diff --git a/CHANGELOG.next.md b/CHANGELOG.next.md index f3225ffdb3..b6f2024aa1 100644 --- a/CHANGELOG.next.md +++ b/CHANGELOG.next.md @@ -41,7 +41,6 @@ Thanks, you're awesome :-) --> #### Improvements * Event categorization fields GA. #1067 -* `wildcard` field type adoption. #1098 * Note `[` and `]` bracket characters may enclose a literal IPv6 address when populating `url.domain`. #1131 * Reinforce the exclusion of the leading dot from `url.extension`. #1151 diff --git a/docs/field-details.asciidoc b/docs/field-details.asciidoc index 73bc4467d3..76d50ac81c 100644 --- a/docs/field-details.asciidoc +++ b/docs/field-details.asciidoc @@ -115,13 +115,11 @@ Examples include Beats. Agents may also run on observers. ECS agent.* fields sha [[field-agent-build-original]] <> -| beta:[ Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. ] - -Extended build information for the agent. +| Extended build information for the agent. This field is intended to contain any build information that a data source may provide, no specific formatting is required. -type: wildcard +type: keyword @@ -257,11 +255,9 @@ example: `15169` [[field-as-organization-name]] <> -| beta:[ Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. ] +| Organization name. -Organization name. - -type: wildcard +type: keyword Multi-fields: @@ -345,11 +341,9 @@ example: `184` [[field-client-domain]] <> -| beta:[ Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. ] +| Client domain. -Client domain. - -type: wildcard +type: keyword @@ -463,15 +457,13 @@ type: long [[field-client-registered-domain]] <> -| beta:[ Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. ] - -The highest registered client domain, stripped of the subdomain. +| The highest registered client domain, stripped of the subdomain. For example, the registered domain for "foo.example.com" is "example.com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". -type: wildcard +type: keyword @@ -1023,11 +1015,9 @@ example: `184` [[field-destination-domain]] <> -| beta:[ Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. ] - -Destination domain. +| Destination domain. -type: wildcard +type: keyword @@ -1141,15 +1131,13 @@ type: long [[field-destination-registered-domain]] <> -| beta:[ Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. ] - -The highest registered destination domain, stripped of the subdomain. +| The highest registered destination domain, stripped of the subdomain. For example, the registered domain for "foo.example.com" is "example.com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". -type: wildcard +type: keyword @@ -1390,13 +1378,11 @@ example: `IN` [[field-dns-answers-data]] <> -| beta:[ Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. ] - -The data describing the resource. +| The data describing the resource. The meaning of this data depends on the type and class of the resource record. -type: wildcard +type: keyword @@ -1529,13 +1515,11 @@ example: `IN` [[field-dns-question-name]] <> -| beta:[ Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. ] - -The name being queried. +| The name being queried. If the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \t, \r, and \n respectively. -type: wildcard +type: keyword @@ -1778,11 +1762,9 @@ type: text [[field-error-stack-trace]] <> -| beta:[ Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. ] - -The stack trace of this error in plain text. +| The stack trace of this error in plain text. -type: wildcard +type: keyword Multi-fields: @@ -1802,11 +1784,9 @@ Multi-fields: [[field-error-type]] <> -| beta:[ Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. ] - -The type of the error, for example the class name of the exception. +| The type of the error, for example the class name of the exception. -type: wildcard +type: keyword @@ -2443,11 +2423,9 @@ example: `sda` [[field-file-directory]] <> -| beta:[ Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. ] +| Directory where the file is located. It should include the drive letter, when appropriate. -Directory where the file is located. It should include the drive letter, when appropriate. - -type: wildcard +type: keyword @@ -2625,11 +2603,9 @@ example: `alice` [[field-file-path]] <> -| beta:[ Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. ] - -Full path to the file, including the file name. It should include the drive letter, when appropriate. +| Full path to the file, including the file name. It should include the drive letter, when appropriate. -type: wildcard +type: keyword Multi-fields: @@ -2667,11 +2643,9 @@ example: `16384` [[field-file-target-path]] <> -| beta:[ Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. ] - -Target path for symlinks. +| Target path for symlinks. -type: wildcard +type: keyword Multi-fields: @@ -2864,15 +2838,13 @@ example: `{ "lon": -73.614830, "lat": 45.505918 }` [[field-geo-name]] <> -| beta:[ Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. ] - -User-defined description of a location, at the level of granularity they care about. +| User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation. -type: wildcard +type: keyword @@ -3148,13 +3120,11 @@ example: `CONTOSO` [[field-host-hostname]] <> -| beta:[ Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. ] - -Hostname of the host. +| Hostname of the host. It normally contains what the `hostname` command returns on the host machine. -type: wildcard +type: keyword @@ -3347,11 +3317,9 @@ example: `887` [[field-http-request-body-content]] <> -| beta:[ Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. ] +| The full HTTP request body. -The full HTTP request body. - -type: wildcard +type: keyword Multi-fields: @@ -3427,11 +3395,9 @@ example: `image/gif` [[field-http-request-referrer]] <> -| beta:[ Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. ] - -Referrer for this HTTP request. +| Referrer for this HTTP request. -type: wildcard +type: keyword @@ -3461,11 +3427,9 @@ example: `887` [[field-http-response-body-content]] <> -| beta:[ Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. ] - -The full HTTP response body. +| The full HTTP response body. -type: wildcard +type: keyword Multi-fields: @@ -3645,13 +3609,11 @@ The details specific to your event source are typically not logged under `log.*` [[field-log-file-path]] <> -| beta:[ Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. ] - -Full path to the log file this event came from, including the file name. It should include the drive letter, when appropriate. +| Full path to the log file this event came from, including the file name. It should include the drive letter, when appropriate. If the event wasn't read from a log file, do not populate this field. -type: wildcard +type: keyword @@ -3685,11 +3647,9 @@ example: `error` [[field-log-logger]] <> -| beta:[ Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. ] - -The name of the logger inside an application. This is usually the name of the class which initialized the logger, or can be a custom name. +| The name of the logger inside an application. This is usually the name of the class which initialized the logger, or can be a custom name. -type: wildcard +type: keyword @@ -4483,11 +4443,9 @@ type: keyword [[field-organization-name]] <> -| beta:[ Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. ] - -Organization name. +| Organization name. -type: wildcard +type: keyword Multi-fields: @@ -4539,11 +4497,9 @@ example: `debian` [[field-os-full]] <> -| beta:[ Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. ] - -Operating system name, including the version or code name. +| Operating system name, including the version or code name. -type: wildcard +type: keyword Multi-fields: @@ -4579,11 +4535,9 @@ example: `4.4.0-112-generic` [[field-os-name]] <> -| beta:[ Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. ] - -Operating system name, without the version. +| Operating system name, without the version. -type: wildcard +type: keyword Multi-fields: @@ -4993,11 +4947,9 @@ example: `0c6803c4e922103c4dca5963aad36ddf` [[field-pe-original-file-name]] <> -| beta:[ Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. ] +| Internal name of the file, provided at compile-time. -Internal name of the file, provided at compile-time. - -type: wildcard +type: keyword @@ -5094,13 +5046,11 @@ example: `4` [[field-process-command-line]] <> -| beta:[ Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. ] - -Full command line that started the process, including the absolute path to the executable, and all arguments. +| Full command line that started the process, including the absolute path to the executable, and all arguments. Some arguments may be filtered to protect sensitive information. -type: wildcard +type: keyword Multi-fields: @@ -5140,11 +5090,9 @@ example: `c2c455d9f99375d` [[field-process-executable]] <> -| beta:[ Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. ] - -Absolute path to the process executable. +| Absolute path to the process executable. -type: wildcard +type: keyword Multi-fields: @@ -5182,13 +5130,11 @@ example: `137` [[field-process-name]] <> -| beta:[ Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. ] - -Process name. +| Process name. Sometimes called program name or similar. -type: wildcard +type: keyword Multi-fields: @@ -5288,11 +5234,9 @@ example: `4242` [[field-process-thread-name]] <> -| beta:[ Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. ] +| Thread name. -Thread name. - -type: wildcard +type: keyword @@ -5306,13 +5250,11 @@ example: `thread-0` [[field-process-title]] <> -| beta:[ Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. ] - -Process title. +| Process title. The proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened. -type: wildcard +type: keyword Multi-fields: @@ -5348,11 +5290,9 @@ example: `1325` [[field-process-working-directory]] <> -| beta:[ Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. ] - -The working directory of the process. +| The working directory of the process. -type: wildcard +type: keyword Multi-fields: @@ -5453,13 +5393,11 @@ example: `ZQBuAC0AVQBTAAAAZQBuAAAAAAA=` [[field-registry-data-strings]] <> -| beta:[ Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. ] - -Content when writing string types. +| Content when writing string types. Populated as an array when writing string data to the registry. For single string registry types (REG_SZ, REG_EXPAND_SZ), this should be an array with one string. For sequences of string with REG_MULTI_SZ, this array will be variable length. For numeric data, such as REG_DWORD and REG_QWORD, this should be populated with the decimal representation (e.g `"1"`). -type: wildcard +type: keyword