.example.com" is "example.com". + + This value can be determined precisely with a list like the public suffix + list (http://publicsuffix.org). Trying to approximate this by simply taking + the last two labels will not work well for TLDs such as "co.uk".' + example: example.com + flat_name: server.registered_domain + ignore_above: 1024 + level: extended + name: registered_domain + normalize: [] + short: The highest registered server domain, stripped of the subdomain. + type: keyword + server.top_level_domain: + dashed_name: server-top-level-domain + description: 'The effective top level domain (eTLD), also known as the domain + suffix, is the last part of the domain name. For example, the top level domain + for example.com is "com". + + This value can be determined precisely with a list like the public suffix + list (http://publicsuffix.org). Trying to approximate this by simply taking + the last label will not work well for effective TLDs such as "co.uk".' + example: co.uk + flat_name: server.top_level_domain + ignore_above: 1024 + level: extended + name: top_level_domain + normalize: [] + short: The effective top level domain (com, org, net, co.uk). + type: keyword + server.user.domain: + dashed_name: server-user-domain + description: 'Name of the directory the user is a member of. + + For example, an LDAP or Active Directory domain name.' + flat_name: server.user.domain + ignore_above: 1024 + level: extended + name: domain + normalize: [] + original_fieldset: user + short: Name of the directory the user is a member of. + type: keyword + server.user.email: + dashed_name: server-user-email + description: User email address. + flat_name: server.user.email + ignore_above: 1024 + level: extended + name: email + normalize: [] + original_fieldset: user + short: User email address. + type: keyword + server.user.full_name: + dashed_name: server-user-full-name + description: User's full name, if available. + example: Albert Einstein + flat_name: server.user.full_name + ignore_above: 1024 + level: extended + multi_fields: + - flat_name: server.user.full_name.text + name: text + norms: false + type: text + name: full_name + normalize: [] + original_fieldset: user + short: User's full name, if available. + type: keyword + server.user.group.domain: + dashed_name: server-user-group-domain + description: 'Name of the directory the group is a member of. + + For example, an LDAP or Active Directory domain name.' + flat_name: server.user.group.domain + ignore_above: 1024 + level: extended + name: domain + normalize: [] + original_fieldset: group + short: Name of the directory the group is a member of. + type: keyword + server.user.group.id: + dashed_name: server-user-group-id + description: Unique identifier for the group on the system/platform. + flat_name: server.user.group.id + ignore_above: 1024 + level: extended + name: id + normalize: [] + original_fieldset: group + short: Unique identifier for the group on the system/platform. + type: keyword + server.user.group.name: + dashed_name: server-user-group-name + description: Name of the group. + flat_name: server.user.group.name + ignore_above: 1024 + level: extended + name: name + normalize: [] + original_fieldset: group + short: Name of the group. + type: keyword + server.user.hash: + dashed_name: server-user-hash + description: 'Unique user hash to correlate information for a user in anonymized + form. + + Useful if `user.id` or `user.name` contain confidential information and cannot + be used.' + flat_name: server.user.hash + ignore_above: 1024 + level: extended + name: hash + normalize: [] + original_fieldset: user + short: Unique user hash to correlate information for a user in anonymized form. + type: keyword + server.user.id: + dashed_name: server-user-id + description: Unique identifier of the user. + flat_name: server.user.id + ignore_above: 1024 + level: core + name: id + normalize: [] + original_fieldset: user + short: Unique identifier of the user. + type: keyword + server.user.name: + dashed_name: server-user-name + description: Short name or login of the user. + example: albert + flat_name: server.user.name + ignore_above: 1024 + level: core + multi_fields: + - flat_name: server.user.name.text + name: text + norms: false + type: text + name: name + normalize: [] + original_fieldset: user + short: Short name or login of the user. + type: keyword + server.user.roles: + dashed_name: server-user-roles + description: Array of user roles at the time of the event. + example: '["kibana_admin", "reporting_user"]' + flat_name: server.user.roles + ignore_above: 1024 + level: extended + name: roles + normalize: + - array + original_fieldset: user + short: Array of user roles at the time of the event. + type: keyword + group: 2 + name: server + nestings: + - server.as + - server.geo + - server.user + prefix: server. + reused_here: + - full: server.as + schema_name: as + short: Fields describing an Autonomous System (Internet routing prefix). + - full: server.geo + schema_name: geo + short: Fields describing a location. + - full: server.user + schema_name: user + short: Fields to describe the user relevant to the event. + short: Fields about the server side of a network connection, used with client. + title: Server + type: group +source: + description: 'Source fields describe details about the source of a packet/event. + + Source fields are usually populated in conjunction with destination fields.' + fields: + source.address: + dashed_name: source-address + description: 'Some event source addresses are defined ambiguously. The event + will sometimes list an IP, a domain or a unix socket. You should always store + the raw address in the `.address` field. + + Then it should be duplicated to `.ip` or `.domain`, depending on which one + it is.' + flat_name: source.address + ignore_above: 1024 + level: extended + name: address + normalize: [] + short: Source network address. + type: keyword + source.as.number: + dashed_name: source-as-number + description: Unique number allocated to the autonomous system. The autonomous + system number (ASN) uniquely identifies each network on the Internet. + example: 15169 + flat_name: source.as.number + level: extended + name: number + normalize: [] + original_fieldset: as + short: Unique number allocated to the autonomous system. + type: long + source.as.organization.name: + dashed_name: source-as-organization-name + description: Organization name. + example: Google LLC + flat_name: source.as.organization.name + ignore_above: 1024 + level: extended + multi_fields: + - flat_name: source.as.organization.name.text + name: text + norms: false + type: text + name: organization.name + normalize: [] + original_fieldset: as + short: Organization name. + type: keyword + source.bytes: + dashed_name: source-bytes + description: Bytes sent from the source to the destination. + example: 184 + flat_name: source.bytes + format: bytes + level: core + name: bytes + normalize: [] + short: Bytes sent from the source to the destination. + type: long + source.domain: + dashed_name: source-domain + description: Source domain. + flat_name: source.domain + ignore_above: 1024 + level: core + name: domain + normalize: [] + short: Source domain. + type: keyword + source.geo.city_name: + dashed_name: source-geo-city-name + description: City name. + example: Montreal + flat_name: source.geo.city_name + ignore_above: 1024 + level: core + name: city_name + normalize: [] + original_fieldset: geo + short: City name. + type: keyword + source.geo.continent_name: + dashed_name: source-geo-continent-name + description: Name of the continent. + example: North America + flat_name: source.geo.continent_name + ignore_above: 1024 + level: core + name: continent_name + normalize: [] + original_fieldset: geo + short: Name of the continent. + type: keyword + source.geo.country_iso_code: + dashed_name: source-geo-country-iso-code + description: Country ISO code. + example: CA + flat_name: source.geo.country_iso_code + ignore_above: 1024 + level: core + name: country_iso_code + normalize: [] + original_fieldset: geo + short: Country ISO code. + type: keyword + source.geo.country_name: + dashed_name: source-geo-country-name + description: Country name. + example: Canada + flat_name: source.geo.country_name + ignore_above: 1024 + level: core + name: country_name + normalize: [] + original_fieldset: geo + short: Country name. + type: keyword + source.geo.location: + dashed_name: source-geo-location + description: Longitude and latitude. + example: '{ "lon": -73.614830, "lat": 45.505918 }' + flat_name: source.geo.location + level: core + name: location + normalize: [] + original_fieldset: geo + short: Longitude and latitude. + type: geo_point + source.geo.name: + dashed_name: source-geo-name + description: 'User-defined description of a location, at the level of granularity + they care about. + + Could be the name of their data centers, the floor number, if this describes + a local physical entity, city names. + + Not typically used in automated geolocation.' + example: boston-dc + flat_name: source.geo.name + ignore_above: 1024 + level: extended + name: name + normalize: [] + original_fieldset: geo + short: User-defined description of a location. + type: keyword + source.geo.region_iso_code: + dashed_name: source-geo-region-iso-code + description: Region ISO code. + example: CA-QC + flat_name: source.geo.region_iso_code + ignore_above: 1024 + level: core + name: region_iso_code + normalize: [] + original_fieldset: geo + short: Region ISO code. + type: keyword + source.geo.region_name: + dashed_name: source-geo-region-name + description: Region name. + example: Quebec + flat_name: source.geo.region_name + ignore_above: 1024 + level: core + name: region_name + normalize: [] + original_fieldset: geo + short: Region name. + type: keyword + source.ip: + dashed_name: source-ip + description: IP address of the source (IPv4 or IPv6). + flat_name: source.ip + level: core + name: ip + normalize: [] + short: IP address of the source. + type: ip + source.mac: + dashed_name: source-mac + description: MAC address of the source. + flat_name: source.mac + ignore_above: 1024 + level: core + name: mac + normalize: [] + short: MAC address of the source. + type: keyword + source.nat.ip: + dashed_name: source-nat-ip + description: 'Translated ip of source based NAT sessions (e.g. internal client + to internet) + + Typically connections traversing load balancers, firewalls, or routers.' + flat_name: source.nat.ip + level: extended + name: nat.ip + normalize: [] + short: Source NAT ip + type: ip + source.nat.port: + dashed_name: source-nat-port + description: 'Translated port of source based NAT sessions. (e.g. internal client + to internet) + + Typically used with load balancers, firewalls, or routers.' + flat_name: source.nat.port + format: string + level: extended + name: nat.port + normalize: [] + short: Source NAT port + type: long + source.packets: + dashed_name: source-packets + description: Packets sent from the source to the destination. + example: 12 + flat_name: source.packets + level: core + name: packets + normalize: [] + short: Packets sent from the source to the destination. + type: long + source.port: + dashed_name: source-port + description: Port of the source. + flat_name: source.port + format: string + level: core + name: port + normalize: [] + short: Port of the source. + type: long + source.registered_domain: + dashed_name: source-registered-domain + description: 'The highest registered source domain, stripped of the subdomain. + + For example, the registered domain for "foo.example.com" is "example.com". + + This value can be determined precisely with a list like the public suffix + list (http://publicsuffix.org). Trying to approximate this by simply taking + the last two labels will not work well for TLDs such as "co.uk".' + example: example.com + flat_name: source.registered_domain + ignore_above: 1024 + level: extended + name: registered_domain + normalize: [] + short: The highest registered source domain, stripped of the subdomain. + type: keyword + source.top_level_domain: + dashed_name: source-top-level-domain + description: 'The effective top level domain (eTLD), also known as the domain + suffix, is the last part of the domain name. For example, the top level domain + for example.com is "com". + + This value can be determined precisely with a list like the public suffix + list (http://publicsuffix.org). Trying to approximate this by simply taking + the last label will not work well for effective TLDs such as "co.uk".' + example: co.uk + flat_name: source.top_level_domain + ignore_above: 1024 + level: extended + name: top_level_domain + normalize: [] + short: The effective top level domain (com, org, net, co.uk). + type: keyword + source.user.domain: + dashed_name: source-user-domain + description: 'Name of the directory the user is a member of. + + For example, an LDAP or Active Directory domain name.' + flat_name: source.user.domain + ignore_above: 1024 + level: extended + name: domain + normalize: [] + original_fieldset: user + short: Name of the directory the user is a member of. + type: keyword + source.user.email: + dashed_name: source-user-email + description: User email address. + flat_name: source.user.email + ignore_above: 1024 + level: extended + name: email + normalize: [] + original_fieldset: user + short: User email address. + type: keyword + source.user.full_name: + dashed_name: source-user-full-name + description: User's full name, if available. + example: Albert Einstein + flat_name: source.user.full_name + ignore_above: 1024 + level: extended + multi_fields: + - flat_name: source.user.full_name.text + name: text + norms: false + type: text + name: full_name + normalize: [] + original_fieldset: user + short: User's full name, if available. + type: keyword + source.user.group.domain: + dashed_name: source-user-group-domain + description: 'Name of the directory the group is a member of. + + For example, an LDAP or Active Directory domain name.' + flat_name: source.user.group.domain + ignore_above: 1024 + level: extended + name: domain + normalize: [] + original_fieldset: group + short: Name of the directory the group is a member of. + type: keyword + source.user.group.id: + dashed_name: source-user-group-id + description: Unique identifier for the group on the system/platform. + flat_name: source.user.group.id + ignore_above: 1024 + level: extended + name: id + normalize: [] + original_fieldset: group + short: Unique identifier for the group on the system/platform. + type: keyword + source.user.group.name: + dashed_name: source-user-group-name + description: Name of the group. + flat_name: source.user.group.name + ignore_above: 1024 + level: extended + name: name + normalize: [] + original_fieldset: group + short: Name of the group. + type: keyword + source.user.hash: + dashed_name: source-user-hash + description: 'Unique user hash to correlate information for a user in anonymized + form. + + Useful if `user.id` or `user.name` contain confidential information and cannot + be used.' + flat_name: source.user.hash + ignore_above: 1024 + level: extended + name: hash + normalize: [] + original_fieldset: user + short: Unique user hash to correlate information for a user in anonymized form. + type: keyword + source.user.id: + dashed_name: source-user-id + description: Unique identifier of the user. + flat_name: source.user.id + ignore_above: 1024 + level: core + name: id + normalize: [] + original_fieldset: user + short: Unique identifier of the user. + type: keyword + source.user.name: + dashed_name: source-user-name + description: Short name or login of the user. + example: albert + flat_name: source.user.name + ignore_above: 1024 + level: core + multi_fields: + - flat_name: source.user.name.text + name: text + norms: false + type: text + name: name + normalize: [] + original_fieldset: user + short: Short name or login of the user. + type: keyword + source.user.roles: + dashed_name: source-user-roles + description: Array of user roles at the time of the event. + example: '["kibana_admin", "reporting_user"]' + flat_name: source.user.roles + ignore_above: 1024 + level: extended + name: roles + normalize: + - array + original_fieldset: user + short: Array of user roles at the time of the event. + type: keyword + group: 2 + name: source + nestings: + - source.as + - source.geo + - source.user + prefix: source. + reused_here: + - full: source.as + schema_name: as + short: Fields describing an Autonomous System (Internet routing prefix). + - full: source.geo + schema_name: geo + short: Fields describing a location. + - full: source.user + schema_name: user + short: Fields to describe the user relevant to the event. + short: Fields about the source side of a network connection, used with destination. + title: Source + type: group +url: + description: URL fields provide support for complete or partial URLs, and supports + the breaking down into scheme, domain, path, and so on. + fields: + url.domain: + dashed_name: url-domain + description: 'Domain of the url, such as "www.elastic.co". + + In some cases a URL may refer to an IP and/or port directly, without a domain + name. In this case, the IP address would go to the `domain` field.' + example: www.elastic.co + flat_name: url.domain + ignore_above: 1024 + level: extended + name: domain + normalize: [] + short: Domain of the url. + type: keyword + url.extension: + dashed_name: url-extension + description: 'The field contains the file extension from the original request + url. + + The file extension is only set if it exists, as not every url has a file extension. + + The leading period must not be included. For example, the value must be "png", + not ".png".' + example: png + flat_name: url.extension + ignore_above: 1024 + level: extended + name: extension + normalize: [] + short: File extension from the original request url. + type: keyword + url.fragment: + dashed_name: url-fragment + description: 'Portion of the url after the `#`, such as "top". + + The `#` is not part of the fragment.' + flat_name: url.fragment + ignore_above: 1024 + level: extended + name: fragment + normalize: [] + short: Portion of the url after the `#`. + type: keyword + url.full: + dashed_name: url-full + description: If full URLs are important to your use case, they should be stored + in `url.full`, whether this field is reconstructed or present in the event + source. + example: https://www.elastic.co:443/search?q=elasticsearch#top + flat_name: url.full + ignore_above: 1024 + level: extended + multi_fields: + - flat_name: url.full.text + name: text + norms: false + type: text + name: full + normalize: [] + short: Full unparsed URL. + type: keyword + url.original: + dashed_name: url-original + description: 'Unmodified original url as seen in the event source. + + Note that in network monitoring, the observed URL may be a full URL, whereas + in access logs, the URL is often just represented as a path. + + This field is meant to represent the URL as it was observed, complete or not.' + example: https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch + flat_name: url.original + ignore_above: 1024 + level: extended + multi_fields: + - flat_name: url.original.text + name: text + norms: false + type: text + name: original + normalize: [] + short: Unmodified original url as seen in the event source. + type: keyword + url.password: + dashed_name: url-password + description: Password of the request. + flat_name: url.password + ignore_above: 1024 + level: extended + name: password + normalize: [] + short: Password of the request. + type: keyword + url.path: + dashed_name: url-path + description: Path of the request, such as "/search". + flat_name: url.path + ignore_above: 1024 + level: extended + name: path + normalize: [] + short: Path of the request, such as "/search". + type: keyword + url.port: + dashed_name: url-port + description: Port of the request, such as 443. + example: 443 + flat_name: url.port + format: string + level: extended + name: port + normalize: [] + short: Port of the request, such as 443. + type: long + url.query: + dashed_name: url-query + description: 'The query field describes the query string of the request, such + as "q=elasticsearch". + + The `?` is excluded from the query string. If a URL contains no `?`, there + is no query field. If there is a `?` but no query, the query field exists + with an empty string. The `exists` query can be used to differentiate between + the two cases.' + flat_name: url.query + ignore_above: 1024 + level: extended + name: query + normalize: [] + short: Query string of the request. + type: keyword + url.registered_domain: + dashed_name: url-registered-domain + description: 'The highest registered url domain, stripped of the subdomain. + + For example, the registered domain for "foo.example.com" is "example.com". + + This value can be determined precisely with a list like the public suffix + list (http://publicsuffix.org). Trying to approximate this by simply taking + the last two labels will not work well for TLDs such as "co.uk".' + example: example.com + flat_name: url.registered_domain + ignore_above: 1024 + level: extended + name: registered_domain + normalize: [] + short: The highest registered url domain, stripped of the subdomain. + type: keyword + url.scheme: + dashed_name: url-scheme + description: 'Scheme of the request, such as "https". + + Note: The `:` is not part of the scheme.' + example: https + flat_name: url.scheme + ignore_above: 1024 + level: extended + name: scheme + normalize: [] + short: Scheme of the url. + type: keyword + url.top_level_domain: + dashed_name: url-top-level-domain + description: 'The effective top level domain (eTLD), also known as the domain + suffix, is the last part of the domain name. For example, the top level domain + for example.com is "com". + + This value can be determined precisely with a list like the public suffix + list (http://publicsuffix.org). Trying to approximate this by simply taking + the last label will not work well for effective TLDs such as "co.uk".' + example: co.uk + flat_name: url.top_level_domain + ignore_above: 1024 + level: extended + name: top_level_domain + normalize: [] + short: The effective top level domain (com, org, net, co.uk). + type: keyword + url.username: + dashed_name: url-username + description: Username of the request. + flat_name: url.username + ignore_above: 1024 + level: extended + name: username + normalize: [] + short: Username of the request. + type: keyword + group: 2 + name: url + prefix: url. + short: Fields that let you store URLs in various forms. + title: URL + type: group +user: + description: 'The user fields describe information about the user that is relevant + to the event. + + Fields can have one entry or multiple entries. If a user has more than one id, + provide an array that includes all of them.' + fields: + user.name: + dashed_name: user-name + description: Short name or login of the user. + example: albert + flat_name: user.name + ignore_above: 1024 + level: core + multi_fields: + - flat_name: user.name.text + name: text + norms: false + type: text + name: name + normalize: [] + short: Short name or login of the user. + type: keyword + group: 2 + name: user + nestings: + - user.group + prefix: user. + reusable: + expected: + - as: user + at: client + full: client.user + - as: user + at: destination + full: destination.user + - as: user + at: host + full: host.user + - as: user + at: server + full: server.user + - as: user + at: source + full: source.user + top_level: true + reused_here: + - full: user.group + schema_name: group + short: User's group relevant to the event. + short: Fields to describe the user relevant to the event. + title: User + type: group +user_agent: + description: 'The user_agent fields normally come from a browser request. + + They often show up in web service logs coming from the parsed user agent string.' + fields: + user_agent.device.name: + dashed_name: user-agent-device-name + description: Name of the device. + example: iPhone + flat_name: user_agent.device.name + ignore_above: 1024 + level: extended + name: device.name + normalize: [] + short: Name of the device. + type: keyword + user_agent.name: + dashed_name: user-agent-name + description: Name of the user agent. + example: Safari + flat_name: user_agent.name + ignore_above: 1024 + level: extended + name: name + normalize: [] + short: Name of the user agent. + type: keyword + user_agent.original: + dashed_name: user-agent-original + description: Unparsed user_agent string. + example: Mozilla/5.0 (iPhone; CPU iPhone OS 12_1 like Mac OS X) AppleWebKit/605.1.15 + (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1 + flat_name: user_agent.original + ignore_above: 1024 + level: extended + multi_fields: + - flat_name: user_agent.original.text + name: text + norms: false + type: text + name: original + normalize: [] + short: Unparsed user_agent string. + type: keyword + user_agent.os.family: + dashed_name: user-agent-os-family + description: OS family (such as redhat, debian, freebsd, windows). + example: debian + flat_name: user_agent.os.family + ignore_above: 1024 + level: extended + name: family + normalize: [] + original_fieldset: os + short: OS family (such as redhat, debian, freebsd, windows). + type: keyword + user_agent.os.full: + dashed_name: user-agent-os-full + description: Operating system name, including the version or code name. + example: Mac OS Mojave + flat_name: user_agent.os.full + ignore_above: 1024 + level: extended + multi_fields: + - flat_name: user_agent.os.full.text + name: text + norms: false + type: text + name: full + normalize: [] + original_fieldset: os + short: Operating system name, including the version or code name. + type: keyword + user_agent.os.kernel: + dashed_name: user-agent-os-kernel + description: Operating system kernel version as a raw string. + example: 4.4.0-112-generic + flat_name: user_agent.os.kernel + ignore_above: 1024 + level: extended + name: kernel + normalize: [] + original_fieldset: os + short: Operating system kernel version as a raw string. + type: keyword + user_agent.os.name: + dashed_name: user-agent-os-name + description: Operating system name, without the version. + example: Mac OS X + flat_name: user_agent.os.name + ignore_above: 1024 + level: extended + multi_fields: + - flat_name: user_agent.os.name.text + name: text + norms: false + type: text + name: name + normalize: [] + original_fieldset: os + short: Operating system name, without the version. + type: keyword + user_agent.os.platform: + dashed_name: user-agent-os-platform + description: Operating system platform (such centos, ubuntu, windows). + example: darwin + flat_name: user_agent.os.platform + ignore_above: 1024 + level: extended + name: platform + normalize: [] + original_fieldset: os + short: Operating system platform (such centos, ubuntu, windows). + type: keyword + user_agent.os.version: + dashed_name: user-agent-os-version + description: Operating system version as a raw string. + example: 10.14.1 + flat_name: user_agent.os.version + ignore_above: 1024 + level: extended + name: version + normalize: [] + original_fieldset: os + short: Operating system version as a raw string. + type: keyword + user_agent.version: + dashed_name: user-agent-version + description: Version of the user agent. + example: 12.0 + flat_name: user_agent.version + ignore_above: 1024 + level: extended + name: version + normalize: [] + short: Version of the user agent. + type: keyword + group: 2 + name: user_agent + nestings: + - user_agent.os + prefix: user_agent. + reused_here: + - full: user_agent.os + schema_name: os + short: OS fields contain information about the operating system. + short: Fields to describe a browser user_agent string. + title: User agent + type: group diff --git a/usage-example/generated/ecs/subset/web_logs/ecs_flat.yml b/usage-example/generated/ecs/subset/web_logs/ecs_flat.yml new file mode 100644 index 0000000000..a2141c7ed2 --- /dev/null +++ b/usage-example/generated/ecs/subset/web_logs/ecs_flat.yml @@ -0,0 +1,3170 @@ +'@timestamp': + dashed_name: -timestamp + description: 'Date/time when the event originated. + + This is the date/time extracted from the event, typically representing when the + event was generated by the source. + + If the event source has no original timestamp, this value is typically populated + by the first time the event was received by the pipeline. + + Required field for all events.' + example: '2016-05-23T08:05:34.853Z' + flat_name: '@timestamp' + level: core + name: '@timestamp' + normalize: [] + required: true + short: Date/time when the event originated. + type: date +acme.account.id: + dashed_name: acme-account-id + description: Customer account for this activity. + flat_name: acme.account.id + ignore_above: 1024 + level: custom + name: account.id + normalize: [] + short: Customer account for this activity. + type: keyword +agent.build.original: + dashed_name: agent-build-original + description: 'Extended build information for the agent. + + This field is intended to contain any build information that a data source may + provide, no specific formatting is required.' + example: metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c + built 2020-02-05 23:10:10 +0000 UTC] + flat_name: agent.build.original + ignore_above: 1024 + level: core + name: build.original + normalize: [] + short: Extended build information for the agent. + type: keyword +agent.ephemeral_id: + dashed_name: agent-ephemeral-id + description: 'Ephemeral identifier of this agent (if one exists). + + This id normally changes across restarts, but `agent.id` does not.' + example: 8a4f500f + flat_name: agent.ephemeral_id + ignore_above: 1024 + level: extended + name: ephemeral_id + normalize: [] + short: Ephemeral identifier of this agent. + type: keyword +agent.id: + dashed_name: agent-id + description: 'Unique identifier of this agent (if one exists). + + Example: For Beats this would be beat.id.' + example: 8a4f500d + flat_name: agent.id + ignore_above: 1024 + level: core + name: id + normalize: [] + short: Unique identifier of this agent. + type: keyword +agent.name: + dashed_name: agent-name + description: 'Custom name of the agent. + + This is a name that can be given to an agent. This can be helpful if for example + two Filebeat instances are running on the same host but a human readable separation + is needed on which Filebeat instance data is coming from. + + If no name is given, the name is often left empty.' + example: foo + flat_name: agent.name + ignore_above: 1024 + level: core + name: name + normalize: [] + short: Custom name of the agent. + type: keyword +agent.type: + dashed_name: agent-type + description: 'Type of the agent. + + The agent type always stays the same and should be given by the agent used. In + case of Filebeat the agent would always be Filebeat also if two Filebeat instances + are run on the same machine.' + example: filebeat + flat_name: agent.type + ignore_above: 1024 + level: core + name: type + normalize: [] + short: Type of the agent. + type: keyword +agent.version: + dashed_name: agent-version + description: Version of the agent. + example: 6.0.0-rc2 + flat_name: agent.version + ignore_above: 1024 + level: core + name: version + normalize: [] + short: Version of the agent. + type: keyword +client.address: + dashed_name: client-address + description: 'Some event client addresses are defined ambiguously. The event will + sometimes list an IP, a domain or a unix socket. You should always store the + raw address in the `.address` field. + + Then it should be duplicated to `.ip` or `.domain`, depending on which one it + is.' + flat_name: client.address + ignore_above: 1024 + level: extended + name: address + normalize: [] + short: Client network address. + type: keyword +client.as.number: + dashed_name: client-as-number + description: Unique number allocated to the autonomous system. The autonomous system + number (ASN) uniquely identifies each network on the Internet. + example: 15169 + flat_name: client.as.number + level: extended + name: number + normalize: [] + original_fieldset: as + short: Unique number allocated to the autonomous system. + type: long +client.as.organization.name: + dashed_name: client-as-organization-name + description: Organization name. + example: Google LLC + flat_name: client.as.organization.name + ignore_above: 1024 + level: extended + multi_fields: + - flat_name: client.as.organization.name.text + name: text + norms: false + type: text + name: organization.name + normalize: [] + original_fieldset: as + short: Organization name. + type: keyword +client.bytes: + dashed_name: client-bytes + description: Bytes sent from the client to the server. + example: 184 + flat_name: client.bytes + format: bytes + level: core + name: bytes + normalize: [] + short: Bytes sent from the client to