Add additional host fields

CHANGELOG.next.md

@@ -20,6 +20,7 @@ Thanks, you're awesome :-) -->
 * Added `http.request.id`. #1208
 * Added `cloud.service.name`. #1204
 * Added `hash.ssdeep`. #1169
+* Added additional host fields. #1248
 
 #### Improvements
 

docs/field-details.asciidoc

@@ -3134,6 +3134,62 @@ example: `x86_64`
 
 // ===============================================================
 
+|
+[[field-host-cpu-usage]]
+<<field-host-cpu-usage, host.cpu.usage>>
+
+| beta:[ This field is currently considered beta. ]
+
+Percent CPU used which is normalized by the number of CPU cores and it ranges from 0 to 1. Scaling factor: 1000.
+
+For example: For a two core host, this value should be the average of the two cores, between 0 and 1.
+
+type: scaled_float
+
+
+
+
+
+| extended
+
+// ===============================================================
+
+|
+[[field-host-disk-read-bytes]]
+<<field-host-disk-read-bytes, host.disk.read.bytes>>
+
+| beta:[ This field is currently considered beta. ]
+
+The total number of bytes (gauge) read successfully (aggregated from all disks) since the last metric collection.
+
+type: long
+
+
+
+
+
+| extended
+
+// ===============================================================
+
+|
+[[field-host-disk-write-bytes]]
+<<field-host-disk-write-bytes, host.disk.write.bytes>>
+
+| beta:[ This field is currently considered beta. ]
+
+The total number of bytes (gauge) written successfully (aggregated from all disks) since the last metric collection.
+
+type: long
+
+
+
+
+
+| extended
+
+// ===============================================================
+
 |
 [[field-host-domain]]
 <<field-host-domain, host.domain>>
@@ -3246,6 +3302,78 @@ type: keyword
 
 // ===============================================================
 
+|
+[[field-host-network-egress-bytes]]
+<<field-host-network-egress-bytes, host.network.egress.bytes>>
+
+| beta:[ This field is currently considered beta. ]
+
+The number of bytes (gauge) sent out on all network interfaces by the host since the last metric collection.
+
+type: long
+
+
+
+
+
+| extended
+
+// ===============================================================
+
+|
+[[field-host-network-egress-packets]]
+<<field-host-network-egress-packets, host.network.egress.packets>>
+
+| beta:[ This field is currently considered beta. ]
+
+The number of packets (gauge) sent out on all network interfaces by the host since the last metric collection.
+
+type: long
+
+
+
+
+
+| extended
+
+// ===============================================================
+
+|
+[[field-host-network-ingress-bytes]]
+<<field-host-network-ingress-bytes, host.network.ingress.bytes>>
+
+| beta:[ This field is currently considered beta. ]
+
+The number of bytes received (gauge) on all network interfaces by the host since the last metric collection.
+
+type: long
+
+
+
+
+
+| extended
+
+// ===============================================================
+
+|
+[[field-host-network-ingress-packets]]
+<<field-host-network-ingress-packets, host.network.ingress.packets>>
+
+| beta:[ This field is currently considered beta. ]
+
+The number of packets (gauge) received on all network interfaces by the host since the last metric collection.
+
+type: long
+
+
+
+
+
+| extended
+
+// ===============================================================
+
 |
 [[field-host-type]]
 <<field-host-type, host.type>>