Note: this field should contain an array of values. @@ -5508,11 +5446,9 @@ example: `HKLM` [[field-registry-key]] <> -| beta:[ Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. ] +| Hive-relative path of keys. -Hive-relative path of keys. - -type: wildcard +type: keyword @@ -5526,11 +5462,9 @@ example: `SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Opti [[field-registry-path]] <> -| beta:[ Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. ] - -Full path, including hive, key and value +| Full path, including hive, key and value -type: wildcard +type: keyword @@ -5893,11 +5827,9 @@ example: `184` [[field-server-domain]] <> -| beta:[ Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. ] - -Server domain. +| Server domain. -type: wildcard +type: keyword @@ -6011,15 +5943,13 @@ type: long [[field-server-registered-domain]] <> -| beta:[ Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. ] - -The highest registered server domain, stripped of the subdomain. +| The highest registered server domain, stripped of the subdomain. For example, the registered domain for "foo.example.com" is "example.com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". -type: wildcard +type: keyword @@ -6308,11 +6238,9 @@ example: `184` [[field-source-domain]] <> -| beta:[ Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. ] - -Source domain. +| Source domain. -type: wildcard +type: keyword @@ -6426,15 +6354,13 @@ type: long [[field-source-registered-domain]] <> -| beta:[ Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. ] - -The highest registered source domain, stripped of the subdomain. +| The highest registered source domain, stripped of the subdomain. For example, the registered domain for "foo.example.com" is "example.com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". -type: wildcard +type: keyword @@ -6853,11 +6779,9 @@ example: `0687F666A054EF17A08E2F2162EAB4CBC0D265E1D7875BE74BF3C712CA92DAF0` [[field-tls-client-issuer]] <> -| beta:[ Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. ] - -Distinguished name of subject of the issuer of the x.509 certificate presented by the client. +| Distinguished name of subject of the issuer of the x.509 certificate presented by the client. -type: wildcard +type: keyword @@ -6935,11 +6859,9 @@ example: `www.elastic.co` [[field-tls-client-subject]] <> -| beta:[ Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. ] - -Distinguished name of subject of the x.509 certificate presented by the client. +| Distinguished name of subject of the x.509 certificate presented by the client. -type: wildcard +type: keyword @@ -7119,11 +7041,9 @@ example: `0687F666A054EF17A08E2F2162EAB4CBC0D265E1D7875BE74BF3C712CA92DAF0` [[field-tls-server-issuer]] <> -| beta:[ Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. ] +| Subject of the issuer of the x.509 certificate presented by the server. -Subject of the issuer of the x.509 certificate presented by the server. - -type: wildcard +type: keyword @@ -7185,11 +7105,9 @@ example: `1970-01-01T00:00:00.000Z` [[field-tls-server-subject]] <> -| beta:[ Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. ] +| Subject of the x.509 certificate presented by the server. -Subject of the x.509 certificate presented by the server. - -type: wildcard +type: keyword @@ -7354,15 +7272,13 @@ URL fields provide support for complete or partial URLs, and supports the breaki [[field-url-domain]] <> -| beta:[ Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. ] - -Domain of the url, such as "www.elastic.co". +| Domain of the url, such as "www.elastic.co". In some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `domain` field. If the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732), the `[` and `]` characters should also be captured in the `domain` field. -type: wildcard +type: keyword @@ -7416,11 +7332,9 @@ type: keyword [[field-url-full]] <> -| beta:[ Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. ] - -If full URLs are important to your use case, they should be stored in `url.full`, whether this field is reconstructed or present in the event source. +| If full URLs are important to your use case, they should be stored in `url.full`, whether this field is reconstructed or present in the event source. -type: wildcard +type: keyword Multi-fields: @@ -7440,15 +7354,13 @@ example: `https://www.elastic.co:443/search?q=elasticsearch#top` [[field-url-original]] <> -| beta:[ Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. ] - -Unmodified original url as seen in the event source. +| Unmodified original url as seen in the event source. Note that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path. This field is meant to represent the URL as it was observed, complete or not. -type: wildcard +type: keyword Multi-fields: @@ -7484,11 +7396,9 @@ type: keyword [[field-url-path]] <> -| beta:[ Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. ] +| Path of the request, such as "/search". -Path of the request, such as "/search". - -type: wildcard +type: keyword @@ -7536,15 +7446,13 @@ type: keyword [[field-url-registered-domain]] <> -| beta:[ Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. ] - -The highest registered url domain, stripped of the subdomain. +| The highest registered url domain, stripped of the subdomain. For example, the registered domain for "foo.example.com" is "example.com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". -type: wildcard +type: keyword @@ -7668,11 +7576,9 @@ type: keyword [[field-user-email]] <> -| beta:[ Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. ] - -User email address. +| User email address. -type: wildcard +type: keyword @@ -7686,11 +7592,9 @@ type: wildcard [[field-user-full-name]] <> -| beta:[ Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. ] - -User's full name, if available. +| User's full name, if available. -type: wildcard +type: keyword Multi-fields: @@ -7744,11 +7648,9 @@ type: keyword [[field-user-name]] <> -| beta:[ Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. ] - -Short name or login of the user. +| Short name or login of the user. -type: wildcard +type: keyword Multi-fields: @@ -7891,11 +7793,9 @@ example: `Safari` [[field-user-agent-original]] <> -| beta:[ Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. ] +| Unparsed user_agent string. -Unparsed user_agent string. - -type: wildcard +type: keyword Multi-fields: @@ -8340,11 +8240,9 @@ example: `US` [[field-x509-issuer-distinguished-name]] <> -| beta:[ Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. ] - -Distinguished name (DN) of issuing certificate authority. +| Distinguished name (DN) of issuing certificate authority. -type: wildcard +type: keyword @@ -8600,11 +8498,9 @@ example: `US` [[field-x509-subject-distinguished-name]] <> -| beta:[ Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. ] - -Distinguished name (DN) of the certificate subject entity. +| Distinguished name (DN) of the certificate subject entity. -type: wildcard +type: keyword diff --git a/experimental/generated/ecs/ecs_flat.yml b/experimental/generated/ecs/ecs_flat.yml index f98d8b95ce..a3555460b3 100644 --- a/experimental/generated/ecs/ecs_flat.yml +++ b/experimental/generated/ecs/ecs_flat.yml @@ -18,8 +18,6 @@ short: Date/time when the event originated. type: date agent.build.original: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: agent-build-original description: 'Extended build information for the agent. @@ -130,8 +128,6 @@ client.as.number: short: Unique number allocated to the autonomous system. type: long client.as.organization.name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: client-as-organization-name description: Organization name. example: Google LLC @@ -159,8 +155,6 @@ client.bytes: short: Bytes sent from the client to the server. type: long client.domain: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: client-domain description: Client domain. flat_name: client.domain @@ -229,8 +223,6 @@ client.geo.location: short: Longitude and latitude. type: geo_point client.geo.name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: client-geo-name description: 'User-defined description of a location, at the level of granularity they care about. @@ -336,8 +328,6 @@ client.port: short: Port of the client. type: long client.registered_domain: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: client-registered-domain description: 'The highest registered client domain, stripped of the subdomain. @@ -402,8 +392,6 @@ client.user.domain: short: Name of the directory the user is a member of. type: keyword client.user.email: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: client-user-email description: User email address. flat_name: client.user.email @@ -414,8 +402,6 @@ client.user.email: short: User email address. type: wildcard client.user.full_name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: client-user-full-name description: User's full name, if available. example: Albert Einstein @@ -493,8 +479,6 @@ client.user.id: short: Unique identifier of the user. type: keyword client.user.name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: client-user-name description: Short name or login of the user. example: albert @@ -733,8 +717,6 @@ destination.as.number: short: Unique number allocated to the autonomous system. type: long destination.as.organization.name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: destination-as-organization-name description: Organization name. example: Google LLC @@ -762,8 +744,6 @@ destination.bytes: short: Bytes sent from the destination to the source. type: long destination.domain: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: destination-domain description: Destination domain. flat_name: destination.domain @@ -832,8 +812,6 @@ destination.geo.location: short: Longitude and latitude. type: geo_point destination.geo.name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: destination-geo-name description: 'User-defined description of a location, at the level of granularity they care about. @@ -938,8 +916,6 @@ destination.port: short: Port of the destination. type: long destination.registered_domain: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: destination-registered-domain description: 'The highest registered destination domain, stripped of the subdomain. @@ -1004,8 +980,6 @@ destination.user.domain: short: Name of the directory the user is a member of. type: keyword destination.user.email: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: destination-user-email description: User email address. flat_name: destination.user.email @@ -1016,8 +990,6 @@ destination.user.email: short: User email