the server. + type: long +client.domain: + dashed_name: client-domain + description: Client domain. + flat_name: client.domain + ignore_above: 1024 + level: core + name: domain + normalize: [] + short: Client domain. + type: keyword +client.geo.city_name: + dashed_name: client-geo-city-name + description: City name. + example: Montreal + flat_name: client.geo.city_name + ignore_above: 1024 + level: core + name: city_name + normalize: [] + original_fieldset: geo + short: City name. + type: keyword +client.geo.continent_name: + dashed_name: client-geo-continent-name + description: Name of the continent. + example: North America + flat_name: client.geo.continent_name + ignore_above: 1024 + level: core + name: continent_name + normalize: [] + original_fieldset: geo + short: Name of the continent. + type: keyword +client.geo.country_iso_code: + dashed_name: client-geo-country-iso-code + description: Country ISO code. + example: CA + flat_name: client.geo.country_iso_code + ignore_above: 1024 + level: core + name: country_iso_code + normalize: [] + original_fieldset: geo + short: Country ISO code. + type: keyword +client.geo.country_name: + dashed_name: client-geo-country-name + description: Country name. + example: Canada + flat_name: client.geo.country_name + ignore_above: 1024 + level: core + name: country_name + normalize: [] + original_fieldset: geo + short: Country name. + type: keyword +client.geo.location: + dashed_name: client-geo-location + description: Longitude and latitude. + example: '{ "lon": -73.614830, "lat": 45.505918 }' + flat_name: client.geo.location + level: core + name: location + normalize: [] + original_fieldset: geo + short: Longitude and latitude. + type: geo_point +client.geo.name: + dashed_name: client-geo-name + description: 'User-defined description of a location, at the level of granularity + they care about. + + Could be the name of their data centers, the floor number, if this describes a + local physical entity, city names. + + Not typically used in automated geolocation.' + example: boston-dc + flat_name: client.geo.name + ignore_above: 1024 + level: extended + name: name + normalize: [] + original_fieldset: geo + short: User-defined description of a location. + type: keyword +client.geo.region_iso_code: + dashed_name: client-geo-region-iso-code + description: Region ISO code. + example: CA-QC + flat_name: client.geo.region_iso_code + ignore_above: 1024 + level: core + name: region_iso_code + normalize: [] + original_fieldset: geo + short: Region ISO code. + type: keyword +client.geo.region_name: + dashed_name: client-geo-region-name + description: Region name. + example: Quebec + flat_name: client.geo.region_name + ignore_above: 1024 + level: core + name: region_name + normalize: [] + original_fieldset: geo + short: Region name. + type: keyword +client.ip: + dashed_name: client-ip + description: IP address of the client (IPv4 or IPv6). + flat_name: client.ip + level: core + name: ip + normalize: [] + short: IP address of the client. + type: ip +client.mac: + dashed_name: client-mac + description: MAC address of the client. + flat_name: client.mac + ignore_above: 1024 + level: core + name: mac + normalize: [] + short: MAC address of the client. + type: keyword +client.nat.ip: + dashed_name: client-nat-ip + description: 'Translated IP of source based NAT sessions (e.g. internal client to + internet). + + Typically connections traversing load balancers, firewalls, or routers.' + flat_name: client.nat.ip + level: extended + name: nat.ip + normalize: [] + short: Client NAT ip address + type: ip +client.nat.port: + dashed_name: client-nat-port + description: 'Translated port of source based NAT sessions (e.g. internal client + to internet). + + Typically connections traversing load balancers, firewalls, or routers.' + flat_name: client.nat.port + format: string + level: extended + name: nat.port + normalize: [] + short: Client NAT port + type: long +client.packets: + dashed_name: client-packets + description: Packets sent from the client to the server. + example: 12 + flat_name: client.packets + level: core + name: packets + normalize: [] + short: Packets sent from the client to the server. + type: long +client.port: + dashed_name: client-port + description: Port of the client. + flat_name: client.port + format: string + level: core + name: port + normalize: [] + short: Port of the client. + type: long +client.registered_domain: + dashed_name: client-registered-domain + description: 'The highest registered client domain, stripped of the subdomain. + + For example, the registered domain for "foo.example.com" is "example.com". + + This value can be determined precisely with a list like the public suffix list + (http://publicsuffix.org). Trying to approximate this by simply taking the last + two labels will not work well for TLDs such as "co.uk".' + example: example.com + flat_name: client.registered_domain + ignore_above: 1024 + level: extended + name: registered_domain + normalize: [] + short: The highest registered client domain, stripped of the subdomain. + type: keyword +client.top_level_domain: + dashed_name: client-top-level-domain + description: 'The effective top level domain (eTLD), also known as the domain suffix, + is the last part of the domain name. For example, the top level domain for example.com + is "com". + + This value can be determined precisely with a list like the public suffix list + (http://publicsuffix.org). Trying to approximate this by simply taking the last + label will not work well for effective TLDs such as "co.uk".' + example: co.uk + flat_name: client.top_level_domain + ignore_above: 1024 + level: extended + name: top_level_domain + normalize: [] + short: The effective top level domain (com, org, net, co.uk). + type: keyword +client.user.domain: + dashed_name: client-user-domain + description: 'Name of the directory the user is a member of. + + For example, an LDAP or Active Directory domain name.' + flat_name: client.user.domain + ignore_above: 1024 + level: extended + name: domain + normalize: [] + original_fieldset: user + short: Name of the directory the user is a member of. + type: keyword +client.user.email: + dashed_name: client-user-email + description: User email address. + flat_name: client.user.email + ignore_above: 1024 + level: extended + name: email + normalize: [] + original_fieldset: user + short: User email address. + type: keyword +client.user.full_name: + dashed_name: client-user-full-name + description: User's full name, if available. + example: Albert Einstein + flat_name: client.user.full_name + ignore_above: 1024 + level: extended + multi_fields: + - flat_name: client.user.full_name.text + name: text + norms: false + type: text + name: full_name + normalize: [] + original_fieldset: user + short: User's full name, if available. + type: keyword +client.user.group.domain: + dashed_name: client-user-group-domain + description: 'Name of the directory the group is a member of. + + For example, an LDAP or Active Directory domain name.' + flat_name: client.user.group.domain + ignore_above: 1024 + level: extended + name: domain + normalize: [] + original_fieldset: group + short: Name of the directory the group is a member of. + type: keyword +client.user.group.id: + dashed_name: client-user-group-id + description: Unique identifier for the group on the system/platform. + flat_name: client.user.group.id + ignore_above: 1024 + level: extended + name: id + normalize: [] + original_fieldset: group + short: Unique identifier for the group on the system/platform. + type: keyword +client.user.group.name: + dashed_name: client-user-group-name + description: Name of the group. + flat_name: client.user.group.name + ignore_above: 1024 + level: extended + name: name + normalize: [] + original_fieldset: group + short: Name of the group. + type: keyword +client.user.hash: + dashed_name: client-user-hash + description: 'Unique user hash to correlate information for a user in anonymized + form. + + Useful if `user.id` or `user.name` contain confidential information and cannot + be used.' + flat_name: client.user.hash + ignore_above: 1024 + level: extended + name: hash + normalize: [] + original_fieldset: user + short: Unique user hash to correlate information for a user in anonymized form. + type: keyword +client.user.id: + dashed_name: client-user-id + description: Unique identifier of the user. + flat_name: client.user.id + ignore_above: 1024 + level: core + name: id + normalize: [] + original_fieldset: user + short: Unique identifier of the user. + type: keyword +client.user.name: + dashed_name: client-user-name + description: Short name or login of the user. + example: albert + flat_name: client.user.name + ignore_above: 1024 + level: core + multi_fields: + - flat_name: client.user.name.text + name: text + norms: false + type: text + name: name + normalize: [] + original_fieldset: user + short: Short name or login of the user. + type: keyword +client.user.roles: + dashed_name: client-user-roles + description: Array of user roles at the time of the event. + example: '["kibana_admin", "reporting_user"]' + flat_name: client.user.roles + ignore_above: 1024 + level: extended + name: roles + normalize: + - array + original_fieldset: user + short: Array of user roles at the time of the event. + type: keyword +destination.address: + dashed_name: destination-address + description: 'Some event destination addresses are defined ambiguously. The event + will sometimes list an IP, a domain or a unix socket. You should always store + the raw address in the `.address` field. + + Then it should be duplicated to `.ip` or `.domain`, depending on which one it + is.' + flat_name: destination.address + ignore_above: 1024 + level: extended + name: address + normalize: [] + short: Destination network address. + type: keyword +destination.as.number: + dashed_name: destination-as-number + description: Unique number allocated to the autonomous system. The autonomous system + number (ASN) uniquely identifies each network on the Internet. + example: 15169 + flat_name: destination.as.number + level: extended + name: number + normalize: [] + original_fieldset: as + short: Unique number allocated to the autonomous system. + type: long +destination.as.organization.name: + dashed_name: destination-as-organization-name + description: Organization name. + example: Google LLC + flat_name: destination.as.organization.name + ignore_above: 1024 + level: extended + multi_fields: + - flat_name: destination.as.organization.name.text + name: text + norms: false + type: text + name: organization.name + normalize: [] + original_fieldset: as + short: Organization name. + type: keyword +destination.bytes: + dashed_name: destination-bytes + description: Bytes sent from the destination to the source. + example: 184 + flat_name: destination.bytes + format: bytes + level: core + name: bytes + normalize: [] + short: Bytes sent from the destination to the source. + type: long +destination.domain: + dashed_name: destination-domain + description: Destination domain. + flat_name: destination.domain + ignore_above: 1024 + level: core + name: domain + normalize: [] + short: Destination domain. + type: keyword +destination.geo.city_name: + dashed_name: destination-geo-city-name + description: City name. + example: Montreal + flat_name: destination.geo.city_name + ignore_above: 1024 + level: core + name: city_name + normalize: [] + original_fieldset: geo + short: City name. + type: keyword +destination.geo.continent_name: + dashed_name: destination-geo-continent-name + description: Name of the continent. + example: North America + flat_name: destination.geo.continent_name + ignore_above: 1024 + level: core + name: continent_name + normalize: [] + original_fieldset: geo + short: Name of the continent. + type: keyword +destination.geo.country_iso_code: + dashed_name: destination-geo-country-iso-code + description: Country ISO code. + example: CA + flat_name: destination.geo.country_iso_code + ignore_above: 1024 + level: core + name: country_iso_code + normalize: [] + original_fieldset: geo + short: Country ISO code. + type: keyword +destination.geo.country_name: + dashed_name: destination-geo-country-name + description: Country name. + example: Canada + flat_name: destination.geo.country_name + ignore_above: 1024 + level: core + name: country_name + normalize: [] + original_fieldset: geo + short: Country name. + type: keyword +destination.geo.location: + dashed_name: destination-geo-location + description: Longitude and latitude. + example: '{ "lon": -73.614830, "lat": 45.505918 }' + flat_name: destination.geo.location + level: core + name: location + normalize: [] + original_fieldset: geo + short: Longitude and latitude. + type: geo_point +destination.geo.name: + dashed_name: destination-geo-name + description: 'User-defined description of a location, at the level of granularity + they care about. + + Could be the name of their data centers, the floor number, if this describes a + local physical entity, city names. + + Not typically used in automated geolocation.' + example: boston-dc + flat_name: destination.geo.name + ignore_above: 1024 + level: extended + name: name + normalize: [] + original_fieldset: geo + short: User-defined description of a location. + type: keyword +destination.geo.region_iso_code: + dashed_name: destination-geo-region-iso-code + description: Region ISO code. + example: CA-QC + flat_name: destination.geo.region_iso_code + ignore_above: 1024 + level: core + name: region_iso_code + normalize: [] + original_fieldset: geo + short: Region ISO code. + type: keyword +destination.geo.region_name: + dashed_name: destination-geo-region-name + description: Region name. + example: Quebec + flat_name: destination.geo.region_name + ignore_above: 1024 + level: core + name: region_name + normalize: [] + original_fieldset: geo + short: Region name. + type: keyword +destination.ip: + dashed_name: destination-ip + description: IP address of the destination (IPv4 or IPv6). + flat_name: destination.ip + level: core + name: ip + normalize: [] + short: IP address of the destination. + type: ip +destination.mac: + dashed_name: destination-mac + description: MAC address of the destination. + flat_name: destination.mac + ignore_above: 1024 + level: core + name: mac + normalize: [] + short: MAC address of the destination. + type: keyword +destination.nat.ip: + dashed_name: destination-nat-ip + description: 'Translated ip of destination based NAT sessions (e.g. internet to + private DMZ) + + Typically used with load balancers, firewalls, or routers.' + flat_name: destination.nat.ip + level: extended + name: nat.ip + normalize: [] + short: Destination NAT ip + type: ip +destination.nat.port: + dashed_name: destination-nat-port + description: 'Port the source session is translated to by NAT Device. + + Typically used with load balancers, firewalls, or routers.' + flat_name: destination.nat.port + format: string + level: extended + name: nat.port + normalize: [] + short: Destination NAT Port + type: long +destination.packets: + dashed_name: destination-packets + description: Packets sent from the destination to the source. + example: 12 + flat_name: destination.packets + level: core + name: packets + normalize: [] + short: Packets sent from the destination to the source. + type: long +destination.port: + dashed_name: destination-port + description: Port of the destination. + flat_name: destination.port + format: string + level: core + name: port + normalize: [] + short: Port of the destination. + type: long +destination.registered_domain: + dashed_name: destination-registered-domain + description: 'The highest registered destination domain, stripped of the subdomain. + + For example, the registered domain for "foo.example.com" is "example.com". + + This value can be determined precisely with a list like the public suffix list + (http://publicsuffix.org). Trying to approximate this by simply taking the last + two labels will not work well for TLDs such as "co.uk".' + example: example.com + flat_name: destination.registered_domain + ignore_above: 1024 + level: extended + name: registered_domain + normalize: [] + short: The highest registered destination domain, stripped of the subdomain. + type: keyword +destination.top_level_domain: + dashed_name: destination-top-level-domain + description: 'The effective top level domain (eTLD), also known as the domain suffix, + is the last part of the domain name. For example, the top level domain for example.com + is "com". + + This value can be determined precisely with a list like the public suffix list + (http://publicsuffix.org). Trying to approximate this by simply taking the last + label will not work well for effective TLDs such as "co.uk".' + example: co.uk + flat_name: destination.top_level_domain + ignore_above: 1024 + level: extended + name: top_level_domain + normalize: [] + short: The effective top level domain (com, org, net, co.uk). + type: keyword +destination.user.domain: + dashed_name: destination-user-domain + description: 'Name of the directory the user is a member of. + + For example, an LDAP or Active Directory domain name.' + flat_name: destination.user.domain + ignore_above: 1024 + level: extended + name: domain + normalize: [] + original_fieldset: user + short: Name of the directory the user is a member of. + type: keyword +destination.user.email: + dashed_name: destination-user-email + description: User email address. + flat_name: destination.user.email + ignore_above: 1024 + level: extended + name: email + normalize: [] + original_fieldset: user + short: User email address. + type: keyword +destination.user.full_name: + dashed_name: destination-user-full-name + description: User's full name, if available. + example: Albert Einstein + flat_name: destination.user.full_name + ignore_above: 1024 + level: extended + multi_fields: + - flat_name: destination.user.full_name.text + name: text + norms: false + type: text + name: full_name + normalize: [] + original_fieldset: user + short: User's full name, if available. + type: keyword +destination.user.group.domain: + dashed_name: destination-user-group-domain + description: 'Name of the directory the group is a member of. + + For example, an LDAP or Active Directory domain name.' + flat_name: destination.user.group.domain + ignore_above: 1024 + level: extended + name: domain + normalize: [] + original_fieldset: group + short: Name of the directory the group is a member of. + type: keyword +destination.user.group.id: + dashed_name: destination-user-group-id + description: Unique identifier for the group on the system/platform. + flat_name: destination.user.group.id + ignore_above: 1024 + level: extended + name: id + normalize: [] + original_fieldset: group + short: Unique identifier for the group on the system/platform. + type: keyword +destination.user.group.name: + dashed_name: destination-user-group-name + description: Name of the group. + flat_name: destination.user.group.name + ignore_above: 1024 + level: extended + name: name + normalize: [] + original_fieldset: group + short: Name of the group. + type: keyword +destination.user.hash: + dashed_name: destination-user-hash + description: 'Unique user hash to correlate information for a user in anonymized + form. + + Useful if `user.id` or `user.name` contain confidential information and cannot + be used.' + flat_name: destination.user.hash + ignore_above: 1024 + level: extended + name: hash + normalize: [] + original_fieldset: user + short: Unique user hash to correlate information for a user in anonymized form. + type: keyword +destination.user.id: + dashed_name: destination-user-id + description: Unique identifier of the user. + flat_name: destination.user.id + ignore_above: 1024 + level: core + name: id + normalize: [] + original_fieldset: user + short: Unique identifier of the user. + type: keyword +destination.user.name: + dashed_name: destination-user-name + description: Short name or login of the user. + example: albert + flat_name: destination.user.name + ignore_above: 1024 + level: core + multi_fields: + - flat_name: destination.user.name.text + name: text + norms: false + type: text + name: name + normalize: [] + original_fieldset: user + short: Short name or login of the user. + type: keyword +destination.user.roles: + dashed_name: destination-user-roles + description: Array of user roles at the time of the event. + example: '["kibana_admin", "reporting_user"]' + flat_name: destination.user.roles + ignore_above: 1024 + level: extended + name: roles + normalize: + - array + original_fieldset: user + short: Array of user roles at the time of the event. + type: keyword +ecs.version: + dashed_name: ecs-version + description: 'ECS version this event conforms to. `ecs.version` is a required field + and must exist in all events. + + When querying across multiple indices -- which may conform to slightly different + ECS versions -- this field lets integrations adjust to the schema version of the + events.' + example: 1.0.0 + flat_name: ecs.version + ignore_above: 1024 + level: core + name: version + normalize: [] + required: true + short: ECS version this event conforms to. + type: keyword +event.action: + dashed_name: event-action + description: 'The action captured by the event. + + This describes the information in the event. It is more specific than `event.category`. + Examples are `group-add`, `process-started`, `file-created`. The value is normally + defined by the implementer.' + example: user-password-change + flat_name: event.action + ignore_above: 1024 + level: core + name: action + normalize: [] + short: The action captured by the event. + type: keyword +event.category: + allowed_values: + - description: Events in this category are related to the challenge and response + process in which credentials are supplied and verified to allow the creation + of a session. Common sources for these logs are Windows event logs and ssh logs. + Visualize and analyze events in this category to look for failed logins, and + other authentication-related activity. + expected_event_types: + - start + - end + - info + name: authentication + - description: The database category denotes events and metrics relating to a data + storage and retrieval system. Note that use of this category is not limited + to relational database systems. Examples include event logs from MS SQL, MySQL, + Elasticsearch, MongoDB, etc. Use this category to visualize and analyze database + activity such as accesses and changes. + expected_event_types: + - access + - change + - info + - error + name: database + - description: 'Events in the driver category have to do with operating system device + drivers and similar software entities such as Windows drivers, kernel extensions, + kernel modules, etc. + + Use events and metrics in this category to visualize and analyze driver-related + activity and status on hosts.' + expected_event_types: + - change + - end + - info + - start + name: driver + - description: Relating to a set of information that has been created on, or has + existed on a filesystem. Use this category of events to visualize and analyze + the creation, access, and deletions of files. Events in this category can come + from both host-based and network-based sources. An example source of a network-based + detection of a file transfer would be the Zeek file.log. + expected_event_types: + - change + - creation + - deletion + - info + name: file + - description: 'Use this category to visualize and analyze information such as host + inventory or host lifecycle events. + + Most of the events in this category can usually be observed from the outside, + such as from a hypervisor or a control plane''s point of view. Some can also + be seen from within, such as "start" or "end". + + Note that this category is for information about hosts themselves; it is not + meant to capture activity "happening on a host".' + expected_event_types: + - access + - change + - end + - info + - start + name: host + - description: Identity and access management (IAM) events relating to users, groups, + and administration. Use this category to visualize and analyze IAM-related logs + and data from active directory, LDAP, Okta, Duo, and other IAM systems. + expected_event_types: + - admin + - change + - creation + - deletion + - group + - info + - user + name: iam + - description: Relating to intrusion detections from IDS/IPS systems and functions, + both network and host-based. Use this category to visualize and analyze intrusion + detection alerts from systems such as Snort, Suricata, and Palo Alto threat + detections. + expected_event_types: + - allowed + - denied + - info + name: intrusion_detection + - description: Malware detection events and alerts. Use this category to visualize + and analyze malware detections from EDR/EPP systems such as Elastic Endpoint + Security, Symantec Endpoint Protection, Crowdstrike, and network IDS/IPS systems + such as Suricata, or other sources of malware-related events such as Palo Alto + Networks threat logs and Wildfire logs. + expected_event_types: + - info + name: malware + - description: Relating to all network activity, including network connection lifecycle, + network traffic, and essentially any event that includes an IP address. Many + events containing decoded network protocol transactions fit into this category. + Use events in this category to visualize or analyze counts of network ports, + protocols, addresses, geolocation information, etc. + expected_event_types: + - access + - allowed + - connection + - denied + - end + - info + - protocol + - start + name: network + - description: Relating to software packages installed on hosts. Use this category + to visualize and analyze inventory of software installed on various hosts, or + to determine host vulnerability in the absence of vulnerability scan data. + expected_event_types: + - access + - change + - deletion + - info + - installation + - start + name: package + - description: Use this category of events to visualize and analyze process-specific + information such as lifecycle events or process ancestry. + expected_event_types: + - access + - change + - end + - info + - start + name: process + - description: 'Relating to web server access. Use this category to create a dashboard + of web server/proxy activity from apache, IIS, nginx web servers, etc. Note: + events from network observers such as Zeek http log may also be included in + this category.' + expected_event_types: + - access + - error + - info + name: web + dashed_name: event-category + description: 'This is one of four ECS Categorization Fields, and indicates the second + level in the ECS category hierarchy. + + `event.category` represents the "big buckets" of ECS categories. For example, + filtering on `event.category:process` yields all events relating to process activity. + This field is closely related to `event.type`, which is used as a subcategory. + + This field is an array. This will allow proper categorization of some events that + fall in multiple categories.' + example: authentication + flat_name: event.category + ignore_above: 1024 + level: core + name: category + normalize: + - array + short: Event category. The second categorization field in the hierarchy. + type: keyword +event.code: + dashed_name: event-code + description: 'Identification code for this event, if one exists. + + Some event sources use event codes to identify messages unambiguously, regardless + of message language or wording adjustments over time. An example of this is the + Windows Event ID.' + example: 4648 + flat_name: event.code + ignore_above: 1024 + level: extended + name: code + normalize: [] + short: Identification code for this event. + type: keyword +event.created: + dashed_name: event-created + description: 'event.created contains the date/time when the event was first read + by an agent, or by your pipeline. + + This field is distinct from @timestamp in that @timestamp typically contain the + time extracted from the original event. + + In most situations, these two timestamps will be slightly different. The difference + can be used to calculate the delay between your source generating an event, and + the time when your agent first processed it. This can be used to monitor your + agent''s or pipeline''s ability to keep up with your event source. + + In case the two timestamps are identical, @timestamp should be used.' + example: '2016-05-23T08:05:34.857Z' + flat_name: event.created + level: core + name: created + normalize: [] + short: Time when the event was first read by an agent or by your pipeline. + type: date +event.dataset: + dashed_name: event-dataset + description: 'Name of the dataset. + + If an event source publishes more than one type of log or events (e.g. access + log, error log), the dataset is used to specify which one the event comes from. + + It''s recommended but not required to start the dataset name with the module name, + followed by a dot, then the dataset name.' + example: apache.access + flat_name: event.dataset + ignore_above: 1024 + level: core + name: dataset + normalize: [] + short: Name of the dataset. + type: keyword +event.duration: + dashed_name: event-duration + description: 'Duration of the event in nanoseconds. + + If event.start and event.end are known this value should be the difference between + the end and start time.' + flat_name: event.duration + format: duration + input_format: nanoseconds + level: core + name: duration + normalize: [] + output_format: asMilliseconds + output_precision: 1 + short: Duration of the event in nanoseconds. + type: long +event.end: + dashed_name: event-end + description: event.end contains the date when the event ended or when the activity + was last observed. + flat_name: event.end + level: extended + name: end + normalize: [] + short: event.end contains the date when the event ended or when the activity was + last observed. + type: date +event.hash: + dashed_name: event-hash + description: Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate + log integrity. + example: 123456789012345678901234567890ABCD + flat_name: event.hash + ignore_above: 1024 + level: extended + name: hash + normalize: [] + short: Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate + log integrity. + type: keyword +event.id: + dashed_name: event-id + description: Unique ID to describe the event. + example: 8a4f500d + flat_name: event.id + ignore_above: 1024 + level: core + name: id + normalize: [] + short: Unique ID to describe the event. + type: keyword +event.ingested: + dashed_name: event-ingested + description: 'Timestamp when an event arrived in the central data store. + + This is different from `@timestamp`, which is when the event originally occurred. It''s + also different from `event.created`, which is meant to capture the first time + an agent saw the event. + + In normal conditions, assuming no tampering, the timestamps should chronologically + look like this: `@timestamp` < `event.created` < `event.ingested`.' + example: '2016-05-23T08:05:35.101Z' + flat_name: event.ingested + level: core + name: ingested + normalize: [] + short: Timestamp when an event arrived in the central data store. + type: date +event.kind: + allowed_values: + - description: 'This value indicates an event that describes an alert or notable + event, triggered by a detection rule. + + `event.kind:alert` is often populated for events coming from firewalls, intrusion + detection systems, endpoint detection and response systems, and so on.' + name: alert + - description: This value is the most general and most common value for this field. + It is used to represent events that indicate that something happened. + name: event + - description: 'This value is used to indicate that this event describes a numeric + measurement taken at given point in time. + + Examples include CPU utilization, memory usage, or device temperature. + + Metric events are often collected on a predictable frequency, such as once every + few seconds, or once a minute, but can also be used to describe ad-hoc numeric + metric queries.' + name: metric + - description: 'The state value is similar to metric, indicating that this event + describes a measurement taken at given point in time, except that the measurement + does not result in a numeric value, but rather one of a fixed set of categorical + values that represent conditions or states. + + Examples include periodic events reporting Elasticsearch cluster state (green/yellow/red), + the state of a TCP connection (open, closed, fin_wait, etc.), the state of a + host with respect to a software vulnerability (vulnerable, not vulnerable), + and the state of a system regarding compliance with a regulatory standard (compliant, + not compliant). + + Note that an event that describes a change of state would not use `event.kind:state`, + but instead would use ''event.kind:event'' since a state change fits the more + general event definition of something that happened. + + State events are often collected on a predictable frequency, such as once every + few seconds, once a minute, once an hour, or once a day, but can also be used + to describe ad-hoc state queries.' + name: state + - description: This value indicates that an error occurred during the ingestion + of this event, and that event data may be missing, inconsistent, or incorrect. + `event.kind:pipeline_error` is often associated with parsing errors. + name: pipeline_error + - description: 'This value is used by the Elastic SIEM app to denote an Elasticsearch + document that was created by a SIEM detection engine rule. + + A signal will typically trigger a notification that something meaningful happened + and should be investigated. + + Usage of this value is reserved, and pipelines should not populate `event.kind` + with the value "signal".' + name: signal + dashed_name: event-kind + description: 'This is one of four ECS Categorization Fields, and indicates the highest + level in the ECS category hierarchy. + + `event.kind` gives high-level information about what type of information the event + contains, without being specific to the contents of the event. For example, values + of this field distinguish alert events from metric events. + + The value of this field can be used to inform how these kinds of events should + be handled. They may warrant different retention, different access control, it + may also help understand whether the data coming in at a regular interval or not.' + example: alert + flat_name: event.kind + ignore_above: 1024 + level: core + name: kind + normalize: [] + short: The kind of the event. The highest categorization field in the hierarchy. + type: keyword +event.module: + dashed_name: event-module + description: 'Name of the module this data is coming from. + + If your monitoring agent supports the concept of modules or plugins to process + events of a given source (e.g. Apache logs), `event.module` should contain the + name of this module.' + example: apache + flat_name: event.module + ignore_above: 1024 + level: core + name: module + normalize: [] + short: Name of the module this data is coming from. + type: keyword +event.original: + dashed_name: event-original + description: 'Raw text message of entire event. Used to demonstrate log integrity. + + This field is not indexed and doc_values are disabled. It cannot be searched, + but it can be retrieved from `_source`.' + doc_values: false + example: Sep 19 08:26:10 host CEF:0|Security| threatmanager|1.0|100| + worm successfully stopped|10|src=10.0.0.1 dst=2.1.2.2spt=1232 + flat_name: event.original + ignore_above: 1024 + index: false + level: core + name: original + normalize: [] + short: Raw text message of entire event. + type: keyword +event.outcome: + allowed_values: + - description: Indicates that this event describes a failed result. A common example + is `event.category:file AND event.type:access AND event.outcome:failure` to + indicate that a file access was attempted, but was not successful. + name: failure + - description: Indicates that this event describes a successful result. A common + example is `event.category:file AND event.type:create AND event.outcome:success` + to indicate that a file was successfully created. + name: success + - description: Indicates that this event describes only an attempt for which the + result is unknown from the perspective of the event producer. For example, if + the event contains information only about the request side of a transaction + that results in a response, populating `event.outcome:unknown` in the request + event is appropriate. The unknown value should not be used when an outcome doesn't + make logical sense for the event. In such cases `event.outcome` should not be + populated. + name: unknown + dashed_name: event-outcome + description: 'This is one of four ECS Categorization Fields, and indicates the lowest + level in the ECS category hierarchy. + + `event.outcome` simply denotes whether the event represents a success or a failure + from the perspective of the entity that produced the event. + + Note that when a single transaction is described in multiple events, each event + may populate different values of `event.outcome`, according to their perspective. + + Also note that in the case of a compound event (a single event that contains multiple + logical events), this field should be populated with the value that best captures + the overall success or failure from the perspective of the event producer. + + Further note that not all events will have an associated outcome. For example, + this field is generally not populated for metric events, events with `event.type:info`, + or any events for which an outcome does not make logical sense.' + example: success + flat_name: event.outcome + ignore_above: 1024 + level: core + name: outcome + normalize: [] + short: The outcome of the event. The lowest level categorization field in the hierarchy. + type: keyword +event.provider: + dashed_name: event-provider + description: 'Source of the event. + + Event transports such as Syslog or the Windows Event Log typically mention the + source of an event. It can be the name of the software that generated the event + (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).' + example: kernel + flat_name: event.provider + ignore_above: 1024 + level: extended + name: provider + normalize: [] + short: Source of the event. + type: keyword +event.reason: + dashed_name: event-reason + description: 'Reason why this event happened, according to the source. + + This describes the why of a particular action or outcome captured in the event. + Where `event.action` captures the action from the event, `event.reason` describes + why that action was taken. For example, a web proxy with an `event.action` which + denied the request may also populate `event.reason` with the reason why (e.g. + `blocked site`).' + example: Terminated an unexpected process + flat_name: event.reason + ignore_above: 1024 + level: extended + name: reason + normalize: [] + short: Reason why this event happened, according to the source + type: keyword +event.reference: + dashed_name: event-reference + description: 'Reference URL linking to additional information about this event. + + This URL links to a static definition of the this event. Alert events, indicated + by `event.kind:alert`, are a common use case for this field.' + example: https://system.example.com/event/#0001234 + flat_name: event.reference + ignore_above: 1024 + level: extended + name: reference + normalize: [] + short: Event reference URL + type: keyword +event.risk_score: + dashed_name: event-risk-score + description: Risk score or priority of the event (e.g. security solutions). Use + your system's original value here. + flat_name: event.risk_score + level: core + name: risk_score + normalize: [] + short: Risk score or priority of the event (e.g. security solutions). Use your system's + original value here. + type: float +event.risk_score_norm: + dashed_name: event-risk-score-norm + description: 'Normalized risk score or priority of the event, on a scale of 0 to + 100. + + This is mainly useful if you use more than one system that assigns risk scores, + and you want to see a normalized value across all systems.' + flat_name: event.risk_score_norm + level: extended + name: risk_score_norm + normalize: [] + short: Normalized risk score or priority of the event (0-100). + type: float +event.sequence: + dashed_name: event-sequence + description: 'Sequence number of the event. + + The sequence number is a value published by some event sources, to make the exact + ordering of events unambiguous, regardless of the timestamp precision.' + flat_name: event.sequence + format: string + level: extended + name: sequence + normalize: [] + short: Sequence number of the event. + type: long +event.severity: + dashed_name: event-severity + description: 'The numeric severity of the event according to your event source. + + What the different severity values mean can be different between sources and use + cases. It''s up to the implementer to make sure severities are consistent across + events from the same source. + + The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is + meant to represent the severity according to the event source (e.g. firewall, + IDS). If the event source does not publish its own severity, you may optionally + copy the `log.syslog.severity.code` to `event.severity`.' + example: 7 + flat_name: event.severity + format: string + level: core + name: severity + normalize: [] + short: Numeric severity of the event. + type: long +event.start: + dashed_name: event-start + description: event.start contains the date when the event started or when the activity + was first observed. + flat_name: event.start + level: extended + name: start + normalize: [] + short: event.start contains the date when the event started or when the activity + was first observed. + type: date +event.timezone: + dashed_name: event-timezone + description: 'This field should be populated when the event''s timestamp does not + include timezone information already (e.g. default Syslog timestamps). It''s optional + otherwise. + + Acceptable timezone formats are: a canonical ID (e.g. "Europe/Amsterdam"), abbreviated + (e.g. "EST") or an HH:mm differential (e.g. "-05:00").' + flat_name: event.timezone + ignore_above: 1024 + level: extended + name: timezone + normalize: [] + short: Event time zone. + type: keyword +event.type: + allowed_values: + - description: The access event type is used for the subset of events within a category + that indicate that something was accessed. Common examples include `event.category:database + AND event.type:access`, or `event.category:file AND event.type:access`. Note + for file access, both directory listings and file opens should be included in + this subcategory. You can further distinguish access operations using the ECS + `event.action` field. + name: access + - description: 'The admin event type is used for the subset of events within a category + that are related to admin objects. For example, administrative changes within + an IAM framework that do not specifically affect a user or group (e.g., adding + new applications to a federation solution or connecting discrete forests in + Active Directory) would fall into this subcategory. Common example: `event.category:iam + AND event.type:change AND event.type:admin`. You can further distinguish admin + operations using the ECS `event.action` field.' + name: admin + - description: The allowed event type is used for the subset of events within a + category that indicate that something was allowed. Common examples include `event.category:network + AND event.type:connection AND event.type:allowed` (to indicate a network firewall + event for which the firewall disposition was to allow the connection to complete) + and `event.category:intrusion_detection AND event.type:allowed` (to indicate + a network intrusion prevention system event for which the IPS disposition was + to allow the connection to complete). You can further distinguish allowed operations + using the ECS `event.action` field, populating with values of your choosing, + such as "allow", "detect", or "pass". + name: allowed + - description: The change event type is used for the subset of events within a category + that indicate that something has changed. If semantics best describe an event + as modified, then include them in this subcategory. Common examples include + `event.category:process AND event.type:change`, and `event.category:file AND + event.type:change`. You can further distinguish change operations using the + ECS `event.action` field. + name: change + - description: Used primarily with `event.category:network` this value is used for + the subset of network traffic that includes sufficient information for the event + to be included in flow or connection analysis. Events in this subcategory will + contain at least source and destination IP addresses, source and destination + TCP/UDP ports, and will usually contain counts of bytes and/or packets transferred. + Events in this subcategory may contain unidirectional or bidirectional information, + including summary information. Use this subcategory to visualize and analyze + network connections. Flow analysis, including Netflow, IPFIX, and other flow-related + events fit in this subcategory. Note that firewall events from many Next-Generation + Firewall (NGFW) devices will also fit into this subcategory. A common filter + for flow/connection information would be `event.category:network AND event.type:connection + AND event.type:end` (to view or analyze all completed network connections, ignoring + mid-flow reports). You can further distinguish connection events using the ECS + `event.action` field, populating with values of your choosing, such as "timeout", + or "reset". + name: connection + - description: The "creation" event type is used for the subset of events within + a category that indicate that something was created. A common example is `event.category:file + AND event.type:creation`. + name: creation + - description: The deletion event type is used for the subset of events within a + category that indicate that something was deleted. A common example is `event.category:file + AND event.type:deletion` to indicate that a file has been deleted. + name: deletion + - description: The denied event type is used for the subset of events within a category + that indicate that something was denied. Common examples include `event.category:network + AND event.type:denied` (to indicate a network firewall event for which the firewall + disposition was to deny the connection) and `event.category:intrusion_detection + AND event.type:denied` (to indicate a network intrusion prevention system event + for which the IPS disposition was to deny the connection to complete). You can + further distinguish denied operations using the ECS `event.action` field, populating + with values of your choosing, such as "blocked", "dropped", or "quarantined". + name: denied + - description: The end event type is used for the subset of events within a category + that indicate something has ended. A common example is `event.category:process + AND event.type:end`. + name: end + - description: The error event type is used for the subset of events within a category + that indicate or describe an error. A common example is `event.category:database + AND event.type:error`. Note that pipeline errors that occur during the event + ingestion process should not use this `event.type` value. Instead, they should + use `event.kind:pipeline_error`. + name: error + - description: 'The group event type is used for the subset of events within a category + that are related to group objects. Common example: `event.category:iam AND event.type:creation + AND event.type:group`. You can further distinguish group operations using the + ECS `event.action` field.' + name: group + - description: The info event type is used for the subset of events within a category + that indicate that they are purely informational, and don't report a state change, + or any type of action. For example, an initial run of a file integrity monitoring + system (FIM), where an agent reports all files under management, would fall + into the "info" subcategory. Similarly, an event containing a dump of all currently + running processes (as opposed to reporting that a process started/ended) would + fall into the "info" subcategory. An additional common examples is `event.category:intrusion_detection + AND event.type:info`. + name: info + - description: The installation event type is used for the subset of events within + a category that indicate that something was installed. A common example is `event.category:package` + AND `event.type:installation`. + name: installation + - description: The protocol event type is used for the subset of events within a + category that indicate that they contain protocol details or analysis, beyond + simply identifying the protocol. Generally, network events that contain specific + protocol details will fall into this subcategory. A common example is `event.category:network + AND event.type:protocol AND event.type:connection AND event.type:end` (to indicate + that the event is a network connection event sent at the end of a connection + that also includes a protocol detail breakdown). Note that events that only + indicate the name or id of the protocol should not use the protocol value. Further + note that when the protocol subcategory is used, the identified protocol is + populated in the ECS `network.protocol` field. + expected_event_types: + - access + - change + - end + - info + - start + name: protocol + - description: The start event type is used for the subset of events within a category + that indicate something has started. A common example is `event.category:process + AND event.type:start`. + name: start + - description: 'The user event type is used for the subset of events within a category + that are related to user objects. Common example: `event.category:iam AND event.type:deletion + AND event.type:user`. You can further distinguish user operations using the + ECS `event.action` field.' + name: user + dashed_name: event-type + description: 'This is one of four ECS Categorization Fields, and indicates the third + level in the ECS category hierarchy. + + `event.type` represents a categorization "sub-bucket" that, when used along with + the `event.category` field values, enables filtering events down to a level appropriate + for single visualization. + + This field is an array. This will allow proper categorization of some events that + fall in multiple event types.' + flat_name: event.type + ignore_above: 1024 + level: core + name: type + normalize: + - array + short: Event type. The third categorization field in the hierarchy. + type: keyword +event.url: + dashed_name: event-url + description: 'URL linking to an external system to continue investigation of this + event. + + This URL links to another system where in-depth investigation of the specific + occurrence of this event can take place. Alert events, indicated by `event.kind:alert`, + are a common use case for this field.' + example: https://mysystem.example.com/alert/5271dedb-f5b0-4218-87f0-4ac4870a38fe + flat_name: event.url + ignore_above: 1024 + level: extended + name: url + normalize: [] + short: Event investigation URL + type: keyword +http.request.body.bytes: + dashed_name: http-request-body-bytes + description: Size in bytes of the request body. + example: 887 + flat_name: http.request.body.bytes + format: bytes + level: extended + name: request.body.bytes + normalize: [] + short: Size in bytes of the request body. + type: long +http.request.body.content: + dashed_name: http-request-body-content + description: The full HTTP request body. + example: Hello world + flat_name: http.request.body.content + ignore_above: 1024 + level: extended + multi_fields: + - flat_name: http.request.body.content.text + name: text + norms: false + type: text + name: request.body.content + normalize: [] + short: The full HTTP request body. + type: keyword +http.request.bytes: + dashed_name: http-request-bytes + description: Total size in bytes of the request (body and headers). + example: 1437 + flat_name: http.request.bytes + format: bytes + level: extended + name: request.bytes + normalize: [] + short: Total size in bytes of the request (body and headers). + type: long +http.request.method: + dashed_name: http-request-method + description: 'HTTP request method. + + Prior to ECS 1.6.0 the following guidance was provided: + + "The field value must be normalized to lowercase for querying." + + As of ECS 1.6.0, the guidance is deprecated because the original case of the method + may be useful in anomaly detection. Original case will be mandated in ECS 2.0.0' + example: GET, POST, PUT, PoST + flat_name: http.request.method + ignore_above: 1024 + level: extended + name: request.method + normalize: [] + short: HTTP request method. + type: keyword +http.request.referrer: + dashed_name: http-request-referrer + description: Referrer for this HTTP request. + example: https://blog.example.com/ + flat_name: http.request.referrer + ignore_above: 1024 + level: extended + name: request.referrer + normalize: [] + short: Referrer for this HTTP request. + type: keyword +http.response.body.bytes: + dashed_name: http-response-body-bytes + description: Size in bytes of the response body. + example: 887 + flat_name: http.response.body.bytes + format: bytes + level: extended + name: response.body.bytes + normalize: [] + short: Size in bytes of the response body. + type: long +http.response.body.content: + dashed_name: http-response-body-content + description: The full HTTP response body. + example: Hello world + flat_name: http.response.body.content + ignore_above: 1024 + level: extended + multi_fields: + - flat_name: http.response.body.content.text + name: text + norms: false + type: text + name: response.body.content + normalize: [] + short: The full HTTP response body. + type: keyword +http.response.bytes: + dashed_name: http-response-bytes + description: Total size in bytes of the response (body and headers). + example: 1437 + flat_name: http.response.bytes + format: bytes + level: extended + name: response.bytes + normalize: [] + short: Total size in bytes of the response (body and headers). + type: long +http.response.status_code: + dashed_name: http-response-status-code + description: HTTP response status code. + example: 404 + flat_name: http.response.status_code + format: string + level: extended + name: response.status_code + normalize: [] + short: HTTP response status code. + type: long +http.version: + dashed_name: http-version + description: HTTP version. + example: 1.1 + flat_name: http.version + ignore_above: 1024 + level: extended + name: version + normalize: [] + short: HTTP version. + type: keyword +labels: + dashed_name: labels + description: 'Custom key/value pairs. + + Can be used to add meta information to events. Should not contain nested objects. + All values are stored as keyword. + + Example: `docker` and `k8s` labels.' + example: '{"application": "foo-bar", "env": "production"}' + flat_name: labels + level: core + name: labels + normalize: [] + object_type: keyword + short: Custom key/value pairs. + type: object +message: + dashed_name: message + description: 'For log events the message field contains the log message, optimized + for viewing in a log viewer. + + For structured logs without an original message field, other fields can be concatenated + to form a human-readable summary of the event. + + If multiple messages exist, they can be combined into one message.' + example: Hello World + flat_name: message + level: core + name: message + normalize: [] + norms: false + short: Log message optimized for viewing in a log viewer. + type: text +network.application: + dashed_name: network-application + description: 'A name given to an application level protocol. This can be arbitrarily + assigned for things like microservices, but also apply to things like skype, icq, + facebook, twitter. This would be used in situations where the vendor or service + can be decoded such as from the source/dest IP owners, ports, or wire format. + + The field value must be normalized to lowercase for querying. See the documentation + section "Implementing ECS".' + example: aim + flat_name: network.application + ignore_above: 1024 + level: extended + name: application + normalize: [] + short: Application level protocol name. + type: keyword +network.bytes: + dashed_name: network-bytes + description: 'Total bytes transferred in both directions. + + If `source.bytes` and `destination.bytes` are known, `network.bytes` is their + sum.' + example: 368 + flat_name: network.bytes + format: bytes + level: core + name: bytes + normalize: [] + short: Total bytes transferred in both directions. + type: long +network.community_id: + dashed_name: network-community-id + description: 'A hash of source and destination IPs and ports, as well as the protocol + used in a communication. This is a tool-agnostic standard to identify flows. + + Learn more at https://github.com/corelight/community-id-spec.' + example: 1:hO+sN4H+MG5MY/8hIrXPqc4ZQz0= + flat_name: network.community_id + ignore_above: 1024 + level: extended + name: community_id + normalize: [] + short: A hash of source and destination IPs and ports. + type: keyword +network.direction: + dashed_name: network-direction + description: "Direction of the network traffic.\nRecommended values are:\n * inbound\n\ + \ * outbound\n * internal\n * external\n * unknown\n\nWhen mapping events\ + \ from a host-based monitoring context, populate this field from the host's point\ + \ of view.\nWhen mapping events from a network or perimeter-based monitoring context,\ + \ populate this field from the point of view of your network perimeter." + example: inbound + flat_name: network.direction + ignore_above: 1024 + level: core + name: direction + normalize: [] + short: Direction of the network traffic. + type: keyword +network.forwarded_ip: + dashed_name: network-forwarded-ip + description: Host IP address when the source IP address is the proxy. + example: 192.1.1.2 + flat_name: network.forwarded_ip + level: core + name: forwarded_ip + normalize: [] + short: Host IP address when the source IP address is the proxy. + type: ip +network.iana_number: + dashed_name: network-iana-number + description: IANA Protocol Number (https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml). + Standardized list of protocols. This aligns well with NetFlow and sFlow related + logs which use the IANA Protocol Number. + example: 6 + flat_name: network.iana_number + ignore_above: 1024 + level: extended + name: iana_number + normalize: [] + short: IANA Protocol Number. + type: keyword +network.inner: + dashed_name: network-inner + description: Network.inner fields are added in addition to network.vlan fields to + describe the innermost VLAN when q-in-q VLAN tagging is present. Allowed fields + include vlan.id and vlan.name. Inner vlan fields are typically used when sending + traffic with multiple 802.1q encapsulations to a network sensor (e.g. Zeek, Wireshark.) + flat_name: network.inner + level: extended + name: inner + normalize: [] + short: Inner VLAN tag information + type: object +network.inner.vlan.id: + dashed_name: network-inner-vlan-id + description: VLAN ID as reported by the observer. + example: 10 + flat_name: network.inner.vlan.id + ignore_above: 1024 + level: extended + name: id + normalize: [] + original_fieldset: vlan + short: VLAN ID as reported by the observer. + type: keyword +network.inner.vlan.name: + dashed_name: network-inner-vlan-name + description: Optional VLAN name as reported by the observer. + example: outside + flat_name: network.inner.vlan.name + ignore_above: 1024 + level: extended + name: name + normalize: [] + original_fieldset: vlan + short: Optional VLAN name as reported by the observer. + type: keyword +network.name: + dashed_name: network-name + description: Name given by operators to sections of their network. + example: Guest Wifi + flat_name: network.name + ignore_above: 1024 + level: extended + name: name + normalize: [] + short: Name given by operators to sections of their network. + type: keyword +network.packets: + dashed_name: network-packets + description: 'Total packets transferred in both directions. + + If `source.packets` and `destination.packets` are known, `network.packets` is + their sum.' + example: 24 + flat_name: network.packets + level: core + name: packets + normalize: [] + short: Total packets transferred in both directions. + type: long +network.protocol: + dashed_name: network-protocol + description: 'L7 Network protocol name. ex. http, lumberjack, transport protocol. + + The field value must be normalized to lowercase for querying. See the documentation + section "Implementing ECS".' + example: http + flat_name: network.protocol + ignore_above: 1024 + level: core + name: protocol + normalize: [] + short: L7 Network protocol name. + type: keyword +network.transport: + dashed_name: network-transport + description: 'Same as network.iana_number, but instead using the Keyword name of + the transport layer (udp, tcp, ipv6-icmp, etc.) + + The field value must be normalized to lowercase for querying. See the documentation + section "Implementing ECS".' + example: tcp + flat_name: network.transport + ignore_above: 1024 + level: core + name: transport + normalize: [] + short: Protocol Name corresponding to the field `iana_number`. + type: keyword +network.type: + dashed_name: network-type + description: 'In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, + pim, etc + + The field value must be normalized to lowercase for querying. See the documentation + section "Implementing ECS".' + example: ipv4 + flat_name: network.type + ignore_above: 1024 + level: core + name: type + normalize: [] + short: In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, + etc + type: keyword +network.vlan.id: + dashed_name: network-vlan-id + description: VLAN ID as reported by the observer. + example: 10 + flat_name: network.vlan.id + ignore_above: 1024 + level: extended + name: id + normalize: [] + original_fieldset: vlan + short: VLAN ID as reported by the observer. + type: keyword +network.vlan.name: + dashed_name: network-vlan-name + description: Optional VLAN name as reported by the observer. + example: outside + flat_name: network.vlan.name + ignore_above: 1024 + level: extended + name: name + normalize: [] + original_fieldset: vlan + short: Optional VLAN name as reported by the observer. + type: keyword +related.ip: + dashed_name: related-ip + description: All of the IPs seen on your event. + flat_name: related.ip + level: extended + name: ip + normalize: + - array + short: All of the IPs seen on your event. + type: ip +related.user: + dashed_name: related-user + description: All the user names seen on your event. + flat_name: related.user + ignore_above: 1024 + level: extended + name: user + normalize: + - array + short: All the user names seen on your event. + type: keyword +server.address: + dashed_name: server-address + description: 'Some event server addresses are defined ambiguously. The event will + sometimes list an IP, a domain or a unix socket. You should always store the + raw address in the `.address` field. + + Then it should be duplicated to `.ip` or `.domain`, depending on which one it + is.' + flat_name: server.address + ignore_above: 1024 + level: extended + name: address + normalize: [] + short: Server network address. + type: keyword +server.as.number: + dashed_name: server-as-number + description: Unique number allocated to the autonomous system. The autonomous system + number (ASN) uniquely identifies each network on the Internet. + example: 15169 + flat_name: server.as.number + level: extended + name: number + normalize: [] + original_fieldset: as + short: Unique number allocated to the autonomous system. + type: long +server.as.organization.name: + dashed_name: server-as-organization-name + description: Organization name. + example: Google LLC + flat_name: server.as.organization.name + ignore_above: 1024 + level: extended + multi_fields: + - flat_name: server.as.organization.name.text + name: text + norms: false + type: text + name: organization.name + normalize: [] + original_fieldset: as + short: Organization name. + type: keyword +server.bytes: + dashed_name: server-bytes + description: Bytes sent from the server to the client. + example: 184 + flat_name: server.bytes + format: bytes + level: core + name: bytes + normalize: [] + short: Bytes sent from the server to the client. + type: long +server.domain: + dashed_name: server-domain + description: Server domain. + flat_name: server.domain + ignore_above: 1024 + level: core + name: domain + normalize: [] + short: Server domain. + type: keyword +server.geo.city_name: + dashed_name: server-geo-city-name + description: City name. + example: Montreal + flat_name: server.geo.city_name + ignore_above: 1024 + level: core + name: city_name + normalize: [] + original_fieldset: geo + short: City name. + type: keyword +server.geo.continent_name: + dashed_name: server-geo-continent-name + description: Name of the continent. + example: North America + flat_name: server.geo.continent_name + ignore_above: 1024 + level: core + name: continent_name + normalize: [] + original_fieldset: geo + short: Name of the continent. + type: keyword +server.geo.country_iso_code: + dashed_name: server-geo-country-iso-code + description: Country ISO code. + example: CA + flat_name: server.geo.country_iso_code + ignore_above: 1024 + level: core + name: country_iso_code + normalize: [] + original_fieldset: geo + short: Country ISO code. + type: keyword +server.geo.country_name: + dashed_name: server-geo-country-name + description: Country name. + example: Canada + flat_name: server.geo.country_name + ignore_above: 1024 + level: core + name: country_name + normalize: [] + original_fieldset: geo + short: Country name. + type: keyword +server.geo.location: + dashed_name: server-geo-location + description: Longitude and latitude. + example: '{ "lon": -73.614830, "lat": 45.505918 }' + flat_name: server.geo.location + level: core + name: location + normalize: [] + original_fieldset: geo + short: Longitude and latitude. + type: geo_point +server.geo.name: + dashed_name: server-geo-name + description: 'User-defined description of a location, at the level of granularity + they care about. + + Could be the name of their data centers, the floor number, if this describes a + local physical entity, city names. + + Not typically used in automated geolocation.' + example: boston-dc + flat_name: server.geo.name + ignore_above: 1024 + level: extended + name: name + normalize: [] + original_fieldset: geo + short: User-defined description of a location. + type: keyword +server.geo.region_iso_code: + dashed_name: server-geo-region-iso-code + description: Region ISO code. + example: CA-QC + flat_name: server.geo.region_iso_code + ignore_above: 1024 + level: core + name: region_iso_code + normalize: [] + original_fieldset: geo + short: Region ISO code. + type: keyword +server.geo.region_name: + dashed_name: server-geo-region-name + description: Region name. + example: Quebec + flat_name: server.geo.region_name + ignore_above: 1024 + level: core + name: region_name + normalize: [] + original_fieldset: geo + short: Region name. + type: keyword +server.ip: + dashed_name: server-ip + description: IP address of the server (IPv4 or IPv6). + flat_name: server.ip + level: core + name: ip + normalize: [] + short: IP address of the server. + type: ip +server.mac: + dashed_name: server-mac + description: MAC address of the server. + flat_name: server.mac + ignore_above: 1024 + level: core + name: mac + normalize: [] + short: MAC address of the server. + type: keyword +server.nat.ip: + dashed_name: server-nat-ip + description: 'Translated ip of destination based NAT sessions (e.g. internet to + private DMZ) + + Typically used with load balancers, firewalls, or routers.' + flat_name: server.nat.ip + level: extended + name: nat.ip + normalize: [] + short: Server NAT ip + type: ip +server.nat.port: + dashed_name: server-nat-port + description: 'Translated port of destination based NAT sessions (e.g. internet to + private DMZ) + + Typically used with load balancers, firewalls, or routers.' + flat_name: server.nat.port + format: string + level: extended + name: nat.port + normalize: [] + short: Server NAT port + type: long +server.packets: + dashed_name: server-packets + description: Packets sent from the server to the client. + example: 12 + flat_name: server.packets + level: core + name: packets + normalize: [] + short: Packets sent from the server to the client. + type: long +server.port: + dashed_name: server-port + description: Port of the server. + flat_name: server.port + format: string + level: core + name: port + normalize: [] + short: Port of the server. + type: long +server.registered_domain: + dashed_name: server-registered-domain + description: 'The highest registered server domain, stripped of the subdomain. + + For example, the registered domain for "foo.example.com" is "example.com". + + This value can be determined precisely with a list like the public suffix list + (http://publicsuffix.org). Trying to approximate this by simply taking the last + two labels will not work well for TLDs such as "co.uk".' + example: example.com + flat_name: server.registered_domain + ignore_above: 1024 + level: extended + name: registered_domain + normalize: [] + short: The highest registered server domain, stripped of the subdomain. + type: keyword +server.top_level_domain: + dashed_name: server-top-level-domain + description: 'The effective top level domain (eTLD), also known as the domain suffix, + is the last part of the domain name. For example, the top level domain for example.com + is "com". + + This value can be determined precisely with a list like the public suffix list + (http://publicsuffix.org). Trying to approximate this by simply taking the last + label will not work well for effective TLDs such as "co.uk".' + example: co.uk + flat_name: server.top_level_domain + ignore_above: 1024 + level: extended + name: top_level_domain + normalize: [] + short: The effective top level domain (com, org, net, co.uk). + type: keyword +server.user.domain: + dashed_name: server-user-domain + description: 'Name of the directory the user is a member of. + + For example, an LDAP or Active Directory domain name.' + flat_name: server.user.domain + ignore_above: 1024 + level: extended + name: domain + normalize: [] + original_fieldset: user + short: Name of the directory the user is a member of. + type: keyword +server.user.email: + dashed_name: server-user-email + description: User email address. + flat_name: server.user.email + ignore_above: 1024 + level: extended + name: email + normalize: [] + original_fieldset: user + short: User email address. + type: keyword +server.user.full_name: + dashed_name: server-user-full-name + description: User's full name, if available. + example: Albert Einstein + flat_name: server.user.full_name + ignore_above: 1024 + level: extended + multi_fields: + - flat_name: server.user.full_name.text + name: text + norms: false + type: text + name: full_name + normalize: [] + original_fieldset: user + short: User's full name, if available. + type: keyword +server.user.group.domain: + dashed_name: server-user-group-domain + description: 'Name of the directory the group is a member of. + + For example, an LDAP or Active Directory domain name.' + flat_name: server.user.group.domain + ignore_above: 1024 + level: extended + name: domain + normalize: [] + original_fieldset: group + short: Name of the directory the group is a member of. + type: keyword +server.user.group.id: + dashed_name: server-user-group-id + description: Unique identifier for the group on the system/platform. + flat_name: server.user.group.id + ignore_above: 1024 + level: extended + name: id + normalize: [] + original_fieldset: group + short: Unique identifier for the group on the system/platform. + type: keyword +server.user.group.name: + dashed_name: server-user-group-name + description: Name of the group. + flat_name: server.user.group.name + ignore_above: 1024 + level: extended + name: name + normalize: [] + original_fieldset: group + short: Name of the group. + type: keyword +server.user.hash: + dashed_name: server-user-hash + description: 'Unique user hash to correlate information for a user in anonymized + form. + + Useful if `user.id` or `user.name` contain confidential information and cannot + be used.' + flat_name: server.user.hash + ignore_above: 1024 + level: extended + name: hash + normalize: [] + original_fieldset: user + short: Unique user hash to correlate information for a user in anonymized form. + type: keyword +server.user.id: + dashed_name: server-user-id + description: Unique identifier of the user. + flat_name: server.user.id + ignore_above: 1024 + level: core + name: id + normalize: [] + original_fieldset: user + short: Unique identifier of the user. + type: keyword +server.user.name: + dashed_name: server-user-name + description: Short name or login of the user. + example: albert + flat_name: server.user.name + ignore_above: 1024 + level: core + multi_fields: + - flat_name: server.user.name.text + name: text + norms: false + type: text + name: name + normalize: [] + original_fieldset: user + short: Short name or login of the user. + type: keyword +server.user.roles: + dashed_name: server-user-roles + description: Array of user roles at the time of the event. + example: '["kibana_admin", "reporting_user"]' + flat_name: server.user.roles + ignore_above: 1024 + level: extended + name: roles + normalize: + - array + original_fieldset: user + short: Array of user roles at the time of the event. + type: keyword +source.address: + dashed_name: source-address + description: 'Some event source addresses are defined ambiguously. The event will + sometimes list an IP, a domain or a unix socket. You should always store the + raw address in the `.address` field. + + Then it should be duplicated to `.ip` or `.domain`, depending on which one it + is.' + flat_name: source.address + ignore_above: 1024 + level: extended + name: address + normalize: [] + short: Source network address. + type: keyword +source.as.number: + dashed_name: source-as-number + description: Unique number allocated to the autonomous system. The autonomous system + number (ASN) uniquely identifies each network on the Internet. + example: 15169 + flat_name: source.as.number + level: extended + name: number + normalize: [] + original_fieldset: as + short: Unique number allocated to the autonomous system. + type: long +source.as.organization.name: + dashed_name: source-as-organization-name + description: Organization name. + example: Google LLC + flat_name: source.as.organization.name + ignore_above: 1024 + level: extended + multi_fields: + - flat_name: source.as.organization.name.text + name: text + norms: false + type: text + name: organization.name + normalize: [] + original_fieldset: as + short: Organization name. + type: keyword +source.bytes: + dashed_name: source-bytes + description: Bytes sent from the source to the destination. + example: 184 + flat_name: source.bytes + format: bytes + level: core + name: bytes + normalize: [] + short: Bytes sent from the source to the destination. + type: long +source.domain: + dashed_name: source-domain + description: Source domain. + flat_name: source.domain + ignore_above: 1024 + level: core + name: domain + normalize: [] + short: Source domain. + type: keyword +source.geo.city_name: + dashed_name: source-geo-city-name + description: City name. + example: Montreal + flat_name: source.geo.city_name + ignore_above: 1024 + level: core + name: city_name + normalize: [] + original_fieldset: geo + short: City name. + type: keyword +source.geo.continent_name: + dashed_name: source-geo-continent-name + description: Name of the continent. + example: North America + flat_name: source.geo.continent_name + ignore_above: 1024 + level: core + name: continent_name + normalize: [] + original_fieldset: geo + short: Name of the continent. + type: keyword +source.geo.country_iso_code: + dashed_name: source-geo-country-iso-code + description: Country ISO code. + example: CA + flat_name: source.geo.country_iso_code + ignore_above: 1024 + level: core + name: country_iso_code + normalize: [] + original_fieldset: geo + short: Country ISO code. + type: keyword +source.geo.country_name: + dashed_name: source-geo-country-name + description: Country name. + example: Canada + flat_name: source.geo.country_name + ignore_above: 1024 + level: core + name: country_name + normalize: [] + original_fieldset: geo + short: Country name. + type: keyword +source.geo.location: + dashed_name: source-geo-location + description: Longitude and latitude. + example: '{ "lon": -73.614830, "lat": 45.505918 }' + flat_name: source.geo.location + level: core + name: location + normalize: [] + original_fieldset: geo + short: Longitude and latitude. + type: geo_point +source.geo.name: + dashed_name: source-geo-name + description: 'User-defined description of a location, at the level of granularity + they care about. + + Could be the name of their data centers, the floor number, if this describes a + local physical entity, city names. + + Not typically used in automated geolocation.' + example: boston-dc + flat_name: source.geo.name + ignore_above: 1024 + level: extended + name: name + normalize: [] + original_fieldset: geo + short: User-defined description of a location. + type: keyword +source.geo.region_iso_code: + dashed_name: source-geo-region-iso-code + description: Region ISO code. + example: CA-QC + flat_name: source.geo.region_iso_code + ignore_above: 1024 + level: core + name: region_iso_code + normalize: [] + original_fieldset: geo + short: Region ISO code. + type: keyword +source.geo.region_name: + dashed_name: source-geo-region-name + description: Region name. + example: Quebec + flat_name: source.geo.region_name + ignore_above: 1024 + level: core + name: region_name + normalize: [] + original_fieldset: geo + short: Region name. + type: keyword +source.ip: + dashed_name: source-ip + description: IP address of the source (IPv4 or IPv6). + flat_name: source.ip + level: core + name: ip + normalize: [] + short: IP address of the source. + type: ip +source.mac: + dashed_name: source-mac + description: MAC address of the source. + flat_name: source.mac + ignore_above: 1024 + level: core + name: mac + normalize: [] + short: MAC address of the source. + type: keyword +source.nat.ip: + dashed_name: source-nat-ip + description: 'Translated ip of source based NAT sessions (e.g. internal client to + internet) + + Typically connections traversing load balancers, firewalls, or routers.' + flat_name: source.nat.ip + level: extended + name: nat.ip + normalize: [] + short: Source NAT ip + type: ip +source.nat.port: + dashed_name: source-nat-port + description: 'Translated port of source based NAT sessions. (e.g. internal client + to internet) + + Typically used with load balancers, firewalls, or routers.' + flat_name: source.nat.port + format: string + level: extended + name: nat.port + normalize: [] + short: Source NAT port + type: long +source.packets: + dashed_name: source-packets + description: Packets sent from the source to the destination. + example: 12 + flat_name: source.packets + level: core + name: packets + normalize: [] + short: Packets sent from the source to the destination. + type: long +source.port: + dashed_name: source-port + description: Port of the source. + flat_name: source.port + format: string + level: core + name: port + normalize: [] + short: Port of the source. + type: long +source.registered_domain: + dashed_name: source-registered-domain + description: 'The highest registered source domain, stripped of the subdomain. + + For example, the registered domain for "foo.example.com" is "example.com". + + This value can be determined precisely with a list like the public suffix list + (http://publicsuffix.org). Trying to approximate this by simply taking the last + two labels will not work well for TLDs such as "co.uk".' + example: example.com + flat_name: source.registered_domain + ignore_above: 1024 + level: extended + name: registered_domain + normalize: [] + short: The highest registered source domain, stripped of the subdomain. + type: keyword +source.top_level_domain: + dashed_name: source-top-level-domain + description: 'The effective top level domain (eTLD), also known as the domain suffix, + is the last part of the domain name. For example, the top level domain for example.com + is "com". + + This value can be determined precisely with a list like the public suffix list + (http://publicsuffix.org). Trying to approximate this by simply taking the last + label will not work well for effective TLDs such as "co.uk".' + example: co.uk + flat_name: source.top_level_domain + ignore_above: 1024 + level: extended + name: top_level_domain + normalize: [] + short: The effective top level domain (com, org, net, co.uk). + type: keyword +source.user.domain: + dashed_name: source-user-domain + description: 'Name of the directory the user is a member of. + + For example, an LDAP or Active Directory domain name.' + flat_name: source.user.domain + ignore_above: 1024 + level: extended + name: domain + normalize: [] + original_fieldset: user + short: Name of the directory the user is a member of. + type: keyword +source.user.email: + dashed_name: source-user-email + description: User email address. + flat_name: source.user.email + ignore_above: 1024 + level: extended + name: email + normalize: [] + original_fieldset: user + short: User email address. + type: keyword +source.user.full_name: + dashed_name: source-user-full-name + description: User's full name, if available. + example: Albert Einstein + flat_name: source.user.full_name + ignore_above: 1024 + level: extended + multi_fields: + - flat_name: source.user.full_name.text + name: text + norms: false + type: text + name: full_name + normalize: [] + original_fieldset: user + short: User's full name, if available. + type: keyword +source.user.group.domain: + dashed_name: source-user-group-domain + description: 'Name of the directory the group is a member of. + + For example, an LDAP or Active Directory domain name.' + flat_name: source.user.group.domain + ignore_above: 1024 + level: extended + name: domain + normalize: [] + original_fieldset: group + short: Name of the directory the group is a member of. + type: keyword +source.user.group.id: + dashed_name: source-user-group-id + description: Unique identifier for the group on the system/platform. + flat_name: source.user.group.id + ignore_above: 1024 + level: extended + name: id + normalize: [] + original_fieldset: group + short: Unique identifier for the group on the system/platform. + type: keyword +source.user.group.name: + dashed_name: source-user-group-name + description: Name of the group. + flat_name: source.user.group.name + ignore_above: 1024 + level: extended + name: name + normalize: [] + original_fieldset: group + short: Name of the group. + type: keyword +source.user.hash: + dashed_name: source-user-hash + description: 'Unique user hash to correlate information for a user in anonymized + form. + + Useful if `user.id` or `user.name` contain confidential information and cannot + be used.' + flat_name: source.user.hash + ignore_above: 1024 + level: extended + name: hash + normalize: [] + original_fieldset: user + short: Unique user hash to correlate information for a user in anonymized form. + type: keyword +source.user.id: + dashed_name: source-user-id + description: Unique identifier of the user. + flat_name: source.user.id + ignore_above: 1024 + level: core + name: id + normalize: [] + original_fieldset: user + short: Unique identifier of the user. + type: keyword +source.user.name: + dashed_name: source-user-name + description: Short name or login of the user. + example: albert + flat_name: source.user.name + ignore_above: 1024 + level: core + multi_fields: + - flat_name: source.user.name.text + name: text + norms: false + type: text + name: name + normalize: [] + original_fieldset: user + short: Short name or login of the user. + type: keyword +source.user.roles: + dashed_name: source-user-roles + description: Array of user roles at the time of the event. + example: '["kibana_admin", "reporting_user"]' + flat_name: source.user.roles + ignore_above: 1024 + level: extended + name: roles + normalize: + - array + original_fieldset: user + short: Array of user roles at the time of the event. + type: keyword +tags: + dashed_name: tags + description: List of keywords used to tag each event. + example: '["production", "env2"]' + flat_name: tags + ignore_above: 1024 + level: core + name: tags + normalize: + - array + short: List of keywords used to tag each event. + type: keyword +url.domain: + dashed_name: url-domain + description: 'Domain of the url, such as "www.elastic.co". + + In some cases a URL may refer to an IP and/or port directly, without a domain + name. In this case, the IP address would go to the `domain` field.' + example: www.elastic.co + flat_name: url.domain + ignore_above: 1024 + level: extended + name: domain + normalize: [] + short: Domain of the url. + type: keyword +url.extension: + dashed_name: url-extension + description: 'The field contains the file extension from the original request url. + + The file extension is only set if it exists, as not every url has a file extension. + + The leading period must not be included. For example, the value must be "png", + not ".png".' + example: png + flat_name: url.extension + ignore_above: 1024 + level: extended + name: extension + normalize: [] + short: File extension from the original request url. + type: keyword +url.fragment: + dashed_name: url-fragment + description: 'Portion of the url after the `#`, such as "top". + + The `#` is not part of the fragment.' + flat_name: url.fragment + ignore_above: 1024 + level: extended + name: fragment + normalize: [] + short: Portion of the url after the `#`. + type: keyword +url.full: + dashed_name: url-full + description: If full URLs are important to your use case, they should be stored + in `url.full`, whether this field is reconstructed or present in the event source. + example: https://www.elastic.co:443/search?q=elasticsearch#top + flat_name: url.full + ignore_above: 1024 + level: extended + multi_fields: + - flat_name: url.full.text + name: text + norms: false + type: text + name: full + normalize: [] + short: Full unparsed URL. + type: keyword +url.original: + dashed_name: url-original + description: 'Unmodified original url as seen in the event source. + + Note that in network monitoring, the observed URL may be a full URL, whereas in + access logs, the URL is often just represented as a path. + + This field is meant to represent the URL as it was observed, complete or not.' + example: https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch + flat_name: url.original + ignore_above: 1024 + level: extended + multi_fields: + - flat_name: url.original.text + name: text + norms: false + type: text + name: original + normalize: [] + short: Unmodified original url as seen in the event source. + type: keyword +url.password: + dashed_name: url-password + description: Password of the request. + flat_name: url.password + ignore_above: 1024 + level: extended + name: password + normalize: [] + short: Password of the request. + type: keyword +url.path: + dashed_name: url-path + description: Path of the request, such as "/search". + flat_name: url.path + ignore_above: 1024 + level: extended + name: path + normalize: [] + short: Path of the request, such as "/search". + type: keyword +url.port: + dashed_name: url-port + description: Port of the request, such as 443. + example: 443 + flat_name: url.port + format: string + level: extended + name: port + normalize: [] + short: Port of the request, such as 443. + type: long +url.query: + dashed_name: url-query + description: 'The query field describes the query string of the request, such as + "q=elasticsearch". + + The `?` is excluded from the query string. If a URL contains no `?`, there is + no query field. If there is a `?` but no query, the query field exists with an + empty string. The `exists` query can be used to differentiate between the two + cases.' + flat_name: url.query + ignore_above: 1024 + level: extended + name: query + normalize: [] + short: Query string of the request. + type: keyword +url.registered_domain: + dashed_name: url-registered-domain + description: 'The highest registered url domain, stripped of the subdomain. + + For example, the registered domain for "foo.example.com" is "example.com". + + This value can be determined precisely with a list like the public suffix list + (http://publicsuffix.org). Trying to approximate this by simply taking the last + two labels will not work well for TLDs such as "co.uk".' + example: example.com + flat_name: url.registered_domain + ignore_above: 1024 + level: extended + name: registered_domain + normalize: [] + short: The highest registered url domain, stripped of the subdomain. + type: keyword +url.scheme: + dashed_name: url-scheme + description: 'Scheme of the request, such as "https". + + Note: The `:` is not part of the scheme.' + example: https + flat_name: url.scheme + ignore_above: 1024 + level: extended + name: scheme + normalize: [] + short: Scheme of the url. + type: keyword +url.top_level_domain: + dashed_name: url-top-level-domain + description: 'The effective top level domain (eTLD), also known as the domain suffix, + is the last part of the domain name. For example, the top level domain for example.com + is "com". + + This value can be determined precisely with a list like the public suffix list + (http://publicsuffix.org). Trying to approximate this by simply taking the last + label will not work well for effective TLDs such as "co.uk".' + example: co.uk + flat_name: url.top_level_domain + ignore_above: 1024 + level: extended + name: top_level_domain + normalize: [] + short: The effective top level domain (com, org, net, co.uk). + type: keyword +url.username: + dashed_name: url-username + description: Username of the request. + flat_name: url.username + ignore_above: 1024 + level: extended + name: username + normalize: [] + short: Username of the request. + type: keyword +user.name: + dashed_name: user-name + description: Short name or login of the user. + example: albert + flat_name: user.name + ignore_above: 1024 + level: core + multi_fields: + - flat_name: user.name.text + name: text + norms: false + type: text + name: name + normalize: [] + short: Short name or login of the user. + type: keyword +user_agent.device.name: + dashed_name: user-agent-device-name + description: Name of the device. + example: iPhone + flat_name: user_agent.device.name + ignore_above: 1024 + level: extended + name: device.name + normalize: [] + short: Name of the device. + type: keyword +user_agent.name: + dashed_name: user-agent-name + description: Name of the user agent. + example: Safari + flat_name: user_agent.name + ignore_above: 1024 + level: extended + name: name + normalize: [] + short: Name of the user agent. + type: keyword +user_agent.original: + dashed_name: user-agent-original + description: Unparsed user_agent string. + example: Mozilla/5.0 (iPhone; CPU iPhone OS 12_1 like Mac OS X) AppleWebKit/605.1.15 + (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1 + flat_name: user_agent.original + ignore_above: 1024 + level: extended + multi_fields: + - flat_name: user_agent.original.text + name: text + norms: false + type: text + name: original + normalize: [] + short: Unparsed user_agent string. + type: keyword +user_agent.os.family: + dashed_name: user-agent-os-family + description: OS family (such as redhat, debian, freebsd, windows). + example: debian + flat_name: user_agent.os.family + ignore_above: 1024 + level: extended + name: family + normalize: [] + original_fieldset: os + short: OS family (such as redhat, debian, freebsd, windows). + type: keyword +user_agent.os.full: + dashed_name: user-agent-os-full + description: Operating system name, including the version or code name. + example: Mac OS Mojave + flat_name: user_agent.os.full + ignore_above: 1024 + level: extended + multi_fields: + - flat_name: user_agent.os.full.text + name: text + norms: false + type: text + name: full + normalize: [] + original_fieldset: os + short: Operating system name, including the version or code name. + type: keyword +user_agent.os.kernel: + dashed_name: user-agent-os-kernel + description: Operating system kernel version as a raw string. + example: 4.4.0-112-generic + flat_name: user_agent.os.kernel + ignore_above: 1024 + level: extended + name: kernel + normalize: [] + original_fieldset: os + short: Operating system kernel version as a raw string. + type: keyword +user_agent.os.name: + dashed_name: user-agent-os-name + description: Operating system name, without the version. + example: Mac OS X + flat_name: user_agent.os.name + ignore_above: 1024 + level: extended + multi_fields: + - flat_name: user_agent.os.name.text + name: text + norms: false + type: text + name: name + normalize: [] + original_fieldset: os + short: Operating system name, without the version. + type: keyword +user_agent.os.platform: + dashed_name: user-agent-os-platform + description: Operating system platform (such centos, ubuntu, windows). + example: darwin + flat_name: user_agent.os.platform + ignore_above: 1024 + level: extended + name: platform + normalize: [] + original_fieldset: os + short: Operating system platform (such centos, ubuntu, windows). + type: keyword +user_agent.os.version: + dashed_name: user-agent-os-version + description: Operating system version as a raw string. + example: 10.14.1 + flat_name: user_agent.os.version + ignore_above: 1024 + level: extended + name: version + normalize: [] + original_fieldset: os + short: Operating system version as a raw string. + type: keyword +user_agent.version: + dashed_name: user-agent-version + description: Version of the user agent. + example: 12.0 + flat_name: user_agent.version + ignore_above: 1024 + level: extended + name: version + normalize: [] + short: Version of the user agent. + type: keyword diff --git a/usage-example/generated/ecs/subset/web_logs/ecs_nested.yml b/usage-example/generated/ecs/subset/web_logs/ecs_nested.yml new file mode 100644 index 0000000000..82675ddcfc --- /dev/null +++ b/usage-example/generated/ecs/subset/web_logs/ecs_nested.yml @@ -0,0 +1,3500 @@ +acme: + description: Acme Inc. custom fields + fields: + acme.account.id: + dashed_name: acme-account-id + description: Customer account for this activity. + flat_name: acme.account.id + ignore_above: 1024 + level: custom + name: account.id + normalize: [] + short: Customer account for this activity. + type: keyword + group: 2 + name: acme + prefix: acme. + short: Acme Inc. custom fields + title: ACME + type: group +agent: + description: 'The agent fields contain the data about the software entity, if any, + that collects, detects, or observes events on a host, or takes measurements on + a host. + + Examples include Beats. Agents may also run on observers. ECS agent.