Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 15 additions & 14 deletions internal/docs/exported_fields.go
Original file line number Diff line number Diff line change
Expand Up @@ -125,21 +125,22 @@ func visitFields(namePrefix string, f fields.FieldDefinition, records []fieldsTa
}
name += f.Name

if len(f.Fields) == 0 && f.Type != "group" {
if f.External != "" {
imported, err := fdm.ImportField(f.External, name)
if err != nil {
return nil, errors.Wrap(err, "can't import field")
}

// Override imported fields with the definition, except for the type and external.
var updated fields.FieldDefinition
updated.Update(imported)
updated.Update(f)
updated.Type = imported.Type
updated.External = ""
f = updated
if f.External != "" {
imported, err := fdm.ImportField(f.External, name)
if err != nil {
return nil, errors.Wrap(err, "can't import field")
}

// Override imported fields with the definition, except for the type and external.
var updated fields.FieldDefinition
updated.Update(imported)
updated.Update(f)
updated.Type = imported.Type
updated.External = ""
f = updated
}

if len(f.Fields) == 0 && f.Type != "group" {
records = append(records, fieldsTableRecord{
name: name,
description: f.Description,
Expand Down
13 changes: 9 additions & 4 deletions test/packages/parallel/gcp/docs/compute.md
Original file line number Diff line number Diff line change
Expand Up @@ -98,17 +98,18 @@ An example event for `compute` looks as following:
| Field | Description | Type |
|---|---|---|
| @timestamp | Event timestamp. | date |
| cloud | Fields related to the cloud or infrastructure the events are coming from. | group |
| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword |
| cloud.account.name | The cloud account name or alias used to identify different entities in a multi-tenant environment. Examples: AWS account name, Google Cloud ORG display name. | keyword |
| cloud.availability_zone | Availability zone in which this host is running. | keyword |
| cloud.image.id | Image ID for the cloud instance. | keyword |
| cloud.instance.id | Instance ID of the host machine. | keyword |
| cloud.instance.name | Instance name of the host machine. | keyword |
| cloud.machine.type | Machine type of the host machine. | keyword |
| cloud.project.id | Name of the project in Google Cloud. | keyword |
| cloud.project.id | The cloud project identifier. Examples: Google Cloud Project id, Azure Project id. | keyword |
| cloud.project.name | The cloud project name. Examples: Google Cloud Project name, Azure Project name. | keyword |
| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword |
| cloud.region | Region in which this host is running. | keyword |
| cloud.region | Region in which this host, resource, or service is located. | keyword |
| cloud.service.name | The cloud service name is intended to distinguish services running on different platforms within a provider, eg AWS EC2 vs Lambda, GCP GCE vs App Engine, Azure VM vs App Server. Examples: app engine, app service, cloud run, fargate, lambda. | keyword |
| container.id | Unique container id. | keyword |
| container.image.name | Name of the image the container was built on. | keyword |
| container.labels | Image labels. | object |
Expand All @@ -117,8 +118,12 @@ An example event for `compute` looks as following:
| data_stream.namespace | Data stream namespace. | constant_keyword |
| data_stream.type | Data stream type. | constant_keyword |
| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword |
| error | These fields can represent errors of any kind. Use them for errors that happen while fetching events or in cases where the event itself contains an error. | group |
| error.code | Error code describing the error. | keyword |
| error.id | Unique identifier for the error. | keyword |
| error.message | Error message. | match_only_text |
| error.stack_trace | The stack trace of this error in plain text. | wildcard |
| error.stack_trace.text | Multi-field of `error.stack_trace`. | match_only_text |
| error.type | The type of the error, for example the class name of the exception. | keyword |
| event.dataset | Event dataset | constant_keyword |
| event.module | Event module | constant_keyword |
| gcp.compute.firewall.dropped.bytes | Incoming bytes dropped by the firewall | long |
Expand Down