address. type: wildcard destination.user.full_name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: destination-user-full-name description: User's full name, if available. example: Albert Einstein @@ -1095,8 +1067,6 @@ destination.user.id: short: Unique identifier of the user. type: keyword destination.user.name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: destination-user-name description: Short name or login of the user. example: albert @@ -1326,8 +1296,6 @@ dll.pe.imphash: short: A hash of the imports in a PE file. type: keyword dll.pe.original_file_name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: dll-pe-original-file-name description: Internal name of the file, provided at compile-time. example: MSPAINT.EXE @@ -1381,8 +1349,6 @@ dns.answers.class: short: The class of DNS data contained in this resource record. type: keyword dns.answers.data: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: dns-answers-data description: 'The data describing the resource. @@ -1483,8 +1449,6 @@ dns.question.class: short: The class of records being queried. type: keyword dns.question.name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: dns-question-name description: 'The name being queried. @@ -1651,8 +1615,6 @@ error.message: short: Error message. type: text error.stack_trace: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: error-stack-trace description: The stack trace of this error in plain text. flat_name: error.stack_trace @@ -1667,8 +1629,6 @@ error.stack_trace: short: The stack trace of this error in plain text. type: wildcard error.type: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: error-type description: The type of the error, for example the class name of the exception. example: java.lang.NullPointerException @@ -2555,8 +2515,6 @@ file.device: short: Device that is the source of the file. type: keyword file.directory: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: file-directory description: Directory where the file is located. It should include the drive letter, when appropriate. @@ -2728,8 +2686,6 @@ file.owner: short: File owner's username. type: keyword file.path: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: file-path description: Full path to the file, including the file name. It should include the drive letter, when appropriate. @@ -2810,8 +2766,6 @@ file.pe.imphash: short: A hash of the imports in a PE file. type: keyword file.pe.original_file_name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: file-pe-original-file-name description: Internal name of the file, provided at compile-time. example: MSPAINT.EXE @@ -2847,8 +2801,6 @@ file.size: short: File size in bytes. type: long file.target_path: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: file-target-path description: Target path for symlinks. flat_name: file.target_path @@ -2926,8 +2878,6 @@ file.x509.issuer.country: short: List of country (C) codes type: keyword file.x509.issuer.distinguished_name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: file-x509-issuer-distinguished-name description: Distinguished name (DN) of issuing certificate authority. example: C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance @@ -3117,8 +3067,6 @@ file.x509.subject.country: short: List of country (C) code type: keyword file.x509.subject.distinguished_name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: file-x509-subject-distinguished-name description: Distinguished name (DN) of the certificate subject entity. example: C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net @@ -3343,8 +3291,6 @@ host.geo.location: short: Longitude and latitude. type: geo_point host.geo.name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: host-geo-name description: 'User-defined description of a location, at the level of granularity they care about. @@ -3386,8 +3332,6 @@ host.geo.region_name: short: Region name. type: keyword host.hostname: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: host-hostname description: 'Hostname of the host. @@ -3499,8 +3443,6 @@ host.os.family: short: OS family (such as redhat, debian, freebsd, windows). type: keyword host.os.full: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: host-os-full description: Operating system name, including the version or code name. example: Mac OS Mojave @@ -3529,8 +3471,6 @@ host.os.kernel: short: Operating system kernel version as a raw string. type: keyword host.os.name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: host-os-name description: Operating system name, without the version. example: Mac OS X @@ -3626,8 +3566,6 @@ host.user.domain: short: Name of the directory the user is a member of. type: keyword host.user.email: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: host-user-email description: User email address. flat_name: host.user.email @@ -3638,8 +3576,6 @@ host.user.email: short: User email address. type: wildcard host.user.full_name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: host-user-full-name description: User's full name, if available. example: Albert Einstein @@ -3717,8 +3653,6 @@ host.user.id: short: Unique identifier of the user. type: keyword host.user.name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: host-user-name description: Short name or login of the user. example: albert @@ -3759,8 +3693,6 @@ http.request.body.bytes: short: Size in bytes of the request body. type: long http.request.body.content: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: http-request-body-content description: The full HTTP request body. example: Hello world @@ -3820,8 +3752,6 @@ http.request.mime_type: short: Mime type of the body of the request. type: keyword http.request.referrer: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: http-request-referrer description: Referrer for this HTTP request. example: https://blog.example.com/ @@ -3843,8 +3773,6 @@ http.response.body.bytes: short: Size in bytes of the response body. type: long http.response.body.content: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: http-response-body-content description: The full HTTP response body. example: Hello world @@ -3924,8 +3852,6 @@ labels: short: Custom key/value pairs. type: object log.file.path: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: log-file-path description: 'Full path to the log file this event came from, including the file name. It should include the drive letter, when appropriate. @@ -3956,8 +3882,6 @@ log.level: short: Log level of the log event. type: keyword log.logger: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: log-logger description: The name of the logger inside an application. This is usually the name of the class which initialized the logger, or can be a custom name. @@ -4488,8 +4412,6 @@ observer.geo.location: short: Longitude and latitude. type: geo_point observer.geo.name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: observer-geo-name description: 'User-defined description of a location, at the level of granularity they care about. @@ -4676,8 +4598,6 @@ observer.os.family: short: OS family (such as redhat, debian, freebsd, windows). type: keyword observer.os.full: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: observer-os-full description: Operating system name, including the version or code name. example: Mac OS Mojave @@ -4706,8 +4626,6 @@ observer.os.kernel: short: Operating system kernel version as a raw string. type: keyword observer.os.name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: observer-os-name description: Operating system name, without the version. example: Mac OS X @@ -4833,8 +4751,6 @@ organization.id: short: Unique identifier for the organization. type: keyword organization.name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: organization-name description: Organization name. flat_name: organization.name @@ -5095,8 +5011,6 @@ process.code_signature.valid: content. type: boolean process.command_line: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: process-command-line description: 'Full command line that started the process, including the absolute path to the executable, and all arguments. @@ -5134,8 +5048,6 @@ process.entity_id: short: Unique identifier for the process. type: keyword process.executable: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: process-executable description: Absolute path to the process executable. example: /usr/bin/ssh @@ -5208,8 +5120,6 @@ process.hash.sha512: short: SHA512 hash. type: keyword process.name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: process-name description: 'Process name. @@ -5326,8 +5236,6 @@ process.parent.code_signature.valid: content. type: boolean process.parent.command_line: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: process-parent-command-line description: 'Full command line that started the process, including the absolute path to the executable, and all arguments. @@ -5367,8 +5275,6 @@ process.parent.entity_id: short: Unique identifier for the process. type: keyword process.parent.executable: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: process-parent-executable description: Absolute path to the process executable. example: /usr/bin/ssh @@ -5443,8 +5349,6 @@ process.parent.hash.sha512: short: SHA512 hash. type: keyword process.parent.name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: process-parent-name description: 'Process name. @@ -5527,8 +5431,6 @@ process.parent.pe.imphash: short: A hash of the imports in a PE file. type: keyword process.parent.pe.original_file_name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: process-parent-pe-original-file-name description: Internal name of the file, provided at compile-time. example: MSPAINT.EXE @@ -5610,8 +5512,6 @@ process.parent.thread.id: short: Thread ID. type: long process.parent.thread.name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: process-parent-thread-name description: Thread name. example: thread-0 @@ -5623,8 +5523,6 @@ process.parent.thread.name: short: Thread name. type: wildcard process.parent.title: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: process-parent-title description: 'Process title. @@ -5654,8 +5552,6 @@ process.parent.uptime: short: Seconds the process has been up. type: long process.parent.working_directory: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: process-parent-working-directory description: The working directory of the process. example: /home/alice @@ -5736,8 +5632,6 @@ process.pe.imphash: short: A hash of the imports in a PE file. type: keyword process.pe.original_file_name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: process-pe-original-file-name