* fields shall + be populated with details of the agent running on the host or observer where the + event happened or the measurement was taken.' + fields: + agent.build.original: + dashed_name: agent-build-original + description: 'Extended build information for the agent. + + This field is intended to contain any build information that a data source + may provide, no specific formatting is required.' + example: metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c + built 2020-02-05 23:10:10 +0000 UTC] + flat_name: agent.build.original + ignore_above: 1024 + level: core + name: build.original + normalize: [] + short: Extended build information for the agent. + type: keyword + agent.ephemeral_id: + dashed_name: agent-ephemeral-id + description: 'Ephemeral identifier of this agent (if one exists). + + This id normally changes across restarts, but `agent.id` does not.' + example: 8a4f500f + flat_name: agent.ephemeral_id + ignore_above: 1024 + level: extended + name: ephemeral_id + normalize: [] + short: Ephemeral identifier of this agent. + type: keyword + agent.id: + dashed_name: agent-id + description: 'Unique identifier of this agent (if one exists). + + Example: For Beats this would be beat.id.' + example: 8a4f500d + flat_name: agent.id + ignore_above: 1024 + level: core + name: id + normalize: [] + short: Unique identifier of this agent. + type: keyword + agent.name: + dashed_name: agent-name + description: 'Custom name of the agent. + + This is a name that can be given to an agent. This can be helpful if for example + two Filebeat instances are running on the same host but a human readable separation + is needed on which Filebeat instance data is coming from. + + If no name is given, the name is often left empty.' + example: foo + flat_name: agent.name + ignore_above: 1024 + level: core + name: name + normalize: [] + short: Custom name of the agent. + type: keyword + agent.type: + dashed_name: agent-type + description: 'Type of the agent. + + The agent type always stays the same and should be given by the agent used. + In case of Filebeat the agent would always be Filebeat also if two Filebeat + instances are run on the same machine.' + example: filebeat + flat_name: agent.type + ignore_above: 1024 + level: core + name: type + normalize: [] + short: Type of the agent. + type: keyword + agent.version: + dashed_name: agent-version + description: Version of the agent. + example: 6.0.0-rc2 + flat_name: agent.version + ignore_above: 1024 + level: core + name: version + normalize: [] + short: Version of the agent. + type: keyword + footnote: 'Examples: In the case of Beats for logs, the agent.name is filebeat. + For APM, it is the agent running in the app/service. The agent information does + not change if data is sent through queuing systems like Kafka, Redis, or processing + systems such as Logstash or APM Server.' + group: 2 + name: agent + prefix: agent. + short: Fields about the monitoring agent. + title: Agent + type: group +base: + description: The `base` field set contains all fields which are at the root of the + events. These fields are common across all types of events. + fields: + '@timestamp': + dashed_name: -timestamp + description: 'Date/time when the event originated. + + This is the date/time extracted from the event, typically representing when + the event was generated by the source. + + If the event source has no original timestamp, this value is typically populated + by the first time the event was received by the pipeline. + + Required field for all events.' + example: '2016-05-23T08:05:34.853Z' + flat_name: '@timestamp' + level: core + name: '@timestamp' + normalize: [] + required: true + short: Date/time when the event originated. + type: date + labels: + dashed_name: labels + description: 'Custom key/value pairs. + + Can be used to add meta information to events. Should not contain nested objects. + All values are stored as keyword. + + Example: `docker` and `k8s` labels.' + example: '{"application": "foo-bar", "env": "production"}' + flat_name: labels + level: core + name: labels + normalize: [] + object_type: keyword + short: Custom key/value pairs. + type: object + message: + dashed_name: message + description: 'For log events the message field contains the log message, optimized + for viewing in a log viewer. + + For structured logs without an original message field, other fields can be + concatenated to form a human-readable summary of the event. + + If multiple messages exist, they can be combined into one message.' + example: Hello World + flat_name: message + level: core + name: message + normalize: [] + norms: false + short: Log message optimized for viewing in a log viewer. + type: text + tags: + dashed_name: tags + description: List of keywords used to tag each event. + example: '["production", "env2"]' + flat_name: tags + ignore_above: 1024 + level: core + name: tags + normalize: + - array + short: List of keywords used to tag each event. + type: keyword + group: 1 + name: base + prefix: '' + root: true + short: All fields defined directly at the root of the events. + title: Base + type: group +client: + description: 'A client is defined as the initiator of a network connection for events + regarding sessions, connections, or bidirectional flow records. + + For TCP events, the client is the initiator of the TCP connection that sends the + SYN packet(s). For other protocols, the client is generally the initiator or requestor + in the network transaction. Some systems use the term "originator" to refer the + client in TCP connections. The client fields describe details about the system + acting as the client in the network event. Client fields are usually populated + in conjunction with server fields. Client fields are generally not populated for + packet-level events. + + Client / server representations can add semantic context to an exchange, which + is helpful to visualize the data in certain situations. If your context falls + in that category, you should still ensure that source and destination are filled + appropriately.' + fields: + client.address: + dashed_name: client-address + description: 'Some event client addresses are defined ambiguously. The event + will sometimes list an IP, a domain or a unix socket. You should always store + the raw address in the `.address` field. + + Then it should be duplicated to `.ip` or `.domain`, depending on which one + it is.' + flat_name: client.address + ignore_above: 1024 + level: extended + name: address + normalize: [] + short: Client network address. + type: keyword + client.as.number: + dashed_name: client-as-number + description: Unique number allocated to the autonomous system. The autonomous + system number (ASN) uniquely identifies each network on the Internet. + example: 15169 + flat_name: client.as.number + level: extended + name: number + normalize: [] + original_fieldset: as + short: Unique number allocated to the autonomous system. + type: long + client.as.organization.name: + dashed_name: client-as-organization-name + description: Organization name. + example: Google LLC + flat_name: client.as.organization.name + ignore_above: 1024 + level: extended + multi_fields: + - flat_name: client.as.organization.name.text + name: text + norms: false + type: text + name: organization.name + normalize: [] + original_fieldset: as + short: Organization name. + type: keyword + client.bytes: + dashed_name: client-bytes + description: Bytes sent from the client to the server. + example: 184 + flat_name: client.bytes + format: bytes + level: core + name: bytes + normalize: [] + short: Bytes sent from the client to the server. + type: long + client.domain: + dashed_name: client-domain + description: Client domain. + flat_name: client.domain + ignore_above: 1024 + level: core + name: domain + normalize: [] + short: Client domain. + type: keyword + client.geo.city_name: + dashed_name: client-geo-city-name + description: City name. + example: Montreal + flat_name: client.geo.city_name + ignore_above: 1024 + level: core + name: city_name + normalize: [] + original_fieldset: geo + short: City name. + type: keyword + client.geo.continent_name: + dashed_name: client-geo-continent-name + description: Name of the continent. + example: North America + flat_name: client.geo.continent_name + ignore_above: 1024 + level: core + name: continent_name + normalize: [] + original_fieldset: geo + short: Name of the continent. + type: keyword + client.geo.country_iso_code: + dashed_name: client-geo-country-iso-code + description: Country ISO code. + example: CA + flat_name: client.geo.country_iso_code + ignore_above: 1024 + level: core + name: country_iso_code + normalize: [] + original_fieldset: geo + short: Country ISO code. + type: keyword + client.geo.country_name: + dashed_name: client-geo-country-name + description: Country name. + example: Canada + flat_name: client.geo.country_name + ignore_above: 1024 + level: core + name: country_name + normalize: [] + original_fieldset: geo + short: Country name. + type: keyword + client.geo.location: + dashed_name: client-geo-location + description: Longitude and latitude. + example: '{ "lon": -73.614830, "lat": 45.505918 }' + flat_name: client.geo.location + level: core + name: location + normalize: [] + original_fieldset: geo + short: Longitude and latitude. + type: geo_point + client.geo.name: + dashed_name: client-geo-name + description: 'User-defined description of a location, at the level of granularity + they care about. + + Could be the name of their data centers, the floor number, if this describes + a local physical entity, city names. + + Not typically used in automated geolocation.' + example: boston-dc + flat_name: client.geo.name + ignore_above: 1024 + level: extended + name: name + normalize: [] + original_fieldset: geo + short: User-defined description of a location. + type: keyword + client.geo.region_iso_code: + dashed_name: client-geo-region-iso-code + description: Region ISO code. + example: CA-QC + flat_name: client.geo.region_iso_code + ignore_above: 1024 + level: core + name: region_iso_code + normalize: [] + original_fieldset: geo + short: Region ISO code. + type: keyword + client.geo.region_name: + dashed_name: client-geo-region-name + description: Region name. + example: Quebec + flat_name: client.geo.region_name + ignore_above: 1024 + level: core + name: region_name + normalize: [] + original_fieldset: geo + short: Region name. + type: keyword + client.ip: + dashed_name: client-ip + description: IP address of the client (IPv4 or IPv6). + flat_name: client.ip + level: core + name: ip + normalize: [] + short: IP address of the client. + type: ip + client.mac: + dashed_name: client-mac + description: MAC address of the client. + flat_name: client.mac + ignore_above: 1024 + level: core + name: mac + normalize: [] + short: MAC address of the client. + type: keyword + client.nat.ip: + dashed_name: client-nat-ip + description: 'Translated IP of source based NAT sessions (e.g. internal client + to internet). + + Typically connections traversing load balancers, firewalls, or routers.' + flat_name: client.nat.ip + level: extended + name: nat.ip + normalize: [] + short: Client NAT ip address + type: ip + client.nat.port: + dashed_name: client-nat-port + description: 'Translated port of source based NAT sessions (e.g. internal client + to internet). + + Typically connections traversing load balancers, firewalls, or routers.' + flat_name: client.nat.port + format: string + level: extended + name: nat.port + normalize: [] + short: Client NAT port + type: long + client.packets: + dashed_name: client-packets + description: Packets sent from the client to the server. + example: 12 + flat_name: client.packets + level: core + name: packets + normalize: [] + short: Packets sent from the client to the server. + type: long + client.port: + dashed_name: client-port + description: Port of the client. + flat_name: client.port + format: string + level: core + name: port + normalize: [] + short: Port of the client. + type: long + client.registered_domain: + dashed_name: client-registered-domain + description: 'The highest registered client domain, stripped of the subdomain. + + For example, the registered domain for "foo.example.com" is "example.com". + + This value can be determined precisely with a list like the public suffix + list (http://publicsuffix.org). Trying to approximate this by simply taking + the last two labels will not work well for TLDs such as "co.uk".' + example: example.com + flat_name: client.registered_domain + ignore_above: 1024 + level: extended + name: registered_domain + normalize: [] + short: The highest registered client domain, stripped of the subdomain. + type: keyword + client.top_level_domain: + dashed_name: client-top-level-domain + description: 'The effective top level domain (eTLD), also known as the domain + suffix, is the last part of the domain name. For example, the top level domain + for example.com is "com". + + This value can be determined precisely with a list like the public suffix + list (http://publicsuffix.org). Trying to approximate this by simply taking + the last label will not work well for effective TLDs such as "co.uk".' + example: co.uk + flat_name: client.top_level_domain + ignore_above: 1024 + level: extended + name: top_level_domain + normalize: [] + short: The effective top level domain (com, org, net, co.uk). + type: keyword + client.user.domain: + dashed_name: client-user-domain + description: 'Name of the directory the user is a member of. + + For example, an LDAP or Active Directory domain name.' + flat_name: client.user.domain + ignore_above: 1024 + level: extended + name: domain + normalize: [] + original_fieldset: user + short: Name of the directory the user is a member of. + type: keyword + client.user.email: + dashed_name: client-user-email + description: User email address. + flat_name: client.user.email + ignore_above: 1024 + level: extended + name: email + normalize: [] + original_fieldset: user + short: User email address. + type: keyword + client.user.full_name: + dashed_name: client-user-full-name + description: User's full name, if available. + example: Albert Einstein + flat_name: client.user.full_name + ignore_above: 1024 + level: extended + multi_fields: + - flat_name: client.user.full_name.text + name: text + norms: false + type: text + name: full_name + normalize: [] + original_fieldset: user + short: User's full name, if available. + type: keyword + client.user.group.domain: + dashed_name: client-user-group-domain + description: 'Name of the directory the group is a member of. + + For example, an LDAP or Active Directory domain name.' + flat_name: client.user.group.domain + ignore_above: 1024 + level: extended + name: domain + normalize: [] + original_fieldset: group + short: Name of the directory the group is a member of. + type: keyword + client.user.group.id: + dashed_name: client-user-group-id + description: Unique identifier for the group on the system/platform. + flat_name: client.user.group.id + ignore_above: 1024 + level: extended + name: id + normalize: [] + original_fieldset: group + short: Unique identifier for the group on the system/platform. + type: keyword + client.user.group.name: + dashed_name: client-user-group-name + description: Name of the group. + flat_name: client.user.group.name + ignore_above: 1024 + level: extended + name: name + normalize: [] + original_fieldset: group + short: Name of the group. + type: keyword + client.user.hash: + dashed_name: client-user-hash + description: 'Unique user hash to correlate information for a user in anonymized + form. + + Useful if `user.id` or `user.name` contain confidential information and cannot + be used.' + flat_name: client.user.hash + ignore_above: 1024 + level: extended + name: hash + normalize: [] + original_fieldset: user + short: Unique user hash to correlate information for a user in anonymized form. + type: keyword + client.user.id: + dashed_name: client-user-id + description: Unique identifier of the user. + flat_name: client.user.id + ignore_above: 1024 + level: core + name: id + normalize: [] + original_fieldset: user + short: Unique identifier of the user. + type: keyword + client.user.name: + dashed_name: client-user-name + description: Short name or login of the user. + example: albert + flat_name: client.user.name + ignore_above: 1024 + level: core + multi_fields: + - flat_name: client.user.name.text + name: text + norms: false + type: text + name: name + normalize: [] + original_fieldset: user + short: Short name or login of the user. + type: keyword + client.user.roles: + dashed_name: client-user-roles + description: Array of user roles at the time of the event. + example: '["kibana_admin", "reporting_user"]' + flat_name: client.user.roles + ignore_above: 1024 + level: extended + name: roles + normalize: + - array + original_fieldset: user + short: Array of user roles at the time of the event. + type: keyword + group: 2 + name: client + nestings: + - client.as + - client.geo + - client.user + prefix: client. + reused_here: + - full: client.as + schema_name: as + short: Fields describing an Autonomous System (Internet routing prefix). + - full: client.geo + schema_name: geo + short: Fields describing a location. + - full: client.user + schema_name: user + short: Fields to describe the user relevant to the event. + short: Fields about the client side of a network connection, used with server. + title: Client + type: group +destination: + description: 'Destination fields describe details about the destination of a packet/event. + + Destination fields are usually populated in conjunction with source fields.' + fields: + destination.address: + dashed_name: destination-address + description: 'Some event destination addresses are defined ambiguously. The + event will sometimes list an IP, a domain or a unix socket. You should always + store the raw address in the `.address` field. + + Then it should be duplicated to `.ip` or `.domain`, depending on which one + it is.' + flat_name: destination.address + ignore_above: 1024 + level: extended + name: address + normalize: [] + short: Destination network address. + type: keyword + destination.as.number: + dashed_name: destination-as-number + description: Unique number allocated to the autonomous system. The autonomous + system number (ASN) uniquely identifies each network on the Internet. + example: 15169 + flat_name: destination.as.number + level: extended + name: number + normalize: [] + original_fieldset: as + short: Unique number allocated to the autonomous system. + type: long + destination.as.organization.name: + dashed_name: destination-as-organization-name + description: Organization name. + example: Google LLC + flat_name: destination.as.organization.name + ignore_above: 1024 + level: extended + multi_fields: + - flat_name: destination.as.organization.name.text + name: text + norms: false + type: text + name: organization.name + normalize: [] + original_fieldset: as + short: Organization name. + type: keyword + destination.bytes: + dashed_name: destination-bytes + description: Bytes sent from the destination to the source. + example: 184 + flat_name: destination.bytes + format: bytes + level: core + name: bytes + normalize: [] + short: Bytes sent from the destination to the source. + type: long + destination.domain: + dashed_name: destination-domain + description: Destination domain. + flat_name: destination.domain + ignore_above: 1024 + level: core + name: domain + normalize: [] + short: Destination domain. + type: keyword + destination.geo.city_name: + dashed_name: destination-geo-city-name + description: City name. + example: Montreal + flat_name: destination.geo.city_name + ignore_above: 1024 + level: core + name: city_name + normalize: [] + original_fieldset: geo + short: City name. + type: keyword + destination.geo.continent_name: + dashed_name: destination-geo-continent-name + description: Name of the continent. + example: North America + flat_name: destination.geo.continent_name + ignore_above: 1024 + level: core + name: continent_name + normalize: [] + original_fieldset: geo + short: Name of the continent. + type: keyword + destination.geo.country_iso_code: + dashed_name: destination-geo-country-iso-code + description: Country ISO code. + example: CA + flat_name: destination.geo.country_iso_code + ignore_above: 1024 + level: core + name: country_iso_code + normalize: [] + original_fieldset: geo + short: Country ISO code. + type: keyword + destination.geo.country_name: + dashed_name: destination-geo-country-name + description: Country name. + example: Canada + flat_name: destination.geo.country_name + ignore_above: 1024 + level: core + name: country_name + normalize: [] + original_fieldset: geo + short: Country name. + type: keyword + destination.geo.location: + dashed_name: destination-geo-location + description: Longitude and latitude. + example: '{ "lon": -73.614830, "lat": 45.505918 }' + flat_name: destination.geo.location + level: core + name: location + normalize: [] + original_fieldset: geo + short: Longitude and latitude. + type: geo_point + destination.geo.name: + dashed_name: destination-geo-name + description: 'User-defined description of a location, at the level of granularity + they care about. + + Could be the name of their data centers, the floor number, if this describes + a local physical entity, city names. + + Not typically used in automated geolocation.' + example: boston-dc + flat_name: destination.geo.name + ignore_above: 1024 + level: extended + name: name + normalize: [] + original_fieldset: geo + short: User-defined description of a location. + type: keyword + destination.geo.region_iso_code: + dashed_name: destination-geo-region-iso-code + description: Region ISO code. + example: CA-QC + flat_name: destination.geo.region_iso_code + ignore_above: 1024 + level: core + name: region_iso_code + normalize: [] + original_fieldset: geo + short: Region ISO code. + type: keyword + destination.geo.region_name: + dashed_name: destination-geo-region-name + description: Region name. + example: Quebec + flat_name: destination.geo.region_name + ignore_above: 1024 + level: core + name: region_name + normalize: [] + original_fieldset: geo + short: Region name. + type: keyword + destination.ip: + dashed_name: destination-ip + description: IP address of the destination (IPv4 or IPv6). + flat_name: destination.ip + level: core + name: ip + normalize: [] + short: IP address of the destination. + type: ip + destination.mac: + dashed_name: destination-mac + description: MAC address of the destination. + flat_name: destination.mac + ignore_above: 1024 + level: core + name: mac + normalize: [] + short: MAC address of the destination. + type: keyword + destination.nat.ip: + dashed_name: destination-nat-ip + description: 'Translated ip of destination based NAT sessions (e.g. internet + to private DMZ) + + Typically used with load balancers, firewalls, or routers.' + flat_name: destination.nat.ip + level: extended + name: nat.ip + normalize: [] + short: Destination NAT ip + type: ip + destination.nat.port: + dashed_name: destination-nat-port + description: 'Port the source session is translated to by NAT Device. + + Typically used with load balancers, firewalls, or routers.' + flat_name: destination.nat.port + format: string + level: extended + name: nat.port + normalize: [] + short: Destination NAT Port + type: long + destination.packets: + dashed_name: destination-packets + description: Packets sent from the destination to the source. + example: 12 + flat_name: destination.packets + level: core + name: packets + normalize: [] + short: Packets sent from the destination to the source. + type: long + destination.port: + dashed_name: destination-port + description: Port of the destination. + flat_name: destination.port + format: string + level: core + name: port + normalize: [] + short: Port of the destination. + type: long + destination.registered_domain: + dashed_name: destination-registered-domain + description: 'The highest registered destination domain, stripped of the subdomain. + + For example, the registered domain for "foo.example.com" is "example.com". + + This value can be determined precisely with a list like the public suffix + list (http://publicsuffix.org). Trying to approximate this by simply taking + the last two labels will not work well for TLDs such as "co.uk".' + example: example.com + flat_name: destination.registered_domain + ignore_above: 1024 + level: extended + name: registered_domain + normalize: [] + short: The highest registered destination domain, stripped of the subdomain. + type: keyword + destination.top_level_domain: + dashed_name: destination-top-level-domain + description: 'The effective top level domain (eTLD), also known as the domain + suffix, is the last part of the domain name. For example, the top level domain + for example.com is "com". + + This value can be determined precisely with a list like the public suffix + list (http://publicsuffix.org). Trying to approximate this by simply taking + the last label will not work well for effective TLDs such as "co.uk".' + example: co.uk + flat_name: destination.top_level_domain + ignore_above: 1024 + level: extended + name: top_level_domain + normalize: [] + short: The effective top level domain (com, org, net, co.uk). + type: keyword + destination.user.domain: + dashed_name: destination-user-domain + description: 'Name of the directory the user is a member of. + + For example, an LDAP or Active Directory domain name.' + flat_name: destination.user.domain + ignore_above: 1024 + level: extended + name: domain + normalize: [] + original_fieldset: user + short: Name of the directory the user is a member of. + type: keyword + destination.user.email: + dashed_name: destination-user-email + description: User email address. + flat_name: destination.user.email + ignore_above: 1024 + level: extended + name: email + normalize: [] + original_fieldset: user + short: User email address. + type: keyword + destination.user.full_name: + dashed_name: destination-user-full-name + description: User's full name, if available. + example: Albert Einstein + flat_name: destination.user.full_name + ignore_above: 1024 + level: extended + multi_fields: + - flat_name: destination.user.full_name.text + name: text + norms: false + type: text + name: full_name + normalize: [] + original_fieldset: user + short: User's full name, if available. + type: keyword + destination.user.group.domain: + dashed_name: destination-user-group-domain + description: 'Name of the directory the group is a member of. + + For example, an LDAP or Active Directory domain name.' + flat_name: destination.user.group.domain + ignore_above: 1024 + level: extended + name: domain + normalize: [] + original_fieldset: group + short: Name of the directory the group is a member of. + type: keyword + destination.user.group.id: + dashed_name: destination-user-group-id + description: Unique identifier for the group on the system/platform. + flat_name: destination.user.group.id + ignore_above: 1024 + level: extended + name: id + normalize: [] + original_fieldset: group + short: Unique identifier for the group on the system/platform. + type: keyword + destination.user.group.name: + dashed_name: destination-user-group-name + description: Name of the group. + flat_name: destination.user.group.name + ignore_above: 1024 + level: extended + name: name + normalize: [] + original_fieldset: group + short: Name of the group. + type: keyword + destination.user.hash: + dashed_name: destination-user-hash + description: 'Unique user hash to correlate information for a user in anonymized + form. + + Useful if `user.id` or `user.name` contain confidential information and cannot + be used.' + flat_name: destination.user.hash + ignore_above: 1024 + level: extended + name: hash + normalize: [] + original_fieldset: user + short: Unique user hash to correlate information for a user in anonymized form. + type: keyword + destination.user.id: + dashed_name: destination-user-id + description: Unique identifier of the user. + flat_name: destination.user.id + ignore_above: 1024 + level: core + name: id + normalize: [] + original_fieldset: user + short: Unique identifier of the user. + type: keyword + destination.user.name: + dashed_name: destination-user-name + description: Short name or login of the user. + example: albert + flat_name: destination.user.name + ignore_above: 1024 + level: core + multi_fields: + - flat_name: destination.user.name.text + name: text + norms: false + type: text + name: name + normalize: [] + original_fieldset: user + short: Short name or login of the user. + type: keyword + destination.user.roles: + dashed_name: destination-user-roles + description: Array of user roles at the time of the event. + example: '["kibana_admin", "reporting_user"]' + flat_name: destination.user.roles + ignore_above: 1024 + level: extended + name: roles + normalize: + - array + original_fieldset: user + short: Array of user roles at the time of the event. + type: keyword + group: 2 + name: destination + nestings: + - destination.as + - destination.geo + - destination.user + prefix: destination. + reused_here: + - full: destination.as + schema_name: as + short: Fields describing an Autonomous System (Internet routing prefix). + - full: destination.geo + schema_name: geo + short: Fields describing a location. + - full: destination.user + schema_name: user + short: Fields to describe the user relevant to the event. + short: Fields about the destination side of a network connection, used with source. + title: Destination + type: group +ecs: + description: Meta-information specific to ECS. + fields: + ecs.version: + dashed_name: ecs-version + description: 'ECS version this event conforms to. `ecs.version` is a required + field and must exist in all events. + + When querying across multiple indices -- which may conform to slightly different + ECS versions -- this field lets integrations adjust to the schema version + of the events.' + example: 1.0.0 + flat_name: ecs.version + ignore_above: 1024 + level: core + name: version + normalize: [] + required: true + short: ECS version this event conforms to. + type: keyword + group: 2 + name: ecs + prefix: ecs. + short: Meta-information specific to ECS. + title: ECS + type: group +event: + description: 'The event fields are used for context information about the log or + metric event itself. + + A log is defined as an event containing details of something that happened. Log + events must include the time at which the thing happened. Examples of log events + include a process starting on a host, a network packet being sent from a source + to a destination, or a network connection between a client and a server being + initiated or closed. A metric is defined as an event containing one or more numerical + measurements and the time at which the measurement was taken. Examples of metric + events include memory pressure measured on a host and device temperature. See + the `event.kind` definition in this section for additional details about metric + and state events.' + fields: + event.action: + dashed_name: event-action + description: 'The action captured by the event. + + This describes the information in the event. It is more specific than `event.category`. + Examples are `group-add`, `process-started`, `file-created`. The value is + normally defined by the implementer.' + example: user-password-change + flat_name: event.action + ignore_above: 1024 + level: core + name: action + normalize: [] + short: The action captured by the event. + type: keyword + event.category: + allowed_values: + - description: Events in this category are related to the challenge and response + process in which credentials are supplied and verified to allow the creation + of a session. Common sources for these logs are Windows event logs and ssh + logs. Visualize and analyze events in this category to look for failed logins, + and other authentication-related activity. + expected_event_types: + - start + - end + - info + name: authentication + - description: The database category denotes events and metrics relating to + a data storage and retrieval system. Note that use of this category is not + limited to relational database systems. Examples include event logs from + MS SQL, MySQL, Elasticsearch, MongoDB, etc. Use this category to visualize + and analyze database activity such as accesses and changes. + expected_event_types: + - access + - change + - info + - error + name: database + - description: 'Events in the driver category have to do with operating system + device drivers and similar software entities such as Windows drivers, kernel + extensions, kernel modules, etc. + + Use events and metrics in this category to visualize and analyze driver-related + activity and status on hosts.' + expected_event_types: + - change + - end + - info + - start + name: driver + - description: Relating to a set of information that has been created on, or + has existed on a filesystem. Use this category of events to visualize and + analyze the creation, access, and deletions of files. Events in this category + can come from both host-based and network-based sources. An example source + of a network-based detection of a file transfer would be the Zeek file.log. + expected_event_types: + - change + - creation + - deletion + - info + name: file + - description: 'Use this category to visualize and analyze information such + as host inventory or host lifecycle events. + + Most of the events in this category can usually be observed from the outside, + such as from a hypervisor or a control plane''s point of view. Some can + also be seen from within, such as "start" or "end". + + Note that this category is for information about hosts themselves; it is + not meant to capture activity "happening on a host".' + expected_event_types: + - access + - change + - end + - info + - start + name: host + - description: Identity and access management (IAM) events relating to users, + groups, and administration. Use this category to visualize and analyze IAM-related + logs and data from active directory, LDAP, Okta, Duo, and other IAM systems. + expected_event_types: + - admin + - change + - creation + - deletion + - group + - info + - user + name: iam + - description: Relating to intrusion detections from IDS/IPS systems and functions, + both network and host-based. Use this category to visualize and analyze + intrusion detection alerts from systems such as Snort, Suricata, and Palo + Alto threat detections. + expected_event_types: + - allowed + - denied + - info + name: intrusion_detection + - description: Malware detection events and alerts. Use this category to visualize + and analyze malware detections from EDR/EPP systems such as Elastic Endpoint + Security, Symantec Endpoint Protection, Crowdstrike, and network IDS/IPS + systems such as Suricata, or other sources of malware-related events such + as Palo Alto Networks threat logs and Wildfire logs. + expected_event_types: + - info + name: malware + - description: Relating to all network activity, including network connection + lifecycle, network traffic, and essentially any event that includes an IP + address. Many events containing decoded network protocol transactions fit + into this category. Use events in this category to visualize or analyze + counts of network ports, protocols, addresses, geolocation information, + etc. + expected_event_types: + - access + - allowed + - connection + - denied + - end + - info + - protocol + - start + name: network + - description: Relating to software packages installed on hosts. Use this category + to visualize and analyze inventory of software installed on various hosts, + or to determine host vulnerability in the absence of vulnerability scan + data. + expected_event_types: + - access + - change + - deletion + - info + - installation + - start + name: package + - description: Use this category of events to visualize and analyze process-specific + information such as lifecycle