experimental/generated/ecs/ecs_flat.yml

@@ -3267,6 +3267,7 @@ host.architecture:
   short: Operating system architecture.
   type: keyword
 host.cpu.usage:
+  beta: This field is currently considered beta.
   dashed_name: host-cpu-usage
   description: 'Percent CPU used which is normalized by the number of CPU cores and
     it ranges from 0 to 1. Scaling factor: 1000.
@@ -3281,6 +3282,7 @@ host.cpu.usage:
   short: Percent CPU used, between 0 and 1.
   type: scaled_float
 host.disk.read.bytes:
+  beta: This field is currently considered beta.
   dashed_name: host-disk-read-bytes
   description: The total number of bytes (gauge) read successfully (aggregated from
     all disks) since the last metric collection.
@@ -3291,6 +3293,7 @@ host.disk.read.bytes:
   short: The number of bytes read by all disks.
   type: long
 host.disk.write.bytes:
+  beta: This field is currently considered beta.
   dashed_name: host-disk-write-bytes
   description: The total number of bytes (gauge) written successfully (aggregated
     from all disks) since the last metric collection.
@@ -3474,6 +3477,7 @@ host.name:
   short: Name of the host.
   type: keyword
 host.network.egress.bytes:
+  beta: This field is currently considered beta.
   dashed_name: host-network-egress-bytes
   description: The number of bytes (gauge) sent out on all network interfaces by the
     host since the last metric collection.
@@ -3484,6 +3488,7 @@ host.network.egress.bytes:
   short: The number of bytes sent on all network interfaces.
   type: long
 host.network.egress.packets:
+  beta: This field is currently considered beta.
   dashed_name: host-network-egress-packets
   description: The number of packets (gauge) sent out on all network interfaces by
     the host since the last metric collection.
@@ -3494,6 +3499,7 @@ host.network.egress.packets:
   short: The number of packets sent on all network interfaces.
   type: long
 host.network.ingress.bytes:
+  beta: This field is currently considered beta.
   dashed_name: host-network-ingress-bytes
   description: The number of bytes received (gauge) on all network interfaces by the
     host since the last metric collection.
@@ -3504,6 +3510,7 @@ host.network.ingress.bytes:
   short: The number of bytes received on all network interfaces.
   type: long
 host.network.ingress.packets:
+  beta: This field is currently considered beta.
   dashed_name: host-network-ingress-packets
   description: The number of packets (gauge) received on all network interfaces by
     the host since the last metric collection.

experimental/generated/ecs/ecs_nested.yml

@@ -3966,6 +3966,7 @@ host:
       short: Operating system architecture.
       type: keyword
     host.cpu.usage:
+      beta: This field is currently considered beta.
       dashed_name: host-cpu-usage
       description: 'Percent CPU used which is normalized by the number of CPU cores
         and it ranges from 0 to 1. Scaling factor: 1000.
@@ -3980,6 +3981,7 @@ host:
       short: Percent CPU used, between 0 and 1.
       type: scaled_float
     host.disk.read.bytes:
+      beta: This field is currently considered beta.
       dashed_name: host-disk-read-bytes
       description: The total number of bytes (gauge) read successfully (aggregated
         from all disks) since the last metric collection.
@@ -3990,6 +3992,7 @@ host:
       short: The number of bytes read by all disks.
       type: long
     host.disk.write.bytes:
+      beta: This field is currently considered beta.
       dashed_name: host-disk-write-bytes
       description: The total number of bytes (gauge) written successfully (aggregated
         from all disks) since the last metric collection.
@@ -4175,6 +4178,7 @@ host:
       short: Name of the host.
       type: keyword
     host.network.egress.bytes:
+      beta: This field is currently considered beta.
       dashed_name: host-network-egress-bytes
       description: The number of bytes (gauge) sent out on all network interfaces
         by the host since the last metric collection.
@@ -4185,6 +4189,7 @@ host:
       short: The number of bytes sent on all network interfaces.
       type: long
     host.network.egress.packets:
+      beta: This field is currently considered beta.
       dashed_name: host-network-egress-packets
       description: The number of packets (gauge) sent out on all network interfaces
         by the host since the last metric collection.
@@ -4195,6 +4200,7 @@ host:
       short: The number of packets sent on all network interfaces.
       type: long
     host.network.ingress.bytes:
+      beta: This field is currently considered beta.
       dashed_name: host-network-ingress-bytes
       description: The number of bytes received (gauge) on all network interfaces
         by the host since the last metric collection.
@@ -4205,6 +4211,7 @@ host:
       short: The number of bytes received on all network interfaces.
       type: long
     host.network.ingress.packets:
+      beta: This field is currently considered beta.
       dashed_name: host-network-ingress-packets
       description: The number of packets (gauge) received on all network interfaces
         by the host since the last metric collection.