description: Internal name of the file, provided at compile-time. example: MSPAINT.EXE @@ -5814,8 +5708,6 @@ process.thread.id: short: Thread ID. type: long process.thread.name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: process-thread-name description: Thread name. example: thread-0 @@ -5826,8 +5718,6 @@ process.thread.name: short: Thread name. type: wildcard process.title: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: process-title description: 'Process title. @@ -5855,8 +5745,6 @@ process.uptime: short: Seconds the process has been up. type: long process.working_directory: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: process-working-directory description: The working directory of the process. example: /home/alice @@ -5887,8 +5775,6 @@ registry.data.bytes: short: Original bytes written with base64 encoding. type: keyword registry.data.strings: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: registry-data-strings description: 'Content when writing string types. @@ -5928,8 +5814,6 @@ registry.hive: short: Abbreviated name for the hive. type: keyword registry.key: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: registry-key description: Hive-relative path of keys. example: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe @@ -5940,8 +5824,6 @@ registry.key: short: Hive-relative path of keys. type: wildcard registry.path: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: registry-path description: Full path, including hive, key and value example: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution @@ -6159,8 +6041,6 @@ server.as.number: short: Unique number allocated to the autonomous system. type: long server.as.organization.name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: server-as-organization-name description: Organization name. example: Google LLC @@ -6188,8 +6068,6 @@ server.bytes: short: Bytes sent from the server to the client. type: long server.domain: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: server-domain description: Server domain. flat_name: server.domain @@ -6258,8 +6136,6 @@ server.geo.location: short: Longitude and latitude. type: geo_point server.geo.name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: server-geo-name description: 'User-defined description of a location, at the level of granularity they care about. @@ -6365,8 +6241,6 @@ server.port: short: Port of the server. type: long server.registered_domain: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: server-registered-domain description: 'The highest registered server domain, stripped of the subdomain. @@ -6431,8 +6305,6 @@ server.user.domain: short: Name of the directory the user is a member of. type: keyword server.user.email: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: server-user-email description: User email address. flat_name: server.user.email @@ -6443,8 +6315,6 @@ server.user.email: short: User email address. type: wildcard server.user.full_name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: server-user-full-name description: User's full name, if available. example: Albert Einstein @@ -6522,8 +6392,6 @@ server.user.id: short: Unique identifier of the user. type: keyword server.user.name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: server-user-name description: Short name or login of the user. example: albert @@ -6692,8 +6560,6 @@ source.as.number: short: Unique number allocated to the autonomous system. type: long source.as.organization.name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: source-as-organization-name description: Organization name. example: Google LLC @@ -6721,8 +6587,6 @@ source.bytes: short: Bytes sent from the source to the destination. type: long source.domain: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: source-domain description: Source domain. flat_name: source.domain @@ -6791,8 +6655,6 @@ source.geo.location: short: Longitude and latitude. type: geo_point source.geo.name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: source-geo-name description: 'User-defined description of a location, at the level of granularity they care about. @@ -6898,8 +6760,6 @@ source.port: short: Port of the source. type: long source.registered_domain: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: source-registered-domain description: 'The highest registered source domain, stripped of the subdomain. @@ -6964,8 +6824,6 @@ source.user.domain: short: Name of the directory the user is a member of. type: keyword source.user.email: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: source-user-email description: User email address. flat_name: source.user.email @@ -6976,8 +6834,6 @@ source.user.email: short: User email address. type: wildcard source.user.full_name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: source-user-full-name description: User's full name, if available. example: Albert Einstein @@ -7055,8 +6911,6 @@ source.user.id: short: Unique identifier of the user. type: keyword source.user.name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: source-user-name description: Short name or login of the user. example: albert @@ -7335,8 +7189,6 @@ tls.client.hash.sha256: certificate offered by the client. type: keyword tls.client.issuer: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: tls-client-issuer description: Distinguished name of subject of the issuer of the x.509 certificate presented by the client. @@ -7395,8 +7247,6 @@ tls.client.server_name: short: Hostname the client is trying to connect to. Also called the SNI. type: keyword tls.client.subject: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: tls-client-subject description: Distinguished name of subject of the x.509 certificate presented by the client. @@ -7462,8 +7312,6 @@ tls.client.x509.issuer.country: short: List of country (C) codes type: keyword tls.client.x509.issuer.distinguished_name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: tls-client-x509-issuer-distinguished-name description: Distinguished name (DN) of issuing certificate authority. example: C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance @@ -7653,8 +7501,6 @@ tls.client.x509.subject.country: short: List of country (C) code type: keyword tls.client.x509.subject.distinguished_name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: tls-client-x509-subject-distinguished-name description: Distinguished name (DN) of the certificate subject entity. example: C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net @@ -7845,8 +7691,6 @@ tls.server.hash.sha256: certificate offered by the server. type: keyword tls.server.issuer: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: tls-server-issuer description: Subject of the issuer of the x.509 certificate presented by the server. example: CN=Example Root CA, OU=Infrastructure Team, DC=example, DC=com @@ -7890,8 +7734,6 @@ tls.server.not_before: short: Timestamp indicating when server certificate is first considered valid. type: date tls.server.subject: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: tls-server-subject description: Subject of the x.509 certificate presented by the server. example: CN=www.example.com, OU=Infrastructure Team, DC=example, DC=com @@ -7943,8 +7785,6 @@ tls.server.x509.issuer.country: short: List of country (C) codes type: keyword tls.server.x509.issuer.distinguished_name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: tls-server-x509-issuer-distinguished-name description: Distinguished name (DN) of issuing certificate authority. example: C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance @@ -8134,8 +7974,6 @@ tls.server.x509.subject.country: short: List of country (C) code type: keyword tls.server.x509.subject.distinguished_name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: tls-server-x509-subject-distinguished-name description: Distinguished name (DN) of the certificate subject entity. example: C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net @@ -8260,8 +8098,6 @@ transaction.id: short: Unique identifier of the transaction within the scope of its trace. type: keyword url.domain: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: url-domain description: 'Domain of the url, such as "www.elastic.co". @@ -8310,8 +8146,6 @@ url.fragment: short: Portion of the url after the `#`. type: keyword url.full: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: url-full description: If full URLs are important to your use case, they should be stored in `url.full`, whether this field is reconstructed or present in the event source. @@ -8328,8 +8162,6 @@ url.full: short: Full unparsed URL. type: wildcard url.original: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: url-original description: 'Unmodified original url as seen in the event source. @@ -8360,8 +8192,6 @@ url.password: short: Password of the request. type: keyword url.path: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: url-path description: Path of the request, such as "/search". flat_name: url.path @@ -8398,8 +8228,6 @@ url.query: short: Query string of the request. type: keyword url.registered_domain: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: url-registered-domain description: 'The highest registered url domain, stripped of the subdomain. @@ -8487,8 +8315,6 @@ user.changes.domain: short: Name of the directory the user is a member of. type: keyword user.changes.email: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: user-changes-email description: User email address. flat_name: user.changes.email @@ -8499,8 +8325,6 @@ user.changes.email: short: User email address. type: wildcard user.changes.full_name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: user-changes-full-name description: User's full name, if available. example: Albert Einstein @@ -8578,8 +8402,6 @@ user.changes.id: short: Unique identifier of the user. type: keyword user.changes.name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: user-changes-name description: Short name or login of the user. example: albert @@ -8634,8 +8456,6 @@ user.effective.domain: short: Name of the directory the user is a member of. type: keyword user.effective.email: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: user-effective-email description: User email address. flat_name: user.effective.email @@ -8646,8 +8466,6 @@ user.effective.email: short: User email address. type: wildcard user.effective.full_name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: user-effective-full-name description: User's full name, if available. example: Albert Einstein @@ -8725,8 +8543,6 @@ user.effective.id: short: Unique identifier of the user. type: keyword user.effective.name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: user-effective-name description: Short name or login of the user. example: albert @@ -8756,8 +8572,6 @@ user.effective.roles: short: Array of user roles at the time of the event. type: keyword user.email: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: user-email description: User email address. flat_name: user.email @@ -8767,8 +8581,6 @@ user.email: short: User email address. type: wildcard user.full_name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: user-full-name description: User's full name, if available. example: Albert Einstein @@ -8843,8 +8655,6 @@ user.id: short: Unique identifier of the user. type: keyword user.name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: user-name description: Short name or login of the user. example: albert @@ -8885,8 +8695,6 @@ user.target.domain: short: Name of the directory the user is a member of. type: keyword user.target.email: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: user-target-email description: User email address. flat_name: user.target.email @@ -8897,8 +8705,6 @@ user.target.email: short: User email address. type: wildcard user.target.full_name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: user-target-full-name description: User's full name, if available. example: Albert Einstein @@ -8976,8 +8782,6 @@ user.target.id: short: Unique identifier of the user. type: keyword user.target.name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: user-target-name description: Short name or login of the user. example: albert @@ -9029,8 +8833,6 @@ user_agent.name: short: Name of the user agent. type: keyword user_agent.original: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: user-agent-original description: Unparsed user_agent string. example: Mozilla/5.0 (iPhone; CPU iPhone OS 12_1 like Mac OS X) AppleWebKit/605.1.15 @@ -9059,8 +8861,6 @@ user_agent.os.family: short: OS family (such as redhat, debian, freebsd, windows). type: keyword user_agent.os.full: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: user-agent-os-full description: Operating system name, including the version or code name. example: Mac OS Mojave @@ -9089,8 +8889,6 @@ user_agent.os.kernel: short: Operating system kernel version as a raw string. type: keyword user_agent.os.name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: user-agent-os-name description: Operating system name, without the version. example: Mac OS X diff --git a/experimental/generated/ecs/ecs_nested.yml b/experimental/generated/ecs/ecs_nested.yml index 97acbc2459..5fcbde6af7 100644 --- a/experimental/generated/ecs/ecs_nested.yml +++ b/experimental/generated/ecs/ecs_nested.yml @@ -8,8 +8,6 @@ agent: event happened or the measurement was taken.' fields: agent.build.original: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: agent-build-original description: 'Extended build information for the agent. @@ -120,8 +118,6 @@ as: short: Unique number allocated to the autonomous system. type: long as.organization.name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: as-organization-name description: Organization name. example: Google LLC @@ -277,8 +273,6 @@ client: short: Unique number allocated to the autonomous system. type: long client.as.organization.name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: client-as-organization-name description: Organization name. example: Google LLC @@ -306,8 +300,6 @@ client: short: Bytes sent from the client to the server. type: long client.domain: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: client-domain description: Client domain. flat_name: client.domain @@ -376,8 +368,6 @@ client: short: Longitude and latitude. type: geo_point client.geo.name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: client-geo-name description: 'User-defined description of a location, at the level of granularity they care about. @@ -483,8 +473,6 @@ client: short: Port of the client. type: long client.registered_domain: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: client-registered-domain description: 'The highest registered client domain, stripped of the subdomain. @@ -549,8 +537,6 @@ client: short: Name of the directory the user is a member of. type: keyword client.user.email: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: client-user-email description: User email address. flat_name: client.user.email @@ -561,8 +547,6 @@ client: short: User email address. type: wildcard client.user.full_name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: client-user-full-name description: User's full name, if available. example: Albert Einstein @@ -640,8 +624,6 @@ client: short: Unique identifier of the user. type: keyword client.user.name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: client-user-name description: Short name or login of the user. example: albert @@ -1022,8 +1004,6 @@ destination: short: Unique number allocated to the autonomous system. type: long destination.as.organization.name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: destination-as-organization-name description: Organization name. example: Google LLC @@ -1051,8 +1031,6 @@ destination: short: Bytes sent from the destination to the source. type: long destination.domain: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: destination-domain description: Destination domain. flat_name: destination.domain @@ -1121,8 +1099,6 @@ destination: short: Longitude and latitude. type: geo_point destination.geo.name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: destination-geo-name description: 'User-defined description of a location, at the level of granularity they care about. @@ -1227,8 +1203,6 @@ destination: short: Port of the destination. type: long destination.registered_domain: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: destination-registered-domain description: 'The highest registered destination domain, stripped of the subdomain. @@ -1293,8 +1267,6 @@ destination: short: Name of the directory the user is a member of. type: keyword destination.user.email: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: destination-user-email description: User email address. flat_name: destination.user.email @@ -1305,8 +1277,6 @@ destination: short: User email address. type: wildcard destination.user.full_name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: destination-user-full-name description: User's full name, if available. example: Albert Einstein @@ -1384,8 +1354,6 @@ destination: short: Unique identifier of the user. type: keyword destination.user.name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: destination-user-name description: Short name or login of the user. example: albert @@ -1649,8 +1617,6 @@ dll: short: A hash of the imports in a PE file. type: keyword dll.pe.original_file_name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: dll-pe-original-file-name description: Internal name of the file, provided at compile-time. example: MSPAINT.EXE @@ -1732,8 +1698,6 @@ dns: short: The class of DNS data contained in this resource record. type: keyword dns.answers.data: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: dns-answers-data description: 'The data describing the resource. @@ -1836,8 +1800,6 @@ dns: short: The class of records being queried. type: keyword dns.question.name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: dns-question-name description: 'The name being queried. @@ -2025,8 +1987,6 @@ error: short: Error message. type: text error.stack_trace: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: error-stack-trace description: The stack trace of this error in plain text. flat_name: error.stack_trace @@ -2041,8 +2001,6 @@ error: short: The stack trace of this error in plain text. type: wildcard error.type: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: error-type description: The type of the error, for example the class name of the exception. example: java.lang.NullPointerException @@ -2980,8 +2938,6 @@ file: short: Device that is the source of the file. type: keyword file.directory: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: file-directory description: Directory where the file is located. It should include the drive letter, when appropriate. @@ -3153,8 +3109,6 @@ file: short: File owner's username. type: keyword file.path: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: file-path description: Full path to the file, including the file name. It should include the drive letter, when appropriate. @@ -3235,8 +3189,6 @@ file: short: A hash of the imports in a PE file. type: keyword file.pe.original_file_name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: file-pe-original-file-name description: Internal name of the file, provided at compile-time. example: MSPAINT.EXE @@ -3272,8 +3224,6 @@ file: short: File size in bytes. type: long file.target_path: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: file-target-path description: Target path for symlinks. flat_name: file.target_path @@ -3351,8 +3301,6 @@ file: short: List of country (C) codes type: keyword file.x509.issuer.distinguished_name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: file-x509-issuer-distinguished-name description: Distinguished name (DN) of issuing certificate authority. example: C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance @@ -3542,8 +3490,6 @@ file: short: List of country (C) code type: keyword file.x509.subject.distinguished_name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: file-x509-subject-distinguished-name description: Distinguished name (DN) of the certificate subject entity. example: C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net @@ -3703,8 +3649,6 @@ geo: short: Longitude and latitude. type: geo_point geo.name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: geo-name description: 'User-defined description of a location, at the level of granularity they care about. @@ -4009,8 +3953,6 @@ host: short: Longitude and latitude. type: geo_point host.geo.name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: host-geo-name description: 'User-defined description of a location, at the level of granularity they care about. @@ -4052,8 +3994,6 @@ host: short: Region name. type: keyword host.hostname: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: host-hostname description: 'Hostname of the host. @@ -4166,8 +4106,6 @@ host: short: OS family (such as redhat, debian, freebsd, windows). type: keyword host.os.full: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: host-os-full description: Operating system name, including the