events or process ancestry. + expected_event_types: + - access + - change + - end + - info + - start + name: process + - description: 'Relating to web server access. Use this category to create a + dashboard of web server/proxy activity from apache, IIS, nginx web servers, + etc. Note: events from network observers such as Zeek http log may also + be included in this category.' + expected_event_types: + - access + - error + - info + name: web + dashed_name: event-category + description: 'This is one of four ECS Categorization Fields, and indicates the + second level in the ECS category hierarchy. + + `event.category` represents the "big buckets" of ECS categories. For example, + filtering on `event.category:process` yields all events relating to process + activity. This field is closely related to `event.type`, which is used as + a subcategory. + + This field is an array. This will allow proper categorization of some events + that fall in multiple categories.' + example: authentication + flat_name: event.category + ignore_above: 1024 + level: core + name: category + normalize: + - array + short: Event category. The second categorization field in the hierarchy. + type: keyword + event.code: + dashed_name: event-code + description: 'Identification code for this event, if one exists. + + Some event sources use event codes to identify messages unambiguously, regardless + of message language or wording adjustments over time. An example of this is + the Windows Event ID.' + example: 4648 + flat_name: event.code + ignore_above: 1024 + level: extended + name: code + normalize: [] + short: Identification code for this event. + type: keyword + event.created: + dashed_name: event-created + description: 'event.created contains the date/time when the event was first + read by an agent, or by your pipeline. + + This field is distinct from @timestamp in that @timestamp typically contain + the time extracted from the original event. + + In most situations, these two timestamps will be slightly different. The difference + can be used to calculate the delay between your source generating an event, + and the time when your agent first processed it. This can be used to monitor + your agent''s or pipeline''s ability to keep up with your event source. + + In case the two timestamps are identical, @timestamp should be used.' + example: '2016-05-23T08:05:34.857Z' + flat_name: event.created + level: core + name: created + normalize: [] + short: Time when the event was first read by an agent or by your pipeline. + type: date + event.dataset: + dashed_name: event-dataset + description: 'Name of the dataset. + + If an event source publishes more than one type of log or events (e.g. access + log, error log), the dataset is used to specify which one the event comes + from. + + It''s recommended but not required to start the dataset name with the module + name, followed by a dot, then the dataset name.' + example: apache.access + flat_name: event.dataset + ignore_above: 1024 + level: core + name: dataset + normalize: [] + short: Name of the dataset. + type: keyword + event.duration: + dashed_name: event-duration + description: 'Duration of the event in nanoseconds. + + If event.start and event.end are known this value should be the difference + between the end and start time.' + flat_name: event.duration + format: duration + input_format: nanoseconds + level: core + name: duration + normalize: [] + output_format: asMilliseconds + output_precision: 1 + short: Duration of the event in nanoseconds. + type: long + event.end: + dashed_name: event-end + description: event.end contains the date when the event ended or when the activity + was last observed. + flat_name: event.end + level: extended + name: end + normalize: [] + short: event.end contains the date when the event ended or when the activity + was last observed. + type: date + event.hash: + dashed_name: event-hash + description: Hash (perhaps logstash fingerprint) of raw field to be able to + demonstrate log integrity. + example: 123456789012345678901234567890ABCD + flat_name: event.hash + ignore_above: 1024 + level: extended + name: hash + normalize: [] + short: Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate + log integrity. + type: keyword + event.id: + dashed_name: event-id + description: Unique ID to describe the event. + example: 8a4f500d + flat_name: event.id + ignore_above: 1024 + level: core + name: id + normalize: [] + short: Unique ID to describe the event. + type: keyword + event.ingested: + dashed_name: event-ingested + description: 'Timestamp when an event arrived in the central data store. + + This is different from `@timestamp`, which is when the event originally occurred. It''s + also different from `event.created`, which is meant to capture the first time + an agent saw the event. + + In normal conditions, assuming no tampering, the timestamps should chronologically + look like this: `@timestamp` < `event.created` < `event.ingested`.' + example: '2016-05-23T08:05:35.101Z' + flat_name: event.ingested + level: core + name: ingested + normalize: [] + short: Timestamp when an event arrived in the central data store. + type: date + event.kind: + allowed_values: + - description: 'This value indicates an event that describes an alert or notable + event, triggered by a detection rule. + + `event.kind:alert` is often populated for events coming from firewalls, + intrusion detection systems, endpoint detection and response systems, and + so on.' + name: alert + - description: This value is the most general and most common value for this + field. It is used to represent events that indicate that something happened. + name: event + - description: 'This value is used to indicate that this event describes a numeric + measurement taken at given point in time. + + Examples include CPU utilization, memory usage, or device temperature. + + Metric events are often collected on a predictable frequency, such as once + every few seconds, or once a minute, but can also be used to describe ad-hoc + numeric metric queries.' + name: metric + - description: 'The state value is similar to metric, indicating that this event + describes a measurement taken at given point in time, except that the measurement + does not result in a numeric value, but rather one of a fixed set of categorical + values that represent conditions or states. + + Examples include periodic events reporting Elasticsearch cluster state (green/yellow/red), + the state of a TCP connection (open, closed, fin_wait, etc.), the state + of a host with respect to a software vulnerability (vulnerable, not vulnerable), + and the state of a system regarding compliance with a regulatory standard + (compliant, not compliant). + + Note that an event that describes a change of state would not use `event.kind:state`, + but instead would use ''event.kind:event'' since a state change fits the + more general event definition of something that happened. + + State events are often collected on a predictable frequency, such as once + every few seconds, once a minute, once an hour, or once a day, but can also + be used to describe ad-hoc state queries.' + name: state + - description: This value indicates that an error occurred during the ingestion + of this event, and that event data may be missing, inconsistent, or incorrect. + `event.kind:pipeline_error` is often associated with parsing errors. + name: pipeline_error + - description: 'This value is used by the Elastic SIEM app to denote an Elasticsearch + document that was created by a SIEM detection engine rule. + + A signal will typically trigger a notification that something meaningful + happened and should be investigated. + + Usage of this value is reserved, and pipelines should not populate `event.kind` + with the value "signal".' + name: signal + dashed_name: event-kind + description: 'This is one of four ECS Categorization Fields, and indicates the + highest level in the ECS category hierarchy. + + `event.kind` gives high-level information about what type of information the + event contains, without being specific to the contents of the event. For example, + values of this field distinguish alert events from metric events. + + The value of this field can be used to inform how these kinds of events should + be handled. They may warrant different retention, different access control, + it may also help understand whether the data coming in at a regular interval + or not.' + example: alert + flat_name: event.kind + ignore_above: 1024 + level: core + name: kind + normalize: [] + short: The kind of the event. The highest categorization field in the hierarchy. + type: keyword + event.module: + dashed_name: event-module + description: 'Name of the module this data is coming from. + + If your monitoring agent supports the concept of modules or plugins to process + events of a given source (e.g. Apache logs), `event.module` should contain + the name of this module.' + example: apache + flat_name: event.module + ignore_above: 1024 + level: core + name: module + normalize: [] + short: Name of the module this data is coming from. + type: keyword + event.original: + dashed_name: event-original + description: 'Raw text message of entire event. Used to demonstrate log integrity. + + This field is not indexed and doc_values are disabled. It cannot be searched, + but it can be retrieved from `_source`.' + doc_values: false + example: Sep 19 08:26:10 host CEF:0|Security| threatmanager|1.0|100| + worm successfully stopped|10|src=10.0.0.1 dst=2.1.2.2spt=1232 + flat_name: event.original + ignore_above: 1024 + index: false + level: core + name: original + normalize: [] + short: Raw text message of entire event. + type: keyword + event.outcome: + allowed_values: + - description: Indicates that this event describes a failed result. A common + example is `event.category:file AND event.type:access AND event.outcome:failure` + to indicate that a file access was attempted, but was not successful. + name: failure + - description: Indicates that this event describes a successful result. A common + example is `event.category:file AND event.type:create AND event.outcome:success` + to indicate that a file was successfully created. + name: success + - description: Indicates that this event describes only an attempt for which + the result is unknown from the perspective of the event producer. For example, + if the event contains information only about the request side of a transaction + that results in a response, populating `event.outcome:unknown` in the request + event is appropriate. The unknown value should not be used when an outcome + doesn't make logical sense for the event. In such cases `event.outcome` + should not be populated. + name: unknown + dashed_name: event-outcome + description: 'This is one of four ECS Categorization Fields, and indicates the + lowest level in the ECS category hierarchy. + + `event.outcome` simply denotes whether the event represents a success or a + failure from the perspective of the entity that produced the event. + + Note that when a single transaction is described in multiple events, each + event may populate different values of `event.outcome`, according to their + perspective. + + Also note that in the case of a compound event (a single event that contains + multiple logical events), this field should be populated with the value that + best captures the overall success or failure from the perspective of the event + producer. + + Further note that not all events will have an associated outcome. For example, + this field is generally not populated for metric events, events with `event.type:info`, + or any events for which an outcome does not make logical sense.' + example: success + flat_name: event.outcome + ignore_above: 1024 + level: core + name: outcome + normalize: [] + short: The outcome of the event. The lowest level categorization field in the + hierarchy. + type: keyword + event.provider: + dashed_name: event-provider + description: 'Source of the event. + + Event transports such as Syslog or the Windows Event Log typically mention + the source of an event. It can be the name of the software that generated + the event (e.g. Sysmon, httpd), or of a subsystem of the operating system + (kernel, Microsoft-Windows-Security-Auditing).' + example: kernel + flat_name: event.provider + ignore_above: 1024 + level: extended + name: provider + normalize: [] + short: Source of the event. + type: keyword + event.reason: + dashed_name: event-reason + description: 'Reason why this event happened, according to the source. + + This describes the why of a particular action or outcome captured in the event. + Where `event.action` captures the action from the event, `event.reason` describes + why that action was taken. For example, a web proxy with an `event.action` + which denied the request may also populate `event.reason` with the reason + why (e.g. `blocked site`).' + example: Terminated an unexpected process + flat_name: event.reason + ignore_above: 1024 + level: extended + name: reason + normalize: [] + short: Reason why this event happened, according to the source + type: keyword + event.reference: + dashed_name: event-reference + description: 'Reference URL linking to additional information about this event. + + This URL links to a static definition of the this event. Alert events, indicated + by `event.kind:alert`, are a common use case for this field.' + example: https://system.example.com/event/#0001234 + flat_name: event.reference + ignore_above: 1024 + level: extended + name: reference + normalize: [] + short: Event reference URL + type: keyword + event.risk_score: + dashed_name: event-risk-score + description: Risk score or priority of the event (e.g. security solutions). + Use your system's original value here. + flat_name: event.risk_score + level: core + name: risk_score + normalize: [] + short: Risk score or priority of the event (e.g. security solutions). Use your + system's original value here. + type: float + event.risk_score_norm: + dashed_name: event-risk-score-norm + description: 'Normalized risk score or priority of the event, on a scale of + 0 to 100. + + This is mainly useful if you use more than one system that assigns risk scores, + and you want to see a normalized value across all systems.' + flat_name: event.risk_score_norm + level: extended + name: risk_score_norm + normalize: [] + short: Normalized risk score or priority of the event (0-100). + type: float + event.sequence: + dashed_name: event-sequence + description: 'Sequence number of the event. + + The sequence number is a value published by some event sources, to make the + exact ordering of events unambiguous, regardless of the timestamp precision.' + flat_name: event.sequence + format: string + level: extended + name: sequence + normalize: [] + short: Sequence number of the event. + type: long + event.severity: + dashed_name: event-severity + description: 'The numeric severity of the event according to your event source. + + What the different severity values mean can be different between sources and + use cases. It''s up to the implementer to make sure severities are consistent + across events from the same source. + + The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` + is meant to represent the severity according to the event source (e.g. firewall, + IDS). If the event source does not publish its own severity, you may optionally + copy the `log.syslog.severity.code` to `event.severity`.' + example: 7 + flat_name: event.severity + format: string + level: core + name: severity + normalize: [] + short: Numeric severity of the event. + type: long + event.start: + dashed_name: event-start + description: event.start contains the date when the event started or when the + activity was first observed. + flat_name: event.start + level: extended + name: start + normalize: [] + short: event.start contains the date when the event started or when the activity + was first observed. + type: date + event.timezone: + dashed_name: event-timezone + description: 'This field should be populated when the event''s timestamp does + not include timezone information already (e.g. default Syslog timestamps). + It''s optional otherwise. + + Acceptable timezone formats are: a canonical ID (e.g. "Europe/Amsterdam"), + abbreviated (e.g. "EST") or an HH:mm differential (e.g. "-05:00").' + flat_name: event.timezone + ignore_above: 1024 + level: extended + name: timezone + normalize: [] + short: Event time zone. + type: keyword + event.type: + allowed_values: + - description: The access event type is used for the subset of events within + a category that indicate that something was accessed. Common examples include + `event.category:database AND event.type:access`, or `event.category:file + AND event.type:access`. Note for file access, both directory listings and + file opens should be included in this subcategory. You can further distinguish + access operations using the ECS `event.action` field. + name: access + - description: 'The admin event type is used for the subset of events within + a category that are related to admin objects. For example, administrative + changes within an IAM framework that do not specifically affect a user or + group (e.g., adding new applications to a federation solution or connecting + discrete forests in Active Directory) would fall into this subcategory. + Common example: `event.category:iam AND event.type:change AND event.type:admin`. + You can further distinguish admin operations using the ECS `event.action` + field.' + name: admin + - description: The allowed event type is used for the subset of events within + a category that indicate that something was allowed. Common examples include + `event.category:network AND event.type:connection AND event.type:allowed` + (to indicate a network firewall event for which the firewall disposition + was to allow the connection to complete) and `event.category:intrusion_detection + AND event.type:allowed` (to indicate a network intrusion prevention system + event for which the IPS disposition was to allow the connection to complete). + You can further distinguish allowed operations using the ECS `event.action` + field, populating with values of your choosing, such as "allow", "detect", + or "pass". + name: allowed + - description: The change event type is used for the subset of events within + a category that indicate that something has changed. If semantics best describe + an event as modified, then include them in this subcategory. Common examples + include `event.category:process AND event.type:change`, and `event.category:file + AND event.type:change`. You can further distinguish change operations using + the ECS `event.action` field. + name: change + - description: Used primarily with `event.category:network` this value is used + for the subset of network traffic that includes sufficient information for + the event to be included in flow or connection analysis. Events in this + subcategory will contain at least source and destination IP addresses, source + and destination TCP/UDP ports, and will usually contain counts of bytes + and/or packets transferred. Events in this subcategory may contain unidirectional + or bidirectional information, including summary information. Use this subcategory + to visualize and analyze network connections. Flow analysis, including Netflow, + IPFIX, and other flow-related events fit in this subcategory. Note that + firewall events from many Next-Generation Firewall (NGFW) devices will also + fit into this subcategory. A common filter for flow/connection information + would be `event.category:network AND event.type:connection AND event.type:end` + (to view or analyze all completed network connections, ignoring mid-flow + reports). You can further distinguish connection events using the ECS `event.action` + field, populating with values of your choosing, such as "timeout", or "reset". + name: connection + - description: The "creation" event type is used for the subset of events within + a category that indicate that something was created. A common example is + `event.category:file AND event.type:creation`. + name: creation + - description: The deletion event type is used for the subset of events within + a category that indicate that something was deleted. A common example is + `event.category:file AND event.type:deletion` to indicate that a file has + been deleted. + name: deletion + - description: The denied event type is used for the subset of events within + a category that indicate that something was denied. Common examples include + `event.category:network AND event.type:denied` (to indicate a network firewall + event for which the firewall disposition was to deny the connection) and + `event.category:intrusion_detection AND event.type:denied` (to indicate + a network intrusion prevention system event for which the IPS disposition + was to deny the connection to complete). You can further distinguish denied + operations using the ECS `event.action` field, populating with values of + your choosing, such as "blocked", "dropped", or "quarantined". + name: denied + - description: The end event type is used for the subset of events within a + category that indicate something has ended. A common example is `event.category:process + AND event.type:end`. + name: end + - description: The error event type is used for the subset of events within + a category that indicate or describe an error. A common example is `event.category:database + AND event.type:error`. Note that pipeline errors that occur during the event + ingestion process should not use this `event.type` value. Instead, they + should use `event.kind:pipeline_error`. + name: error + - description: 'The group event type is used for the subset of events within + a category that are related to group objects. Common example: `event.category:iam + AND event.type:creation AND event.type:group`. You can further distinguish + group operations using the ECS `event.action` field.' + name: group + - description: The info event type is used for the subset of events within a + category that indicate that they are purely informational, and don't report + a state change, or any type of action. For example, an initial run of a + file integrity monitoring system (FIM), where an agent reports all files + under management, would fall into the "info" subcategory. Similarly, an + event containing a dump of all currently running processes (as opposed to + reporting that a process started/ended) would fall into the "info" subcategory. + An additional common examples is `event.category:intrusion_detection AND + event.type:info`. + name: info + - description: The installation event type is used for the subset of events + within a category that indicate that something was installed. A common example + is `event.category:package` AND `event.type:installation`. + name: installation + - description: The protocol event type is used for the subset of events within + a category that indicate that they contain protocol details or analysis, + beyond simply identifying the protocol. Generally, network events that contain + specific protocol details will fall into this subcategory. A common example + is `event.category:network AND event.type:protocol AND event.type:connection + AND event.type:end` (to indicate that the event is a network connection + event sent at the end of a connection that also includes a protocol detail + breakdown). Note that events that only indicate the name or id of the protocol + should not use the protocol value. Further note that when the protocol subcategory + is used, the identified protocol is populated in the ECS `network.protocol` + field. + expected_event_types: + - access + - change + - end + - info + - start + name: protocol + - description: The start event type is used for the subset of events within + a category that indicate something has started. A common example is `event.category:process + AND event.type:start`. + name: start + - description: 'The user event type is used for the subset of events within + a category that are related to user objects. Common example: `event.category:iam + AND event.type:deletion AND event.type:user`. You can further distinguish + user operations using the ECS `event.action` field.' + name: user + dashed_name: event-type + description: 'This is one of four ECS Categorization Fields, and indicates the + third level in the ECS category hierarchy. + + `event.type` represents a categorization "sub-bucket" that, when used along + with the `event.category` field values, enables filtering events down to a + level appropriate for single visualization. + + This field is an array. This will allow proper categorization of some events + that fall in multiple event types.' + flat_name: event.type + ignore_above: 1024 + level: core + name: type + normalize: + - array + short: Event type. The third categorization field in the hierarchy. + type: keyword + event.url: + dashed_name: event-url + description: 'URL linking to an external system to continue investigation of + this event. + + This URL links to another system where in-depth investigation of the specific + occurrence of this event can take place. Alert events, indicated by `event.kind:alert`, + are a common use case for this field.' + example: https://mysystem.example.com/alert/5271dedb-f5b0-4218-87f0-4ac4870a38fe + flat_name: event.url + ignore_above: 1024 + level: extended + name: url + normalize: [] + short: Event investigation URL + type: keyword + group: 2 + name: event + prefix: event. + short: Fields breaking down the event details. + title: Event + type: group +http: + description: Fields related to HTTP activity. Use the `url` field set to store the + url of the request. + fields: + http.request.body.bytes: + dashed_name: http-request-body-bytes + description: Size in bytes of the request body. + example: 887 + flat_name: http.request.body.bytes + format: bytes + level: extended + name: request.body.bytes + normalize: [] + short: Size in bytes of the request body. + type: long + http.request.body.content: + dashed_name: http-request-body-content + description: The full HTTP request body. + example: Hello world + flat_name: http.request.body.content + ignore_above: 1024 + level: extended + multi_fields: + - flat_name: http.request.body.content.text + name: text + norms: false + type: text + name: request.body.content + normalize: [] + short: The full HTTP request body. + type: keyword + http.request.bytes: + dashed_name: http-request-bytes + description: Total size in bytes of the request (body and headers). + example: 1437 + flat_name: http.request.bytes + format: bytes + level: extended + name: request.bytes + normalize: [] + short: Total size in bytes of the request (body and headers). + type: long + http.request.method: + dashed_name: http-request-method + description: 'HTTP request method. + + Prior to ECS 1.6.0 the following guidance was provided: + + "The field value must be normalized to lowercase for querying." + + As of ECS 1.6.0, the guidance is deprecated because the original case of the + method may be useful in anomaly detection. Original case will be mandated + in ECS 2.0.0' + example: GET, POST, PUT, PoST + flat_name: http.request.method + ignore_above: 1024 + level: extended + name: request.method + normalize: [] + short: HTTP request method. + type: keyword + http.request.referrer: + dashed_name: http-request-referrer + description: Referrer for this HTTP request. + example: https://blog.example.com/ + flat_name: http.request.referrer + ignore_above: 1024 + level: extended + name: request.referrer + normalize: [] + short: Referrer for this HTTP request. + type: keyword + http.response.body.bytes: + dashed_name: http-response-body-bytes + description: Size in bytes of the response body. + example: 887 + flat_name: http.response.body.bytes + format: bytes + level: extended + name: response.body.bytes + normalize: [] + short: Size in bytes of the response body. + type: long + http.response.body.content: + dashed_name: http-response-body-content + description: The full HTTP response body. + example: Hello world + flat_name: http.response.body.content + ignore_above: 1024 + level: extended + multi_fields: + - flat_name: http.response.body.content.text + name: text + norms: false + type: text + name: response.body.content + normalize: [] + short: The full HTTP response body. + type: keyword + http.response.bytes: + dashed_name: http-response-bytes + description: Total size in bytes of the response (body and headers). + example: 1437 + flat_name: http.response.bytes + format: bytes + level: extended + name: response.bytes + normalize: [] + short: Total size in bytes of the response (body and headers). + type: long + http.response.status_code: + dashed_name: http-response-status-code + description: HTTP response status code. + example: 404 + flat_name: http.response.status_code + format: string + level: extended + name: response.status_code + normalize: [] + short: HTTP response status code. + type: long + http.version: + dashed_name: http-version + description: HTTP version. + example: 1.1 + flat_name: http.version + ignore_above: 1024 + level: extended + name: version + normalize: [] + short: HTTP version. + type: keyword + group: 2 + name: http + prefix: http. + short: Fields describing an HTTP request. + title: HTTP + type: group +network: + description: 'The network is defined as the communication path over which a host + or network event happens. + + The network.* fields should be populated with details about the network activity + associated with an event.' + fields: + network.application: + dashed_name: network-application + description: 'A name given to an application level protocol. This can be arbitrarily + assigned for things like microservices, but also apply to things like skype, + icq, facebook, twitter. This would be used in situations where the vendor + or service can be decoded such as from the source/dest IP owners, ports, or + wire format. + + The field value must be normalized to lowercase for querying. See the documentation + section "Implementing ECS".' + example: aim + flat_name: network.application + ignore_above: 1024 + level: extended + name: application + normalize: [] + short: Application level protocol name. + type: keyword + network.bytes: + dashed_name: network-bytes + description: 'Total bytes transferred in both directions. + + If `source.bytes` and `destination.bytes` are known, `network.bytes` is their + sum.' + example: 368 + flat_name: network.bytes + format: bytes + level: core + name: bytes + normalize: [] + short: Total bytes transferred in both directions. + type: long + network.community_id: + dashed_name: network-community-id + description: 'A hash of source and destination IPs and ports, as well as the + protocol used in a communication. This is a tool-agnostic standard to identify + flows. + + Learn more at https://github.com/corelight/community-id-spec.' + example: 1:hO+sN4H+MG5MY/8hIrXPqc4ZQz0= + flat_name: network.community_id + ignore_above: 1024 + level: extended + name: community_id + normalize: [] + short: A hash of source and destination IPs and ports. + type: keyword + network.direction: + dashed_name: network-direction + description: "Direction of the network traffic.\nRecommended values are:\n \ + \ * inbound\n * outbound\n * internal\n * external\n * unknown\n\nWhen\ + \ mapping events from a host-based monitoring context, populate this field\ + \ from the host's point of view.