generated/beats/fields.ecs.yml

@@ -2111,6 +2111,28 @@
       ignore_above: 1024
       description: Operating system architecture.
       example: x86_64
+    - name: cpu.usage
+      level: extended
+      type: scaled_float
+      description: 'Percent CPU used which is normalized by the number of CPU cores
+        and it ranges from 0 to 1. Scaling factor: 1000.
+
+        For example: For a two core host, this value should be the average of the
+        two cores, between 0 and 1.'
+      scaling_factor: 1000
+      default_field: false
+    - name: disk.read.bytes
+      level: extended
+      type: long
+      description: The total number of bytes (gauge) read successfully (aggregated
+        from all disks) since the last metric collection.
+      default_field: false
+    - name: disk.write.bytes
+      level: extended
+      type: long
+      description: The total number of bytes (gauge) written successfully (aggregated
+        from all disks) since the last metric collection.
+      default_field: false
     - name: domain
       level: extended
       type: keyword
@@ -2209,6 +2231,30 @@
         It can contain what `hostname` returns on Unix systems, the fully qualified
         domain name, or a name specified by the user. The sender decides which value
         to use.'
+    - name: network.egress.bytes
+      level: extended
+      type: long
+      description: The number of bytes (gauge) sent out on all network interfaces
+        by the host since the last metric collection.
+      default_field: false
+    - name: network.egress.packets
+      level: extended
+      type: long
+      description: The number of packets (gauge) sent out on all network interfaces
+        by the host since the last metric collection.
+      default_field: false
+    - name: network.ingress.bytes
+      level: extended
+      type: long
+      description: The number of bytes received (gauge) on all network interfaces
+        by the host since the last metric collection.
+      default_field: false
+    - name: network.ingress.packets
+      level: extended
+      type: long
+      description: The number of packets (gauge) received on all network interfaces
+        by the host since the last metric collection.
+      default_field: false
     - name: os.family
       level: extended
       type: keyword

generated/csv/fields.csv

@@ -233,6 +233,9 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description
 2.0.0-dev,true,group,group.id,keyword,extended,,,Unique identifier for the group on the system/platform.
 2.0.0-dev,true,group,group.name,keyword,extended,,,Name of the group.
 2.0.0-dev,true,host,host.architecture,keyword,core,,x86_64,Operating system architecture.
+2.0.0-dev,true,host,host.cpu.usage,scaled_float,extended,,,"Percent CPU used, between 0 and 1."
+2.0.0-dev,true,host,host.disk.read.bytes,long,extended,,,The number of bytes read by all disks.
+2.0.0-dev,true,host,host.disk.write.bytes,long,extended,,,The number of bytes written on all disks.
 2.0.0-dev,true,host,host.domain,keyword,extended,,CONTOSO,Name of the directory the group is a member of.
 2.0.0-dev,true,host,host.geo.city_name,keyword,core,,Montreal,City name.
 2.0.0-dev,true,host,host.geo.continent_name,keyword,core,,North America,Name of the continent.
@@ -247,6 +250,10 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description
 2.0.0-dev,true,host,host.ip,ip,core,array,,Host ip addresses.
 2.0.0-dev,true,host,host.mac,keyword,core,array,,Host mac addresses.
 2.0.0-dev,true,host,host.name,keyword,core,,,Name of the host.
+2.0.0-dev,true,host,host.network.egress.bytes,long,extended,,,The number of bytes sent on all network interfaces.
+2.0.0-dev,true,host,host.network.egress.packets,long,extended,,,The number of packets sent on all network interfaces.
+2.0.0-dev,true,host,host.network.ingress.bytes,long,extended,,,The number of bytes received on all network interfaces.
+2.0.0-dev,true,host,host.network.ingress.packets,long,extended,,,The number of packets received on all network interfaces.
 2.0.0-dev,true,host,host.os.family,keyword,extended,,debian,"OS family (such as redhat, debian, freebsd, windows)."
 2.0.0-dev,true,host,host.os.full,keyword,extended,,Mac OS Mojave,"Operating system name, including the version or code name."
 2.0.0-dev,true,host,host.os.full.text,text,extended,,Mac OS Mojave,"Operating system name, including the version or code name."