version or code name. example: Mac OS Mojave @@ -4196,8 +4134,6 @@ host: short: Operating system kernel version as a raw string. type: keyword host.os.name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: host-os-name description: Operating system name, without the version. example: Mac OS X @@ -4295,8 +4231,6 @@ host: short: Name of the directory the user is a member of. type: keyword host.user.email: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: host-user-email description: User email address. flat_name: host.user.email @@ -4307,8 +4241,6 @@ host: short: User email address. type: wildcard host.user.full_name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: host-user-full-name description: User's full name, if available. example: Albert Einstein @@ -4386,8 +4318,6 @@ host: short: Unique identifier of the user. type: keyword host.user.name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: host-user-name description: Short name or login of the user. example: albert @@ -4452,8 +4382,6 @@ http: short: Size in bytes of the request body. type: long http.request.body.content: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: http-request-body-content description: The full HTTP request body. example: Hello world @@ -4515,8 +4443,6 @@ http: short: Mime type of the body of the request. type: keyword http.request.referrer: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: http-request-referrer description: Referrer for this HTTP request. example: https://blog.example.com/ @@ -4538,8 +4464,6 @@ http: short: Size in bytes of the response body. type: long http.response.body.content: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: http-response-body-content description: The full HTTP response body. example: Hello world @@ -4677,8 +4601,6 @@ log: but rather in `event.*` or in other ECS fields.' fields: log.file.path: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: log-file-path description: 'Full path to the log file this event came from, including the file name. It should include the drive letter, when appropriate. @@ -4709,8 +4631,6 @@ log: short: Log level of the log event. type: keyword log.logger: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: log-logger description: The name of the logger inside an application. This is usually the name of the class which initialized the logger, or can be a custom name. @@ -5272,8 +5192,6 @@ observer: short: Longitude and latitude. type: geo_point observer.geo.name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: observer-geo-name description: 'User-defined description of a location, at the level of granularity they care about. @@ -5461,8 +5379,6 @@ observer: short: OS family (such as redhat, debian, freebsd, windows). type: keyword observer.os.full: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: observer-os-full description: Operating system name, including the version or code name. example: Mac OS Mojave @@ -5491,8 +5407,6 @@ observer: short: Operating system kernel version as a raw string. type: keyword observer.os.name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: observer-os-name description: Operating system name, without the version. example: Mac OS X @@ -5658,8 +5572,6 @@ organization: short: Unique identifier for the organization. type: keyword organization.name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: organization-name description: Organization name. flat_name: organization.name @@ -5694,8 +5606,6 @@ os: short: OS family (such as redhat, debian, freebsd, windows). type: keyword os.full: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: os-full description: Operating system name, including the version or code name. example: Mac OS Mojave @@ -5722,8 +5632,6 @@ os: short: Operating system kernel version as a raw string. type: keyword os.name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: os-name description: Operating system name, without the version. example: Mac OS X @@ -6023,8 +5931,6 @@ pe: short: A hash of the imports in a PE file. type: keyword pe.original_file_name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: pe-original-file-name description: Internal name of the file, provided at compile-time. example: MSPAINT.EXE @@ -6168,8 +6074,6 @@ process: content. type: boolean process.command_line: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: process-command-line description: 'Full command line that started the process, including the absolute path to the executable, and all arguments. @@ -6207,8 +6111,6 @@ process: short: Unique identifier for the process. type: keyword process.executable: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: process-executable description: Absolute path to the process executable. example: /usr/bin/ssh @@ -6281,8 +6183,6 @@ process: short: SHA512 hash. type: keyword process.name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: process-name description: 'Process name. @@ -6399,8 +6299,6 @@ process: content. type: boolean process.parent.command_line: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: process-parent-command-line description: 'Full command line that started the process, including the absolute path to the executable, and all arguments. @@ -6440,8 +6338,6 @@ process: short: Unique identifier for the process. type: keyword process.parent.executable: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: process-parent-executable description: Absolute path to the process executable. example: /usr/bin/ssh @@ -6516,8 +6412,6 @@ process: short: SHA512 hash. type: keyword process.parent.name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: process-parent-name description: 'Process name. @@ -6600,8 +6494,6 @@ process: short: A hash of the imports in a PE file. type: keyword process.parent.pe.original_file_name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: process-parent-pe-original-file-name description: Internal name of the file, provided at compile-time. example: MSPAINT.EXE @@ -6683,8 +6575,6 @@ process: short: Thread ID. type: long process.parent.thread.name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: process-parent-thread-name description: Thread name. example: thread-0 @@ -6696,8 +6586,6 @@ process: short: Thread name. type: wildcard process.parent.title: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: process-parent-title description: 'Process title. @@ -6727,8 +6615,6 @@ process: short: Seconds the process has been up. type: long process.parent.working_directory: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: process-parent-working-directory description: The working directory of the process. example: /home/alice @@ -6809,8 +6695,6 @@ process: short: A hash of the imports in a PE file. type: keyword process.pe.original_file_name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: process-pe-original-file-name description: Internal name of the file, provided at compile-time. example: MSPAINT.EXE @@ -6887,8 +6771,6 @@ process: short: Thread ID. type: long process.thread.name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: process-thread-name description: Thread name. example: thread-0 @@ -6899,8 +6781,6 @@ process: short: Thread name. type: wildcard process.title: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: process-title description: 'Process title. @@ -6928,8 +6808,6 @@ process: short: Seconds the process has been up. type: long process.working_directory: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: process-working-directory description: The working directory of the process. example: /home/alice @@ -6993,8 +6871,6 @@ registry: short: Original bytes written with base64 encoding. type: keyword registry.data.strings: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: registry-data-strings description: 'Content when writing string types. @@ -7034,8 +6910,6 @@ registry: short: Abbreviated name for the hive. type: keyword registry.key: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: registry-key description: Hive-relative path of keys. example: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe @@ -7046,8 +6920,6 @@ registry: short: Hive-relative path of keys. type: wildcard registry.path: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: registry-path description: Full path, including hive, key and value example: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution @@ -7322,8 +7194,6 @@ server: short: Unique number allocated to the autonomous system. type: long server.as.organization.name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: server-as-organization-name description: Organization name. example: Google LLC @@ -7351,8 +7221,6 @@ server: short: Bytes sent from the server to the client. type: long server.domain: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: server-domain description: Server domain. flat_name: server.domain @@ -7421,8 +7289,6 @@ server: short: Longitude and latitude. type: geo_point server.geo.name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: server-geo-name description: 'User-defined description of a location, at the level of granularity they care about. @@ -7528,8 +7394,6 @@ server: short: Port of the server. type: long server.registered_domain: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: server-registered-domain description: 'The highest registered server domain, stripped of the subdomain. @@ -7594,8 +7458,6 @@ server: short: Name of the directory the user is a member of. type: keyword server.user.email: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: server-user-email description: User email address. flat_name: server.user.email @@ -7606,8 +7468,6 @@ server: short: User email address. type: wildcard server.user.full_name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: server-user-full-name description: User's full name, if available. example: Albert Einstein @@ -7685,8 +7545,6 @@ server: short: Unique identifier of the user. type: keyword server.user.name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: server-user-name description: Short name or login of the user. example: albert @@ -7899,8 +7757,6 @@ source: short: Unique number allocated to the autonomous system. type: long source.as.organization.name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: source-as-organization-name description: Organization name. example: Google LLC @@ -7928,8 +7784,6 @@ source: short: Bytes sent from the source to the destination. type: long source.domain: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: source-domain description: Source domain. flat_name: source.domain @@ -7998,8 +7852,6 @@ source: short: Longitude and latitude. type: geo_point