\nWhen mapping events from a network or perimeter-based\ + \ monitoring context, populate this field from the point of view of your network\ + \ perimeter." + example: inbound + flat_name: network.direction + ignore_above: 1024 + level: core + name: direction + normalize: [] + short: Direction of the network traffic. + type: keyword + network.forwarded_ip: + dashed_name: network-forwarded-ip + description: Host IP address when the source IP address is the proxy. + example: 192.1.1.2 + flat_name: network.forwarded_ip + level: core + name: forwarded_ip + normalize: [] + short: Host IP address when the source IP address is the proxy. + type: ip + network.iana_number: + dashed_name: network-iana-number + description: IANA Protocol Number (https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml). + Standardized list of protocols. This aligns well with NetFlow and sFlow related + logs which use the IANA Protocol Number. + example: 6 + flat_name: network.iana_number + ignore_above: 1024 + level: extended + name: iana_number + normalize: [] + short: IANA Protocol Number. + type: keyword + network.inner: + dashed_name: network-inner + description: Network.inner fields are added in addition to network.vlan fields + to describe the innermost VLAN when q-in-q VLAN tagging is present. Allowed + fields include vlan.id and vlan.name. Inner vlan fields are typically used + when sending traffic with multiple 802.1q encapsulations to a network sensor + (e.g. Zeek, Wireshark.) + flat_name: network.inner + level: extended + name: inner + normalize: [] + short: Inner VLAN tag information + type: object + network.inner.vlan.id: + dashed_name: network-inner-vlan-id + description: VLAN ID as reported by the observer. + example: 10 + flat_name: network.inner.vlan.id + ignore_above: 1024 + level: extended + name: id + normalize: [] + original_fieldset: vlan + short: VLAN ID as reported by the observer. + type: keyword + network.inner.vlan.name: + dashed_name: network-inner-vlan-name + description: Optional VLAN name as reported by the observer. + example: outside + flat_name: network.inner.vlan.name + ignore_above: 1024 + level: extended + name: name + normalize: [] + original_fieldset: vlan + short: Optional VLAN name as reported by the observer. + type: keyword + network.name: + dashed_name: network-name + description: Name given by operators to sections of their network. + example: Guest Wifi + flat_name: network.name + ignore_above: 1024 + level: extended + name: name + normalize: [] + short: Name given by operators to sections of their network. + type: keyword + network.packets: + dashed_name: network-packets + description: 'Total packets transferred in both directions. + + If `source.packets` and `destination.packets` are known, `network.packets` + is their sum.' + example: 24 + flat_name: network.packets + level: core + name: packets + normalize: [] + short: Total packets transferred in both directions. + type: long + network.protocol: + dashed_name: network-protocol + description: 'L7 Network protocol name. ex. http, lumberjack, transport protocol. + + The field value must be normalized to lowercase for querying. See the documentation + section "Implementing ECS".' + example: http + flat_name: network.protocol + ignore_above: 1024 + level: core + name: protocol + normalize: [] + short: L7 Network protocol name. + type: keyword + network.transport: + dashed_name: network-transport + description: 'Same as network.iana_number, but instead using the Keyword name + of the transport layer (udp, tcp, ipv6-icmp, etc.) + + The field value must be normalized to lowercase for querying. See the documentation + section "Implementing ECS".' + example: tcp + flat_name: network.transport + ignore_above: 1024 + level: core + name: transport + normalize: [] + short: Protocol Name corresponding to the field `iana_number`. + type: keyword + network.type: + dashed_name: network-type + description: 'In the OSI Model this would be the Network Layer. ipv4, ipv6, + ipsec, pim, etc + + The field value must be normalized to lowercase for querying. See the documentation + section "Implementing ECS".' + example: ipv4 + flat_name: network.type + ignore_above: 1024 + level: core + name: type + normalize: [] + short: In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, + pim, etc + type: keyword + network.vlan.id: + dashed_name: network-vlan-id + description: VLAN ID as reported by the observer. + example: 10 + flat_name: network.vlan.id + ignore_above: 1024 + level: extended + name: id + normalize: [] + original_fieldset: vlan + short: VLAN ID as reported by the observer. + type: keyword + network.vlan.name: + dashed_name: network-vlan-name + description: Optional VLAN name as reported by the observer. + example: outside + flat_name: network.vlan.name + ignore_above: 1024 + level: extended + name: name + normalize: [] + original_fieldset: vlan + short: Optional VLAN name as reported by the observer. + type: keyword + group: 2 + name: network + nestings: + - network.inner.vlan + - network.vlan + prefix: network. + reused_here: + - full: network.vlan + schema_name: vlan + short: Fields to describe observed VLAN information. + - full: network.inner.vlan + schema_name: vlan + short: Fields to describe observed VLAN information. + short: Fields describing the communication path over which the event happened. + title: Network + type: group +related: + description: 'This field set is meant to facilitate pivoting around a piece of data. + + Some pieces of information can be seen in many places in an ECS event. To facilitate + searching for them, store an array of all seen values to their corresponding field + in `related.`. + + A concrete example is IP addresses, which can be under host, observer, source, + destination, client, server, and network.forwarded_ip. If you append all IPs to + `related.ip`, you can then search for a given IP trivially, no matter where it + appeared, by querying `related.ip:192.0.2.15`.' + fields: + related.ip: + dashed_name: related-ip + description: All of the IPs seen on your event. + flat_name: related.ip + level: extended + name: ip + normalize: + - array + short: All of the IPs seen on your event. + type: ip + related.user: + dashed_name: related-user + description: All the user names seen on your event. + flat_name: related.user + ignore_above: 1024 + level: extended + name: user + normalize: + - array + short: All the user names seen on your event. + type: keyword + group: 2 + name: related + prefix: related. + short: Fields meant to facilitate pivoting around a piece of data. + title: Related + type: group +server: + description: 'A Server is defined as the responder in a network connection for events + regarding sessions, connections, or bidirectional flow records. + + For TCP events, the server is the receiver of the initial SYN packet(s) of the + TCP connection. For other protocols, the server is generally the responder in + the network transaction. Some systems actually use the term "responder" to refer + the server in TCP connections. The server fields describe details about the system + acting as the server in the network event. Server fields are usually populated + in conjunction with client fields. Server fields are generally not populated for + packet-level events. + + Client / server representations can add semantic context to an exchange, which + is helpful to visualize the data in certain situations. If your context falls + in that category, you should still ensure that source and destination are filled + appropriately.' + fields: + server.address: + dashed_name: server-address + description: 'Some event server addresses are defined ambiguously. The event + will sometimes list an IP, a domain or a unix socket. You should always store + the raw address in the `.address` field. + + Then it should be duplicated to `.ip` or `.domain`, depending on which one + it is.' + flat_name: server.address + ignore_above: 1024 + level: extended + name: address + normalize: [] + short: Server network address. + type: keyword + server.as.number: + dashed_name: server-as-number + description: Unique number allocated to the autonomous system. The autonomous + system number (ASN) uniquely identifies each network on the Internet. + example: 15169 + flat_name: server.as.number + level: extended + name: number + normalize: [] + original_fieldset: as + short: Unique number allocated to the autonomous system. + type: long + server.as.organization.name: + dashed_name: server-as-organization-name + description: Organization name. + example: Google LLC + flat_name: server.as.organization.name + ignore_above: 1024 + level: extended + multi_fields: + - flat_name: server.as.organization.name.text + name: text + norms: false + type: text + name: organization.name + normalize: [] + original_fieldset: as + short: Organization name. + type: keyword + server.bytes: + dashed_name: server-bytes + description: Bytes sent from the server to the client. + example: 184 + flat_name: server.bytes + format: bytes + level: core + name: bytes + normalize: [] + short: Bytes sent from the server to the client. + type: long + server.domain: + dashed_name: server-domain + description: Server domain. + flat_name: server.domain + ignore_above: 1024 + level: core + name: domain + normalize: [] + short: Server domain. + type: keyword + server.geo.city_name: + dashed_name: server-geo-city-name + description: City name. + example: Montreal + flat_name: server.geo.city_name + ignore_above: 1024 + level: core + name: city_name + normalize: [] + original_fieldset: geo + short: City name. + type: keyword + server.geo.continent_name: + dashed_name: server-geo-continent-name + description: Name of the continent. + example: North America + flat_name: server.geo.continent_name + ignore_above: 1024 + level: core + name: continent_name + normalize: [] + original_fieldset: geo + short: Name of the continent. + type: keyword + server.geo.country_iso_code: + dashed_name: server-geo-country-iso-code + description: Country ISO code. + example: CA + flat_name: server.geo.country_iso_code + ignore_above: 1024 + level: core + name: country_iso_code + normalize: [] + original_fieldset: geo + short: Country ISO code. + type: keyword + server.geo.country_name: + dashed_name: server-geo-country-name + description: Country name. + example: Canada + flat_name: server.geo.country_name + ignore_above: 1024 + level: core + name: country_name + normalize: [] + original_fieldset: geo + short: Country name. + type: keyword + server.geo.location: + dashed_name: server-geo-location + description: Longitude and latitude. + example: '{ "lon": -73.614830, "lat": 45.505918 }' + flat_name: server.geo.location + level: core + name: location + normalize: [] + original_fieldset: geo + short: Longitude and latitude. + type: geo_point + server.geo.name: + dashed_name: server-geo-name + description: 'User-defined description of a location, at the level of granularity + they care about. + + Could be the name of their data centers, the floor number, if this describes + a local physical entity, city names. + + Not typically used in automated geolocation.' + example: boston-dc + flat_name: server.geo.name + ignore_above: 1024 + level: extended + name: name + normalize: [] + original_fieldset: geo + short: User-defined description of a location. + type: keyword + server.geo.region_iso_code: + dashed_name: server-geo-region-iso-code + description: Region ISO code. + example: CA-QC + flat_name: server.geo.region_iso_code + ignore_above: 1024 + level: core + name: region_iso_code + normalize: [] + original_fieldset: geo + short: Region ISO code. + type: keyword + server.geo.region_name: + dashed_name: server-geo-region-name + description: Region name. + example: Quebec + flat_name: server.geo.region_name + ignore_above: 1024 + level: core + name: region_name + normalize: [] + original_fieldset: geo + short: Region name. + type: keyword + server.ip: + dashed_name: server-ip + description: IP address of the server (IPv4 or IPv6). + flat_name: server.ip + level: core + name: ip + normalize: [] + short: IP address of the server. + type: ip + server.mac: + dashed_name: server-mac + description: MAC address of the server. + flat_name: server.mac + ignore_above: 1024 + level: core + name: mac + normalize: [] + short: MAC address of the server. + type: keyword + server.nat.ip: + dashed_name: server-nat-ip + description: 'Translated ip of destination based NAT sessions (e.g. internet + to private DMZ) + + Typically used with load balancers, firewalls, or routers.' + flat_name: server.nat.ip + level: extended + name: nat.ip + normalize: [] + short: Server NAT ip + type: ip + server.nat.port: + dashed_name: server-nat-port + description: 'Translated port of destination based NAT sessions (e.g. internet + to private DMZ) + + Typically used with load balancers, firewalls, or routers.' + flat_name: server.nat.port + format: string + level: extended + name: nat.port + normalize: [] + short: Server NAT port + type: long + server.packets: + dashed_name: server-packets + description: Packets sent from the server to the client. + example: 12 + flat_name: server.packets + level: core + name: packets + normalize: [] + short: Packets sent from the server to the client. + type: long + server.port: + dashed_name: server-port + description: Port of the server. + flat_name: server.port + format: string + level: core + name: port + normalize: [] + short: Port of the server. + type: long + server.registered_domain: + dashed_name: server-registered-domain + description: 'The highest registered server domain, stripped of the subdomain. + + For example, the registered domain for "foo.example.com" is "example.com". + + This value can be determined precisely with a list like the public suffix + list (http://publicsuffix.org). Trying to approximate this by simply taking + the last two labels will not work well for TLDs such as "co.uk".' + example: example.com + flat_name: server.registered_domain + ignore_above: 1024 + level: extended + name: registered_domain + normalize: [] + short: The highest registered server domain, stripped of the subdomain. + type: keyword + server.top_level_domain: + dashed_name: server-top-level-domain + description: 'The effective top level domain (eTLD), also known as the domain + suffix, is the last part of the domain name. For example, the top level domain + for example.com is "com". + + This value can be determined precisely with a list like the public suffix + list (http://publicsuffix.org). Trying to approximate this by simply taking + the last label will not work well for effective TLDs such as "co.uk".' + example: co.uk + flat_name: server.top_level_domain + ignore_above: 1024 + level: extended + name: top_level_domain + normalize: [] + short: The effective top level domain (com, org, net, co.uk). + type: keyword + server.user.domain: + dashed_name: server-user-domain + description: 'Name of the directory the user is a member of. + + For example, an LDAP or Active Directory domain name.' + flat_name: server.user.domain + ignore_above: 1024 + level: extended + name: domain + normalize: [] + original_fieldset: user + short: Name of the directory the user is a member of. + type: keyword + server.user.email: + dashed_name: server-user-email + description: User email address. + flat_name: server.user.email + ignore_above: 1024 + level: extended + name: email + normalize: [] + original_fieldset: user + short: User email address. + type: keyword + server.user.full_name: + dashed_name: server-user-full-name + description: User's full name, if available. + example: Albert Einstein + flat_name: server.user.full_name + ignore_above: 1024 + level: extended + multi_fields: + - flat_name: server.user.full_name.text + name: text + norms: false + type: text + name: full_name + normalize: [] + original_fieldset: user + short: User's full name, if available. + type: keyword + server.user.group.domain: + dashed_name: server-user-group-domain + description: 'Name of the directory the group is a member of. + + For example, an LDAP or Active Directory domain name.' + flat_name: server.user.group.domain + ignore_above: 1024 + level: extended + name: domain + normalize: [] + original_fieldset: group + short: Name of the directory the group is a member of. + type: keyword + server.user.group.id: + dashed_name: server-user-group-id + description: Unique identifier for the group on the system/platform. + flat_name: server.user.group.id + ignore_above: 1024 + level: extended + name: id + normalize: [] + original_fieldset: group + short: Unique identifier for the group on the system/platform. + type: keyword + server.user.group.name: + dashed_name: server-user-group-name + description: Name of the group. + flat_name: server.user.group.name + ignore_above: 1024 + level: extended + name: name + normalize: [] + original_fieldset: group + short: Name of the group. + type: keyword + server.user.hash: + dashed_name: server-user-hash + description: 'Unique user hash to correlate information for a user in anonymized + form. + + Useful if `user.id` or `user.name` contain confidential information and cannot + be used.' + flat_name: server.user.hash + ignore_above: 1024 + level: extended + name: hash + normalize: [] + original_fieldset: user + short: Unique user hash to correlate information for a user in anonymized form. + type: keyword + server.user.id: + dashed_name: server-user-id + description: Unique identifier of the user. + flat_name: server.user.id + ignore_above: 1024 + level: core + name: id + normalize: [] + original_fieldset: user + short: Unique identifier of the user. + type: keyword + server.user.name: + dashed_name: server-user-name + description: Short name or login of the user. + example: albert + flat_name: server.user.name + ignore_above: 1024 + level: core + multi_fields: + - flat_name: server.user.name.text + name: text + norms: false + type: text + name: name + normalize: [] + original_fieldset: user + short: Short name or login of the user. + type: keyword + server.user.roles: + dashed_name: server-user-roles + description: Array of user roles at the time of the event. + example: '["kibana_admin", "reporting_user"]' + flat_name: server.user.roles + ignore_above: 1024 + level: extended + name: roles + normalize: + - array + original_fieldset: user + short: Array of user roles at the time of the event. + type: keyword + group: 2 + name: server + nestings: + - server.as + - server.geo + - server.user + prefix: server. + reused_here: + - full: server.as + schema_name: as + short: Fields describing an Autonomous System (Internet routing prefix). + - full: server.geo + schema_name: geo + short: Fields describing a location. + - full: server.user + schema_name: user + short: Fields to describe the user relevant to the event. + short: Fields about the server side of a network connection, used with client. + title: Server + type: group +source: + description: 'Source fields describe details about the source of a packet/event. + + Source fields are usually populated in conjunction with destination fields.' + fields: + source.address: + dashed_name: source-address + description: 'Some event source addresses are defined ambiguously. The event + will sometimes list an IP, a domain or a unix socket. You should always store + the raw address in the `.address` field. + + Then it should be duplicated to `.ip` or `.domain`, depending on which one + it is.' + flat_name: source.address + ignore_above: 1024 + level: extended + name: address + normalize: [] + short: Source network address. + type: keyword + source.as.number: + dashed_name: source-as-number + description: Unique number allocated to the autonomous system. The autonomous + system number (ASN) uniquely identifies each network on the Internet. + example: 15169 + flat_name: source.as.number + level: extended + name: number + normalize: [] + original_fieldset: as + short: Unique number allocated to the autonomous system. + type: long + source.as.organization.name: + dashed_name: source-as-organization-name + description: Organization name. + example: Google LLC + flat_name: source.as.organization.name + ignore_above: 1024 + level: extended + multi_fields: + - flat_name: source.as.organization.name.text + name: text + norms: false + type: text + name: organization.name + normalize: [] + original_fieldset: as + short: Organization name. + type: keyword + source.bytes: + dashed_name: source-bytes + description: Bytes sent from the source to the destination. + example: 184 + flat_name: source.bytes + format: bytes + level: core + name: bytes + normalize: [] + short: Bytes sent from the source to the destination. + type: long + source.domain: + dashed_name: source-domain + description: Source domain. + flat_name: source.domain + ignore_above: 1024 + level: core + name: domain + normalize: [] + short: Source domain. + type: keyword + source.geo.city_name: + dashed_name: source-geo-city-name + description: City name. + example: Montreal + flat_name: source.geo.city_name + ignore_above: 1024 + level: core + name: city_name + normalize: [] + original_fieldset: geo + short: City name. + type: keyword + source.geo.continent_name: + dashed_name: source-geo-continent-name + description: Name of the continent. + example: North America + flat_name: source.geo.continent_name + ignore_above: 1024 + level: core + name: continent_name + normalize: [] + original_fieldset: geo + short: Name of the continent. + type: keyword + source.geo.country_iso_code: + dashed_name: source-geo-country-iso-code + description: Country ISO code. + example: CA + flat_name: source.geo.country_iso_code + ignore_above: 1024 + level: core + name: country_iso_code + normalize: [] + original_fieldset: geo + short: Country ISO code. + type: keyword + source.geo.country_name: + dashed_name: source-geo-country-name + description: Country name. + example: Canada + flat_name: source.geo.country_name + ignore_above: 1024 + level: core + name: country_name + normalize: [] + original_fieldset: geo + short: Country name. + type: keyword + source.geo.location: + dashed_name: source-geo-location + description: Longitude and latitude. + example: '{ "lon": -73.614830, "lat": 45.505918 }' + flat_name: source.geo.location + level: core + name: location + normalize: [] + original_fieldset: geo + short: Longitude and latitude. + type: geo_point + source.geo.name: + dashed_name: source-geo-name + description: 'User-defined description of a location, at the level of granularity + they care about. + + Could be the name of their data centers, the floor number, if this describes + a local physical entity, city names. + + Not typically used in automated geolocation.' + example: boston-dc + flat_name: source.geo.name + ignore_above: 1024 + level: extended + name: name + normalize: [] + original_fieldset: geo + short: User-defined description of a location. + type: keyword + source.geo.region_iso_code: + dashed_name: source-geo-region-iso-code + description: Region ISO code. + example: CA-QC + flat_name: source.geo.region_iso_code + ignore_above: 1024 + level: core + name: region_iso_code + normalize: [] + original_fieldset: geo + short: Region ISO code. + type: keyword + source.geo.region_name: + dashed_name: source-geo-region-name + description: Region name. + example: Quebec + flat_name: source.geo.region_name + ignore_above: 1024 + level: core + name: region_name + normalize: [] + original_fieldset: geo + short: Region name. + type: keyword + source.ip: + dashed_name: source-ip + description: IP address of the source (IPv4 or IPv6). + flat_name: source.ip + level: core + name: ip + normalize: [] + short: IP address of the source. + type: ip + source.mac: + dashed_name: source-mac + description: MAC address of the source. + flat_name: source.mac + ignore_above: 1024 + level: core + name: mac + normalize: [] + short: MAC address of the source. + type: keyword + source.nat.ip: + dashed_name: source-nat-ip + description: 'Translated ip of source based NAT sessions (e.g. internal client + to internet) + + Typically connections traversing load balancers, firewalls, or routers.' + flat_name: source.nat.ip + level: extended + name: nat.ip + normalize: [] + short: Source NAT ip + type: ip + source.nat.port: + dashed_name: source-nat-port + description: 'Translated port of source based NAT sessions. (e.g. internal client + to internet) + + Typically used with load balancers, firewalls, or routers.' + flat_name: source.nat.port + format: string + level: extended + name: nat.port + normalize: [] + short: Source NAT port + type: long + source.packets: + dashed_name: source-packets + description: Packets sent from the source to the destination. + example: 12 + flat_name: source.packets + level: core + name: packets + normalize: [] + short: Packets sent from the source to the destination. + type: long + source.port: + dashed_name: source-port + description: Port of the source. + flat_name: source.port + format: string + level: core + name: port + normalize: [] + short: Port of the source. + type: long + source.registered_domain: + dashed_name: source-registered-domain + description: 'The highest registered source domain, stripped of the subdomain. + + For example, the registered domain for "foo.example.com" is "example.com". + + This value can be determined precisely with a list like the public suffix + list (http://publicsuffix.org). Trying to approximate this by simply taking + the last two labels will not work well for TLDs such as "co.uk".' + example: example.com + flat_name: source.registered_domain + ignore_above: 1024 + level: extended + name: registered_domain + normalize: [] + short: The highest registered source domain, stripped of the subdomain. + type: keyword + source.top_level_domain: + dashed_name: source-top-level-domain + description: 'The effective top level domain (eTLD), also known as the domain + suffix, is the last part of the domain name. For example, the top level domain + for example.com is "com". + + This value can be determined precisely with a list like the public suffix + list (http://publicsuffix.org). Trying to approximate this by simply taking + the last label will not work well for effective TLDs such as "co.uk".' + example: co.uk + flat_name: source.top_level_domain + ignore_above: 1024 + level: extended + name: top_level_domain + normalize: [] + short: The effective top level domain (com, org, net, co.uk). + type: keyword + source.user.domain: + dashed_name: source-user-domain + description: 'Name of the directory the user is a member of. + + For example, an LDAP or Active Directory domain name.' + flat_name: source.user.domain + ignore_above: 1024 + level: extended + name: domain + normalize: [] + original_fieldset: user + short: Name of the directory the user is a member of. + type: keyword + source.user.email: + dashed_name: source-user-email + description: User email address. + flat_name: source.user.email + ignore_above: 1024 + level: extended + name: email + normalize: [] + original_fieldset: user + short: User email address. + type: keyword + source.user.full_name: + dashed_name: source-user-full-name + description: User's full name, if available. + example: Albert Einstein + flat_name: source.user.full_name + ignore_above: 1024 + level: extended + multi_fields: + - flat_name: source.user.full_name.text + name: text + norms: false + type: text + name: full_name + normalize: [] + original_fieldset: user + short: User's full name, if available. + type: keyword + source.user.group.domain: + dashed_name: source-user-group-domain + description: 'Name of the directory the group is a member of. + + For example, an LDAP or Active Directory domain name.' + flat_name: source.user.group.domain + ignore_above: 1024 + level: extended + name: domain + normalize: [] + original_fieldset: group + short: Name of the directory the group is a member of. + type: keyword + source.user.group.id: + dashed_name: source-user-group-id + description: Unique identifier for the group on the system/platform. + flat_name: source.user.group.id + ignore_above: 1024 + level: extended + name: id + normalize: [] + original_fieldset: group + short: Unique identifier for the group on the system/platform. + type: keyword + source.user.group.name: + dashed_name: source-user-group-name + description: Name of the group. + flat_name: source.user.group.name + ignore_above: 1024 + level: extended + name: name + normalize: [] + original_fieldset: group + short: Name of the group. + type: keyword + source.user.hash: + dashed_name: source-user-hash + description: 'Unique user hash to correlate information for a user in anonymized + form. + + Useful if `user.id` or `user.name` contain confidential information and cannot + be used.' + flat_name: source.user.hash + ignore_above: 1024 + level: extended + name: hash + normalize: [] + original_fieldset: user + short: Unique user hash to correlate information for a user in anonymized form. + type: keyword + source.user.id: + dashed_name: source-user-id + description: Unique identifier of the user. + flat_name: source.user.id + ignore_above: 1024 + level: core + name: id + normalize: [] + original_fieldset: user + short: Unique identifier of the user. + type: keyword + source.user.name: + dashed_name: source-user-name + description: Short name or login of the user. + example: albert + flat_name: source.user.name + ignore_above: 1024 + level: core + multi_fields: + - flat_name: source.user.name.text + name: text + norms: false + type: text + name: name + normalize: [] + original_fieldset: user + short: Short name or login of the user. + type: keyword + source.user.roles: + dashed_name: source-user-roles + description: Array of user roles at the time of the event. + example: '["kibana_admin", "reporting_user"]' + flat_name: source.user.roles + ignore_above: 1024 + level: extended + name: roles + normalize: + - array + original_fieldset: user + short: Array of user roles at the time of the event. + type: keyword + group: 2 + name: source + nestings: + - source.as + - source.geo + - source.user + prefix: source. + reused_here: + - full: source.as + schema_name: as + short: Fields describing an Autonomous System (Internet routing prefix). + - full: source.geo + schema_name: geo + short: Fields describing a location. + - full: source.user + schema_name: user + short: Fields to describe the user relevant to the event. + short: Fields about the source side of a network connection, used with destination. + title: Source + type: group +url: + description: URL fields provide support for complete or partial URLs, and supports + the breaking down into scheme, domain, path, and so on. + fields: + url.domain: + dashed_name: url-domain + description: 'Domain of the url, such as "www.elastic.co". + + In some cases a URL may refer to an IP and/or port directly, without a domain + name. In this case, the IP address would go to the `domain` field.' + example: www.elastic.co + flat_name: url.domain + ignore_above: 1024 + level: extended + name: domain + normalize: [] + short: Domain of the url. + type: keyword + url.extension: + dashed_name: url-extension + description: 'The field contains the file extension from the original request + url. + + The file extension is only set if it exists, as not every url has a file extension. + + The leading period must not be included. For example, the value must be "png", + not ".png".' + example: png + flat_name: url.extension + ignore_above: 1024 + level: extended + name: extension + normalize: [] + short: File extension from the original request url. + type: keyword + url.fragment: + dashed_name: url-fragment + description: 'Portion of the url after the `#`, such as "top". + + The `#` is not part of the fragment.' + flat_name: url.fragment + ignore_above: 1024 + level: extended + name: fragment + normalize: [] + short: Portion of the url after the `#`. + type: keyword + url.full: + dashed_name: url-full + description: If full URLs are important to your use case, they should be stored + in `url.full`, whether this field is reconstructed or present in the event + source. + example: https://www.elastic.co:443/search?q=elasticsearch#top + flat_name: url.full + ignore_above: 1024 + level: extended + multi_fields: + - flat_name: url.full.text + name: text + norms: false + type: text + name: full + normalize: [] + short: Full unparsed URL. + type: keyword + url.original: + dashed_name: url-original + description: 'Unmodified original url as seen in the event source. + + Note that in network monitoring, the observed URL may be a full URL, whereas + in access logs, the URL is often just represented as a path. + + This field is meant to represent the URL as it was observed, complete or not.' + example: https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch + flat_name: url.original + ignore_above: 1024 + level: extended + multi_fields: + - flat_name: url.original.text + name: text + norms: false + type: text + name: original + normalize: [] + short: Unmodified original url as seen in the event source. + type: keyword + url.password: + dashed_name: url-password + description: Password of the request. + flat_name: url.password + ignore_above: 1024 + level: extended + name: password + normalize: [] + short: Password of the request. + type: keyword + url.path: + dashed_name: url-path + description: Path of the request, such as "/search". + flat_name: url.path + ignore_above: 1024 + level: extended + name: path + normalize: [] + short: Path of the request, such as "/search". + type: keyword + url.port: + dashed_name: url-port + description: Port of the request, such as 443. + example: 443 + flat_name: url.port + format: string + level: extended + name: port + normalize: [] + short: Port of the request, such as 443. + type: long + url.query: + dashed_name: url-query + description: 'The query field describes the query string of the request, such + as "q=elasticsearch". + + The `?` is excluded from the query string. If a URL contains no `?`, there + is no query field. If there is a `?` but no query, the query field exists + with an empty string. The `exists` query can be used to differentiate between + the two cases.' + flat_name: url.query + ignore_above: 1024 + level: extended + name: query + normalize: [] + short: Query string of the request. + type: keyword + url.registered_domain: + dashed_name: url-registered-domain + description: 'The highest registered url domain, stripped of the subdomain. + + For example, the registered domain for "foo.example.com" is "example.com". + + This value can be determined precisely with a list like the public suffix + list (http://publicsuffix.org). Trying to approximate this by simply taking + the last two labels will not work well for TLDs such as "co.uk".' + example: example.com + flat_name: url.registered_domain + ignore_above: 1024 + level: extended + name: registered_domain + normalize: [] + short: The highest registered url domain, stripped of the subdomain. + type: keyword + url.scheme: + dashed_name: url-scheme + description: 'Scheme of the request, such as "https". + + Note: The `:` is not part of the scheme.' + example: https + flat_name: url.scheme + ignore_above: 1024 + level: extended + name: scheme + normalize: [] + short: Scheme of the url. + type: keyword + url.top_level_domain: + dashed_name: url-top-level-domain + description: 'The effective top level domain (eTLD), also known as the domain + suffix, is the last part of the domain name. For example, the top level domain + for example.com is "com". + + This value can be determined precisely with a list like the public suffix + list (http://publicsuffix.org). Trying to approximate this by simply taking + the last label will not work well for effective TLDs such as "co.uk".' + example: co.uk + flat_name: url.top_level_domain + ignore_above: 1024 + level: extended + name: top_level_domain + normalize: [] + short: The effective top level domain (com, org, net, co.uk). + type: keyword + url.username: + dashed_name: url-username + description: Username of the request. + flat_name: url.username + ignore_above: 1024 + level: extended + name: username + normalize: [] + short: Username of the request. + type: keyword + group: 2 + name: url + prefix: url. + short: Fields that let you store URLs in various forms. + title: URL + type: group +user: + description: 'The user fields describe information about the user that is relevant + to the event. + + Fields can have one entry or multiple entries. If a user has more than one id, + provide an array that includes all of them.' + fields: + user.name: + dashed_name: user-name + description: Short name or login of the user. + example: albert + flat_name: user.name + ignore_above: 1024 + level: core + multi_fields: + - flat_name: user.name.text + name: text + norms: false + type: text + name: name + normalize: [] + short: Short name or login of the user. + type: keyword + group: 2 + name: user + nestings: + - user.group + prefix: user. + reusable: + expected: + - as: user + at: client + full: client.user + - as: user + at: destination + full: destination.user + - as: user + at: host + full: host.user + - as: user + at: server + full: server.user + - as: user + at: source + full: source.user + top_level: true + reused_here: + - full: user.group + schema_name: group + short: User's group relevant to the event. + short: Fields to describe the user relevant to the event. + title: User + type: group +user_agent: + description: 'The user_agent fields normally come from a browser request. + + They often show up in web service logs coming from the parsed user agent string.' + fields: + user_agent.device.name: + dashed_name: user-agent-device-name + description: Name of the device. + example: iPhone + flat_name: user_agent.device.name + ignore_above: 1024 + level: extended + name: device.name + normalize: [] + short: Name of the device. + type: keyword + user_agent.name: + dashed_name: user-agent-name + description: Name of the user agent. + example: Safari + flat_name: user_agent.name + ignore_above: 1024 + level: extended + name: name + normalize: [] + short: Name of the user agent. + type: keyword + user_agent.original: + dashed_name: user-agent-original + description: Unparsed user_agent string. + example: Mozilla/5.0 (iPhone; CPU iPhone OS 12_1 like Mac OS X) AppleWebKit/605.1.15 + (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1 + flat_name: user_agent.original + ignore_above: 1024 + level: extended + multi_fields: + - flat_name: user_agent.original.text + name: text + norms: false + type: text + name: original + normalize: [] + short: Unparsed user_agent string. + type: keyword + user_agent.os.family: + dashed_name: user-agent-os-family + description: OS family (such as redhat, debian, freebsd, windows). + example: debian + flat_name: user_agent.os.family + ignore_above: 1024 + level: extended + name: family + normalize: [] + original_fieldset: os + short: OS family (such as redhat, debian, freebsd, windows). + type: keyword + user_agent.os.full: + dashed_name: user-agent-os-full + description: Operating system name, including the version or code name. + example: Mac OS Mojave + flat_name: user_agent.os.full + ignore_above: 1024 + level: extended + multi_fields: + - flat_name: user_agent.os.full.text + name: text + norms: false + type: text + name: full + normalize: [] + original_fieldset: os + short: Operating system name, including the version or code name. + type: keyword + user_agent.os.kernel: + dashed_name: user-agent-os-kernel + description: Operating system kernel version as a raw string. + example: 4.4.0-112-generic + flat_name: user_agent.os.kernel + ignore_above: 1024 + level: extended + name: kernel + normalize: [] + original_fieldset: os + short: Operating system kernel version as a raw string. + type: keyword + user_agent.os.name: + dashed_name: user-agent-os-name + description: Operating system name, without the version. + example: Mac OS X + flat_name: user_agent.os.name + ignore_above: 1024 + level: extended + multi_fields: + - flat_name: user_agent.os.name.text + name: text + norms: false + type: text + name: name + normalize: [] + original_fieldset: os + short: Operating system name, without the version. + type: keyword + user_agent.os.platform: + dashed_name: user-agent-os-platform + description: Operating system platform (such centos, ubuntu, windows). + example: darwin + flat_name: user_agent.os.platform + ignore_above: 1024 + level: extended + name: platform + normalize: [] + original_fieldset: os + short: Operating system platform (such centos, ubuntu, windows). + type: keyword + user_agent.os.version: + dashed_name: user-agent-os-version + description: Operating system version as a raw string. + example: 10.14.1 + flat_name: user_agent.os.version + ignore_above: 1024 + level: extended + name: version + normalize: [] + original_fieldset: os + short: Operating system version as a raw string. + type: keyword + user_agent.version: + dashed_name: user-agent-version + description: Version of the user agent. + example: 12.0 + flat_name: user_agent.version + ignore_above: 1024 + level: extended + name: version + normalize: [] + short: Version of the user agent. + type: keyword + group: 2 + name: user_agent + nestings: + - user_agent.os + prefix: user_agent. + reused_here: + - full: user_agent.os + schema_name: os + short: OS fields contain information about the operating system. + short: Fields to describe a browser user_agent string. + title: User agent + type: group diff --git a/usage-example/generated/elasticsearch/6/template.json b/usage-example/generated/elasticsearch/6/template.json new file mode 100644 index 0000000000..2f598e8f9b --- /dev/null +++ b/usage-example/generated/elasticsearch/6/template.json @@ -0,0 +1,1158 @@ +{ + "index_patterns": [ + "acme-weblogs-*" + ], + "mappings": { + "_doc": { + "_meta": { + "version": "1.6.0" + }, + "date_detection": false, + "dynamic_templates": [ + { + "strings_as_keyword": { + "mapping": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "match_mapping_type": "string" + } + } + ], + "properties": { + "@timestamp": { + "type": "date" + }, + "acme": { + "properties": { + "account": { + "properties": { + "id": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + }, + "agent": { + "properties": { + "build": { + "properties": { + "original": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "ephemeral_id": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + }, + "type": { + "ignore_above": 1024, + "type": "keyword" + }, + "version": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "client": { + "properties": { + "address": { + "ignore_above": 1024, + "type": "keyword" + }, + "as": { + "properties": { + "number": { + "type": "long" + }, + "organization": { + "properties": { + "name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + }, + "bytes": { + "type": "long" + }, + "domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "geo": { + "properties": { + "city_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "continent_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "country_iso_code": { + "ignore_above": 1024, + "type": "keyword" + }, + "country_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "location": { + "type": "geo_point" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + }, + "region_iso_code": { + "ignore_above": 1024, + "type": "keyword" + }, + "region_name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "ip": { + "type": "ip" + }, + "mac": { + "ignore_above": 1024, + "type": "keyword" + }, + "nat": { + "properties": { + "ip": { + "type": "ip" + }, + "port": { + "type": "long" + } + } + }, + "packets": { + "type": "long" + }, + "port": { + "type": "long" + }, + "registered_domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "top_level_domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "user": { + "properties": { + "domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "email": { + "ignore_above": 1024, + "type": "keyword" + }, + "full_name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "group": { + "properties": { + "domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "hash": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "roles": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + }, + "destination": { + "properties": { + "address": { + "ignore_above": 1024, + "type": "keyword" + }, + "as": { + "properties": { + "number": { + "type": "long" + }, + "organization": { + "properties": { + "name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + }, + "bytes": { + "type": "long" + }, + "domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "geo": { + "properties": { + "city_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "continent_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "country_iso_code": { + "ignore_above": 1024, + "type": "keyword" + }, + "country_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "location": { + "type": "geo_point" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + }, + "region_iso_code": { + "ignore_above": 1024, + "type": "keyword" + }, + "region_name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "ip": { + "type": "ip" + }, + "mac": { + "ignore_above": 1024, + "type": "keyword" + }, + "nat": { + "properties": { + "ip": { + "type": "ip" + }, + "port": { + "type": "long" + } + } + }, + "packets": { + "type": "long" + }, + "port": { + "type": "long" + }, + "registered_domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "top_level_domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "user": { + "properties": { + "domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "email": { + "ignore_above": 1024, + "type": "keyword" + }, + "full_name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "group": { + "properties": { + "domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "hash": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "roles": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + }, + "ecs": { + "properties": { + "version": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "event": { + "properties": { + "action": { + "ignore_above": 1024, + "type": "keyword" + }, + "category": { + "ignore_above": 1024, + "type": "keyword" + }, + "code": { + "ignore_above": 1024, + "type": "keyword" + }, + "created": { + "type": "date" + }, + "dataset": { + "ignore_above": 1024, + "type": "keyword" + }, + "duration": { + "type": "long" + }, + "end": { + "type": "date" + }, + "hash": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "ingested": { + "type": "date" + }, + "kind": { + "ignore_above": 1024, + "type": "keyword" + }, + "module": { + "ignore_above": 1024, + "type": "keyword" + }, + "original": { + "doc_values": false, + "ignore_above": 1024, + "index": false, + "type": "keyword" + }, + "outcome": { + "ignore_above": 1024, + "type": "keyword" + }, + "provider": { + "ignore_above": 1024, + "type": "keyword" + }, + "reason": { + "ignore_above": 1024, + "type": "keyword" + }, + "reference": { + "ignore_above": 1024, + "type": "keyword" + }, + "risk_score": { + "type": "float" + }, + "risk_score_norm": { + "type": "float" + }, + "sequence": { + "type": "long" + }, + "severity": { + "type": "long" + }, + "start": { + "type": "date" + }, + "timezone": { + "ignore_above": 1024, + "type": "keyword" + }, + "type": { + "ignore_above": 1024, + "type": "keyword" + }, + "url": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "http": { + "properties": { + "request": { + "properties": { + "body": { + "properties": { + "bytes": { + "type": "long" + }, + "content": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "bytes": { + "type": "long" + }, + "method": { + "ignore_above": 1024, + "type": "keyword" + }, + "referrer": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "response": { + "properties": { + "body": { + "properties": { + "bytes": { + "type": "long" + }, + "content": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "bytes": { + "type": "long" + }, + "status_code": { + "type": "long" + } + } + }, + "version": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "labels": { + "type": "object" + }, + "message": { + "norms": false, + "type": "text" + }, + "network": { + "properties": { + "application": { + "ignore_above": 1024, + "type": "keyword" + }, + "bytes": { + "type": "long" + }, + "community_id": { + "ignore_above": 1024, + "type": "keyword" + }, + "direction": { + "ignore_above": 1024, + "type": "keyword" + }, + "forwarded_ip": { + "type": "ip" + }, + "iana_number": { + "ignore_above": 1024, + "type": "keyword" + }, + "inner": { + "properties": { + "vlan": { + "properties": { + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + }, + "type": "object" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + }, + "packets": { + "type": "long" + }, + "protocol": { + "ignore_above": 1024, + "type": "keyword" + }, + "transport": { + "ignore_above": 1024, + "type": "keyword" + }, + "type": { + "ignore_above": 1024, + "type": "keyword" + }, + "vlan": { + "properties": { + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + }, + "related": { + "properties": { + "ip": { + "type": "ip" + }, + "user": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "server": { + "properties": { + "address": { + "ignore_above": 1024, + "type": "keyword" + }, + "as": { + "properties": { + "number": { + "type": "long" + }, + "organization": { + "properties": { + "name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + }, + "bytes": { + "type": "long" + }, + "domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "geo": { + "properties": { + "city_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "continent_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "country_iso_code": { + "ignore_above": 1024, + "type": "keyword" + }, + "country_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "location": { + "type": "geo_point" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + }, + "region_iso_code": { + "ignore_above": 1024, + "type": "keyword" + }, + "region_name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "ip": { + "type": "ip" + }, + "mac": { + "ignore_above": 1024, + "type": "keyword" + }, + "nat": { + "properties": { + "ip": { + "type": "ip" + }, + "port": { + "type": "long" + } + } + }, + "packets": { + "type": "long" + }, + "port": { + "type": "long" + }, + "registered_domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "top_level_domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "user": { + "properties": { + "domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "email": { + "ignore_above": 1024, + "type": "keyword" + }, + "full_name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "group": { + "properties": { + "domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "hash": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "roles": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + }, + "source": { + "properties": { + "address": { + "ignore_above": 1024, + "type": "keyword" + }, + "as": { + "properties": { + "number": { + "type": "long" + }, + "organization": { + "properties": { + "name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + }, + "bytes": { + "type": "long" + }, + "domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "geo": { + "properties": { + "city_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "continent_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "country_iso_code": { + "ignore_above": 1024, + "type": "keyword" + }, + "country_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "location": { + "type": "geo_point" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + }, + "region_iso_code": { + "ignore_above": 1024, + "type": "keyword" + }, + "region_name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "ip": { + "type": "ip" + }, + "mac": { + "ignore_above": 1024, + "type": "keyword" + }, + "nat": { + "properties": { + "ip": { + "type": "ip" + }, + "port": { + "type": "long" + } + } + }, + "packets": { + "type": "long" + }, + "port": { + "type": "long" + }, + "registered_domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "top_level_domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "user": { + "properties": { + "domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "email": { + "ignore_above": 1024, + "type": "keyword" + }, + "full_name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "group": { + "properties": { + "domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "hash": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "roles": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + }, + "tags": { + "ignore_above": 1024, + "type": "keyword" + }, + "url": { + "properties": { + "domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "extension": { + "ignore_above": 1024, + "type": "keyword" + }, + "fragment": { + "ignore_above": 1024, + "type": "keyword" + }, + "full": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "original": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "password": { + "ignore_above": 1024, + "type": "keyword" + }, + "path": { + "ignore_above": 1024, + "type": "keyword" + }, + "port": { + "type": "long" + }, + "query": { + "ignore_above": 1024, + "type": "keyword" + }, + "registered_domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "scheme": { + "ignore_above": 1024, + "type": "keyword" + }, + "top_level_domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "username": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "user": { + "properties": { + "name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "user_agent": { + "properties": { + "device": { + "properties": { + "name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + }, + "original": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "os": { + "properties": { + "family": { + "ignore_above": 1024, + "type": "keyword" + }, + "full": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "kernel": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "platform": { + "ignore_above": 1024, + "type": "keyword" + }, + "version": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "version": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + }, + "order": 1, + "settings": { + "index": { + "codec": "best_compression", + "mapping": { + "total_fields": { + "limit": 1000 + } + }, + "refresh_interval": "2s" + } + } +} \ No newline at end of file diff --git a/usage-example/generated/elasticsearch/7/template.json b/usage-example/generated/elasticsearch/7/template.json new file mode 100644 index 0000000000..c632cfda07 --- /dev/null +++ b/usage-example/generated/elasticsearch/7/template.json @@ -0,0 +1,1156 @@ +{ + "index_patterns": [ + "acme-weblogs-*" + ], + "mappings": { + "_meta": { + "version": "1.6.0" + }, + "date_detection": false, + "dynamic_templates": [ + { + "strings_as_keyword": { + "mapping": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "match_mapping_type": "string" + } + } + ], + "properties": { + "@timestamp": { + "type": "date" + }, + "acme": { + "properties": { + "account": { + "properties": { + "id": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + }, + "agent": { + "properties": { + "build": { + "properties": { + "original": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "ephemeral_id": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + }, + "type": { + "ignore_above": 1024, + "type": "keyword" + }, + "version": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "client": { + "properties": { + "address": { + "ignore_above": 1024, + "type": "keyword" + }, + "as": { + "properties": { + "number": { + "type": "long" + }, + "organization": { + "properties": { + "name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + }, + "bytes": { + "type": "long" + }, + "domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "geo": { + "properties": { + "city_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "continent_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "country_iso_code": { + "ignore_above": 1024, + "type": "keyword" + }, + "country_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "location": { + "type": "geo_point" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + }, + "region_iso_code": { + "ignore_above": 1024, + "type": "keyword" + }, + "region_name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "ip": { + "type": "ip" + }, + "mac": { + "ignore_above": 1024, + "type": "keyword" + }, + "nat": { + "properties": { + "ip": { + "type": "ip" + }, + "port": { + "type": "long" + } + } + }, + "packets": { + "type": "long" + }, + "port": { + "type": "long" + }, + "registered_domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "top_level_domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "user": { + "properties": { + "domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "email": { + "ignore_above": 1024, + "type": "keyword" + }, + "full_name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "group": { + "properties": { + "domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "hash": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "roles": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + }, + "destination": { + "properties": { + "address": { + "ignore_above": 1024, + "type": "keyword" + }, + "as": { + "properties": { + "number": { + "type": "long" + }, + "organization": { + "properties": { + "name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + }, + "bytes": { + "type": "long" + }, + "domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "geo": { + "properties": { + "city_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "continent_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "country_iso_code": { + "ignore_above": 1024, + "type": "keyword" + }, + "country_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "location": { + "type": "geo_point" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + }, + "region_iso_code": { + "ignore_above": 1024, + "type": "keyword" + }, + "region_name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "ip": { + "type": "ip" + }, + "mac": { + "ignore_above": 1024, + "type": "keyword" + }, + "nat": { + "properties": { + "ip": { + "type": "ip" + }, + "port": { + "type": "long" + } + } + }, + "packets": { + "type": "long" + }, + "port": { + "type": "long" + }, + "registered_domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "top_level_domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "user": { + "properties": { + "domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "email": { + "ignore_above": 1024, + "type": "keyword" + }, + "full_name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "group": { + "properties": { + "domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "hash": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "roles": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + }, + "ecs": { + "properties": { + "version": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "event": { + "properties": { + "action": { + "ignore_above": 1024, + "type": "keyword" + }, + "category": { + "ignore_above": 1024, + "type": "keyword" + }, + "code": { + "ignore_above": 1024, + "type": "keyword" + }, + "created": { + "type": "date" + }, + "dataset": { + "ignore_above": 1024, + "type": "keyword" + }, + "duration": { + "type": "long" + }, + "end": { + "type": "date" + }, + "hash": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "ingested": { + "type": "date" + }, + "kind": { + "ignore_above": 1024, + "type": "keyword" + }, + "module": { + "ignore_above": 1024, + "type": "keyword" + }, + "original": { + "doc_values": false, + "ignore_above": 1024, + "index": false, + "type": "keyword" + }, + "outcome": { + "ignore_above": 1024, + "type": "keyword" + }, + "provider": { + "ignore_above": 1024, + "type": "keyword" + }, + "reason": { + "ignore_above": 1024, + "type": "keyword" + }, + "reference": { + "ignore_above": 1024, + "type": "keyword" + }, + "risk_score": { + "type": "float" + }, + "risk_score_norm": { + "type": "float" + }, + "sequence": { + "type": "long" + }, + "severity": { + "type": "long" + }, + "start": { + "type": "date" + }, + "timezone": { + "ignore_above": 1024, + "type": "keyword" + }, + "type": { + "ignore_above": 1024, + "type": "keyword" + }, + "url": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "http": { + "properties": { + "request": { + "properties": { + "body": { + "properties": { + "bytes": { + "type": "long" + }, + "content": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "bytes": { + "type": "long" + }, + "method": { + "ignore_above": 1024, + "type": "keyword" + }, + "referrer": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "response": { + "properties": { + "body": { + "properties": { + "bytes": { + "type": "long" + }, + "content": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "bytes": { + "type": "long" + }, + "status_code": { + "type": "long" + } + } + }, + "version": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "labels": { + "type": "object" + }, + "message": { + "norms": false, + "type": "text" + }, + "network": { + "properties": { + "application": { + "ignore_above": 1024, + "type": "keyword" + }, + "bytes": { + "type": "long" + }, + "community_id": { + "ignore_above": 1024, + "type": "keyword" + }, + "direction": { + "ignore_above": 1024, + "type": "keyword" + }, + "forwarded_ip": { + "type": "ip" + }, + "iana_number": { + "ignore_above": 1024, + "type": "keyword" + }, + "inner": { + "properties": { + "vlan": { + "properties": { + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + }, + "type": "object" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + }, + "packets": { + "type": "long" + }, + "protocol": { + "ignore_above": 1024, + "type": "keyword" + }, + "transport": { + "ignore_above": 1024, + "type": "keyword" + }, + "type": { + "ignore_above": 1024, + "type": "keyword" + }, + "vlan": { + "properties": { + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + }, + "related": { + "properties": { + "ip": { + "type": "ip" + }, + "user": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "server": { + "properties": { + "address": { + "ignore_above": 1024, + "type": "keyword" + }, + "as": { + "properties": { + "number": { + "type": "long" + }, + "organization": { + "properties": { + "name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + }, + "bytes": { + "type": "long" + }, + "domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "geo": { + "properties": { + "city_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "continent_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "country_iso_code": { + "ignore_above": 1024, + "type": "keyword" + }, + "country_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "location": { + "type": "geo_point" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + }, + "region_iso_code": { + "ignore_above": 1024, + "type": "keyword" + }, + "region_name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "ip": { + "type": "ip" + }, + "mac": { + "ignore_above": 1024, + "type": "keyword" + }, + "nat": { + "properties": { + "ip": { + "type": "ip" + }, + "port": { + "type": "long" + } + } + }, + "packets": { + "type": "long" + }, + "port": { + "type": "long" + }, + "registered_domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "top_level_domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "user": { + "properties": { + "domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "email": { + "ignore_above": 1024, + "type": "keyword" + }, + "full_name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "group": { + "properties": { + "domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "hash": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "roles": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + }, + "source": { + "properties": { + "address": { + "ignore_above": 1024, + "type": "keyword" + }, + "as": { + "properties": { + "number": { + "type": "long" + }, + "organization": { + "properties": { + "name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + }, + "bytes": { + "type": "long" + }, + "domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "geo": { + "properties": { + "city_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "continent_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "country_iso_code": { + "ignore_above": 1024, + "type": "keyword" + }, + "country_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "location": { + "type": "geo_point" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + }, + "region_iso_code": { + "ignore_above": 1024, + "type": "keyword" + }, + "region_name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "ip": { + "type": "ip" + }, + "mac": { + "ignore_above": 1024, + "type": "keyword" + }, + "nat": { + "properties": { + "ip": { + "type": "ip" + }, + "port": { + "type": "long" + } + } + }, + "packets": { + "type": "long" + }, + "port": { + "type": "long" + }, + "registered_domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "top_level_domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "user": { + "properties": { + "domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "email": { + "ignore_above": 1024, + "type": "keyword" + }, + "full_name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "group": { + "properties": { + "domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "hash": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "roles": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + }, + "tags": { + "ignore_above": 1024, + "type": "keyword" + }, + "url": { + "properties": { + "domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "extension": { + "ignore_above": 1024, + "type": "keyword" + }, + "fragment": { + "ignore_above": 1024, + "type": "keyword" + }, + "full": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "original": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "password": { + "ignore_above": 1024, + "type": "keyword" + }, + "path": { + "ignore_above": 1024, + "type": "keyword" + }, + "port": { + "type": "long" + }, + "query": { + "ignore_above": 1024, + "type": "keyword" + }, + "registered_domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "scheme": { + "ignore_above": 1024, + "type": "keyword" + }, + "top_level_domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "username": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "user": { + "properties": { + "name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "user_agent": { + "properties": { + "device": { + "properties": { + "name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + }, + "original": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "os": { + "properties": { + "family": { + "ignore_above": 1024, + "type": "keyword" + }, + "full": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "kernel": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "platform": { + "ignore_above": 1024, + "type": "keyword" + }, + "version": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "version": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + }, + "order": 1, + "settings": { + "index": { + "codec": "best_compression", + "mapping": { + "total_fields": { + "limit": 1000 + } + }, + "refresh_interval": "2s" + } + } +} \ No newline at end of file