source.geo.name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: source-geo-name description: 'User-defined description of a location, at the level of granularity they care about. @@ -8105,8 +7957,6 @@ source: short: Port of the source. type: long source.registered_domain: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: source-registered-domain description: 'The highest registered source domain, stripped of the subdomain. @@ -8171,8 +8021,6 @@ source: short: Name of the directory the user is a member of. type: keyword source.user.email: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: source-user-email description: User email address. flat_name: source.user.email @@ -8183,8 +8031,6 @@ source: short: User email address. type: wildcard source.user.full_name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: source-user-full-name description: User's full name, if available. example: Albert Einstein @@ -8262,8 +8108,6 @@ source: short: Unique identifier of the user. type: keyword source.user.name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: source-user-name description: Short name or login of the user. example: albert @@ -8556,8 +8400,6 @@ tls: of certificate offered by the client. type: keyword tls.client.issuer: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: tls-client-issuer description: Distinguished name of subject of the issuer of the x.509 certificate presented by the client. @@ -8618,8 +8460,6 @@ tls: short: Hostname the client is trying to connect to. Also called the SNI. type: keyword tls.client.subject: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: tls-client-subject description: Distinguished name of subject of the x.509 certificate presented by the client. @@ -8686,8 +8526,6 @@ tls: short: List of country (C) codes type: keyword tls.client.x509.issuer.distinguished_name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: tls-client-x509-issuer-distinguished-name description: Distinguished name (DN) of issuing certificate authority. example: C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance @@ -8877,8 +8715,6 @@ tls: short: List of country (C) code type: keyword tls.client.x509.subject.distinguished_name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: tls-client-x509-subject-distinguished-name description: Distinguished name (DN) of the certificate subject entity. example: C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net @@ -9069,8 +8905,6 @@ tls: of certificate offered by the server. type: keyword tls.server.issuer: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: tls-server-issuer description: Subject of the issuer of the x.509 certificate presented by the server. @@ -9117,8 +8951,6 @@ tls: short: Timestamp indicating when server certificate is first considered valid. type: date tls.server.subject: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: tls-server-subject description: Subject of the x.509 certificate presented by the server. example: CN=www.example.com, OU=Infrastructure Team, DC=example, DC=com @@ -9170,8 +9002,6 @@ tls: short: List of country (C) codes type: keyword tls.server.x509.issuer.distinguished_name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: tls-server-x509-issuer-distinguished-name description: Distinguished name (DN) of issuing certificate authority. example: C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance @@ -9361,8 +9191,6 @@ tls: short: List of country (C) code type: keyword tls.server.x509.subject.distinguished_name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: tls-server-x509-subject-distinguished-name description: Distinguished name (DN) of the certificate subject entity. example: C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net @@ -9538,8 +9366,6 @@ url: the breaking down into scheme, domain, path, and so on. fields: url.domain: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: url-domain description: 'Domain of the url, such as "www.elastic.co". @@ -9589,8 +9415,6 @@ url: short: Portion of the url after the `#`. type: keyword url.full: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: url-full description: If full URLs are important to your use case, they should be stored in `url.full`, whether this field is reconstructed or present in the event @@ -9608,8 +9432,6 @@ url: short: Full unparsed URL. type: wildcard url.original: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: url-original description: 'Unmodified original url as seen in the event source. @@ -9640,8 +9462,6 @@ url: short: Password of the request. type: keyword url.path: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: url-path description: Path of the request, such as "/search". flat_name: url.path @@ -9678,8 +9498,6 @@ url: short: Query string of the request. type: keyword url.registered_domain: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: url-registered-domain description: 'The highest registered url domain, stripped of the subdomain. @@ -9780,8 +9598,6 @@ user: short: Name of the directory the user is a member of. type: keyword user.changes.email: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: user-changes-email description: User email address. flat_name: user.changes.email @@ -9792,8 +9608,6 @@ user: short: User email address. type: wildcard user.changes.full_name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: user-changes-full-name description: User's full name, if available. example: Albert Einstein @@ -9871,8 +9685,6 @@ user: short: Unique identifier of the user. type: keyword user.changes.name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: user-changes-name description: Short name or login of the user. example: albert @@ -9927,8 +9739,6 @@ user: short: Name of the directory the user is a member of. type: keyword user.effective.email: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: user-effective-email description: User email address. flat_name: user.effective.email @@ -9939,8 +9749,6 @@ user: short: User email address. type: wildcard user.effective.full_name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: user-effective-full-name description: User's full name, if available. example: Albert Einstein @@ -10018,8 +9826,6 @@ user: short: Unique identifier of the user. type: keyword user.effective.name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: user-effective-name description: Short name or login of the user. example: albert @@ -10049,8 +9855,6 @@ user: short: Array of user roles at the time of the event. type: keyword user.email: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: user-email description: User email address. flat_name: user.email @@ -10060,8 +9864,6 @@ user: short: User email address. type: wildcard user.full_name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: user-full-name description: User's full name, if available. example: Albert Einstein @@ -10136,8 +9938,6 @@ user: short: Unique identifier of the user. type: keyword user.name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: user-name description: Short name or login of the user. example: albert @@ -10178,8 +9978,6 @@ user: short: Name of the directory the user is a member of. type: keyword user.target.email: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: user-target-email description: User email address. flat_name: user.target.email @@ -10190,8 +9988,6 @@ user: short: User email address. type: wildcard user.target.full_name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: user-target-full-name description: User's full name, if available. example: Albert Einstein @@ -10269,8 +10065,6 @@ user: short: Unique identifier of the user. type: keyword user.target.name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: user-target-name description: Short name or login of the user. example: albert @@ -10384,8 +10178,6 @@ user_agent: short: Name of the user agent. type: keyword user_agent.original: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: user-agent-original description: Unparsed user_agent string. example: Mozilla/5.0 (iPhone; CPU iPhone OS 12_1 like Mac OS X) AppleWebKit/605.1.15 @@ -10414,8 +10206,6 @@ user_agent: short: OS family (such as redhat, debian, freebsd, windows). type: keyword user_agent.os.full: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: user-agent-os-full description: Operating system name, including the version or code name. example: Mac OS Mojave @@ -10444,8 +10234,6 @@ user_agent: short: Operating system kernel version as a raw string. type: keyword user_agent.os.name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: user-agent-os-name description: Operating system name, without the version. example: Mac OS X @@ -10826,8 +10614,6 @@ x509: short: List of country (C) codes type: keyword x509.issuer.distinguished_name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: x509-issuer-distinguished-name description: Distinguished name (DN) of issuing certificate authority. example: C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance @@ -11002,8 +10788,6 @@ x509: short: List of country (C) code type: keyword x509.subject.distinguished_name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: x509-subject-distinguished-name description: Distinguished name (DN) of the certificate subject entity. example: C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net diff --git a/experimental/schemas/agent.yml b/experimental/schemas/agent.yml new file mode 100644 index 0000000000..d09e77111d --- /dev/null +++ b/experimental/schemas/agent.yml @@ -0,0 +1,5 @@ +--- +- name: agent + fields: + - name: build.original + type: wildcard diff --git a/experimental/schemas/as.yml b/experimental/schemas/as.yml new file mode 100644 index 0000000000..96cf45621c --- /dev/null +++ b/experimental/schemas/as.yml @@ -0,0 +1,5 @@ +--- +- name: as + fields: + - name: organization.name + type: wildcard diff --git a/experimental/schemas/client.yml b/experimental/schemas/client.yml new file mode 100644 index 0000000000..14ed3a9a37 --- /dev/null +++ b/experimental/schemas/client.yml @@ -0,0 +1,7 @@ +--- + - name: client + fields: + - name: domain + type: wildcard + - name: registered_domain + type: wildcard diff --git a/experimental/schemas/destination.yml b/experimental/schemas/destination.yml new file mode 100644 index 0000000000..d64a84c6be --- /dev/null +++ b/experimental/schemas/destination.yml @@ -0,0 +1,7 @@ +--- + - name: destination + fields: + - name: domain + type: wildcard + - name: registered_domain + type: wildcard diff --git a/experimental/schemas/dns.yml b/experimental/schemas/dns.yml new file mode 100644 index 0000000000..466859c09f --- /dev/null +++ b/experimental/schemas/dns.yml @@ -0,0 +1,9 @@ +--- +- name: dns + fields: + - name: question.name + type: wildcard + - name: answers + type: object + - name: answers.data + type: wildcard diff --git a/experimental/schemas/error.yml b/experimental/schemas/error.yml new file mode 100644 index 0000000000..f2004d3fe0 --- /dev/null +++ b/experimental/schemas/error.yml @@ -0,0 +1,9 @@ +--- +- name: error + fields: + - name: stack_trace + index: true + type: wildcard + + - name: type + type: wildcard diff --git a/experimental/schemas/file.yml b/experimental/schemas/file.yml new file mode 100644 index 0000000000..f4938d38be --- /dev/null +++ b/experimental/schemas/file.yml @@ -0,0 +1,9 @@ +--- +- name: file + fields: + - name: directory + type: wildcard + - name: path + type: wildcard + - name: target_path + type: wildcard diff --git a/experimental/schemas/geo.yml b/experimental/schemas/geo.yml new file mode 100644 index 0000000000..d3445a5a2b --- /dev/null +++ b/experimental/schemas/geo.yml @@ -0,0 +1,5 @@ +--- + - name: geo + fields: + - name: name + type: wildcard diff --git a/experimental/schemas/host.yml b/experimental/schemas/host.yml index eabc2f9af8..b7b57cfc09 100644 --- a/experimental/schemas/host.yml +++ b/experimental/schemas/host.yml @@ -60,3 +60,6 @@ description: > The total number of bytes (gauge) written successfully (aggregated from all disks) since the last metric collection. + + - name: hostname + type: wildcard diff --git a/experimental/schemas/http.yml b/experimental/schemas/http.yml new file mode 100644 index 0000000000..1722cdc5e7 --- /dev/null +++ b/experimental/schemas/http.yml @@ -0,0 +1,9 @@ +--- +- name: http + fields: + - name: request.body.content + type: wildcard + - name: request.referrer + type: wildcard + - name: response.body.content + type: wildcard diff --git a/experimental/schemas/log.yml b/experimental/schemas/log.yml new file mode 100644 index 0000000000..8a2f2dd397 --- /dev/null +++ b/experimental/schemas/log.yml @@ -0,0 +1,7 @@ +--- +- name: log + fields: + - name: file.path + type: wildcard + - name: logger + type: wildcard diff --git a/experimental/schemas/organization.yml b/experimental/schemas/organization.yml new file mode 100644 index 0000000000..594581413b --- /dev/null +++ b/experimental/schemas/organization.yml @@ -0,0 +1,5 @@ +--- +- name: organization + fields: + - name: name + type: wildcard diff --git a/experimental/schemas/os.yml b/experimental/schemas/os.yml new file mode 100644 index 0000000000..ec9d71a79c --- /dev/null +++ b/experimental/schemas/os.yml @@ -0,0 +1,7 @@ +--- +- name: os + fields: + - name: name + type: wildcard + - name: full + type: wildcard diff --git a/experimental/schemas/pe.yml b/experimental/schemas/pe.yml new file mode 100644 index 0000000000..77a0574348 --- /dev/null +++ b/experimental/schemas/pe.yml @@ -0,0 +1,5 @@ +--- +- name: pe + fields: + - name: original_file_name + type: wildcard diff --git a/experimental/schemas/process.yml b/experimental/schemas/process.yml new file mode 100644 index 0000000000..e759e97e86 --- /dev/null +++ b/experimental/schemas/process.yml @@ -0,0 +1,15 @@ +--- +- name: process + fields: + - name: command_line + type: wildcard + - name: executable + type: wildcard + - name: name + type: wildcard + - name: thread.name + type: wildcard + - name: title + type: wildcard + - name: working_directory + type: wildcard diff --git a/experimental/schemas/registry.yml b/experimental/schemas/registry.yml new file mode 100644 index 0000000000..66f6f6b22c --- /dev/null +++ b/experimental/schemas/registry.yml @@ -0,0 +1,9 @@ +--- +- name: registry + fields: + - name: key + type: wildcard + - name: path + type: wildcard + - name: data.strings + type: wildcard diff --git a/experimental/schemas/server.yml b/experimental/schemas/server.yml new file mode 100644 index 0000000000..70c285f374 --- /dev/null +++ b/experimental/schemas/server.yml @@ -0,0 +1,7 @@ +--- + - name: server + fields: + - name: domain + type: wildcard + - name: registered_domain + type: wildcard diff --git a/experimental/schemas/source.yml b/experimental/schemas/source.yml new file mode 100644 index 0000000000..d810a6cb79 --- /dev/null +++ b/experimental/schemas/source.yml @@ -0,0 +1,7 @@ +--- +- name: source + fields: + - name: domain + type: wildcard + - name: registered_domain + type: wildcard diff --git a/experimental/schemas/tls.yml b/experimental/schemas/tls.yml new file mode 100644 index 0000000000..4f5378a313 --- /dev/null +++ b/experimental/schemas/tls.yml @@ -0,0 +1,11 @@ +--- +- name: tls + fields: + - name: client.issuer + type: wildcard + - name: client.subject + type: wildcard + - name: server.issuer + type: wildcard + - name: server.subject + type: wildcard diff --git a/experimental/schemas/url.yml b/experimental/schemas/url.yml new file mode 100644 index 0000000000..0d5f66c36a --- /dev/null +++ b/experimental/schemas/url.yml @@ -0,0 +1,13 @@ +--- +- name: url + fields: + - name: original + type: wildcard + - name: full + type: wildcard + - name: path + type: wildcard + - name: domain + type: wildcard + - name: registered_domain + type: wildcard diff --git a/experimental/schemas/user.yml b/experimental/schemas/user.yml new file mode 100644 index 0000000000..89e182fbee --- /dev/null +++ b/experimental/schemas/user.yml @@ -0,0 +1,9 @@ +--- +- name: user + fields: + - name: name + type: wildcard + - name: full_name + type: wildcard + - name: email + type: wildcard diff --git a/experimental/schemas/user_agent.yml b/experimental/schemas/user_agent.yml new file mode 100644 index 0000000000..c413a9d702 --- /dev/null +++ b/experimental/schemas/user_agent.yml @@ -0,0 +1,5 @@ +--- +- name: user_agent + fields: + - name: original + type: wildcard diff --git a/experimental/schemas/x509.yml b/experimental/schemas/x509.yml new file mode 100644 index 0000000000..d1c7d8af6b --- /dev/null +++ b/experimental/schemas/x509.yml @@ -0,0 +1,7 @@ +--- +- name: x509 + fields: + - name: issuer.distinguished_name + type: wildcard + - name: subject.distinguished_name + type: wildcard diff --git a/generated/beats/fields.ecs.yml b/generated/beats/fields.ecs.yml index 1f06a65a1a..d3e0aeda3b 100644 --- a/generated/beats/fields.ecs.yml +++ b/generated/beats/fields.ecs.yml @@ -66,7 +66,8 @@ fields: - name: build.original level: core - type: wildcard + type: keyword + ignore_above: 1024 description: 'Extended build information for the agent. This field is intended to contain any build information that a data source @@ -135,7 +136,8 @@ example: 15169 - name: organization.name level: extended - type: wildcard + type: keyword + ignore_above: 1024 multi_fields: - name: text type: text @@ -181,7 +183,8 @@ example: 15169 - name: as.organization.name level: extended - type: wildcard + type: keyword + ignore_above: 1024 multi_fields: - name: text type: text @@ -197,7 +200,8 @@ example: 184 - name: domain level: core - type: wildcard + type: keyword + ignore_above: 1024 description: Client domain. - name: geo.city_name level: core @@ -230,7 +234,8 @@ example: '{ "lon": -73.614830, "lat": 45.505918 }' - name: geo.name level: extended - type: wildcard + type: keyword + ignore_above: 1024 description: 'User-defined description of a location, at the level of granularity they care about. @@ -287,7 +292,8 @@ description: Port of the client. - name: registered_domain level: extended - type: wildcard + type: keyword + ignore_above: 1024 description: 'The highest registered client domain, stripped of the subdomain. For example, the registered domain for "foo.example.com" is "example.com". @@ -331,11 +337,13 @@ For example, an LDAP or Active Directory domain name.' - name: user.email level: extended - type: wildcard + type: keyword + ignore_above: 1024 description: User email address. - name: user.full_name level: extended - type: wildcard + type: keyword + ignore_above: 1024 multi_fields: - name: text type: text @@ -376,7 +384,8 @@ description: Unique identifier of the user. - name: user.name level: core - type: wildcard + type: keyword + ignore_above: 1024 multi_fields: - name: text type: text @@ -596,7 +605,8 @@ example: 15169 - name: as.organization.name level: extended - type: wildcard + type: keyword + ignore_above: 1024 multi_fields: - name: text type: text @@ -612,7 +622,8 @@ example: 184 - name: domain level: core - type: wildcard + type: keyword + ignore_above: 1024 description: Destination domain. - name: geo.city_name level: core @@ -645,7 +656,8 @@ example: '{ "lon": -73.614830, "lat": 45.505918 }' - name: geo.name level: extended - type: wildcard + type: keyword + ignore_above: 1024 description: 'User-defined description of a location, at the level of granularity they care about. @@ -701,7 +713,8 @@ description: Port of the destination. - name: registered_domain level: extended - type: wildcard + type: keyword + ignore_above: 1024 description: 'The highest registered destination domain, stripped of the subdomain. For example, the registered domain for "foo.example.com" is "example.com". @@ -745,11 +758,13 @@ For example, an LDAP or Active Directory domain name.' - name: user.email level: extended - type: wildcard + type: keyword + ignore_above: 1024 description: User email address. - name: user.full_name level: extended - type: wildcard + type: keyword + ignore_above: 1024 multi_fields: - name: text type: text @@ -790,7 +805,8 @@ description: Unique identifier of the user. - name: user.name level: core - type: wildcard + type: keyword + ignore_above: 1024 multi_fields: - name: text type: text @@ -945,7 +961,8 @@ default_field: false - name: pe.original_file_name level: extended - type: wildcard + type: keyword + ignore_above: 1024 description: Internal name of the file, provided at compile-time. example: MSPAINT.EXE default_field: false @@ -988,7 +1005,8 @@ example: IN - name: answers.data level: extended - type: wildcard + type: keyword + ignore_above: 1024 description: 'The data describing the resource. The meaning of this data depends on the type and class of the resource record.' @@ -1047,7 +1065,8 @@ example: IN - name: question.name level: extended - type: wildcard + type: keyword + ignore_above: 1024 description: 'The name being queried. If the name field contains non-printable characters (below 32 or above 126), @@ -1166,16 +1185,19 @@ description: Error message. - name: stack_trace level: extended - type: wildcard + type: keyword + ignore_above: 1024 multi_fields: - name: text type: text norms: false default_field: false description: The stack trace of this error in plain text. + index: false - name: type level: extended - type: wildcard + type: keyword + ignore_above: 1024 description: The type of the error, for example the class name of the exception. example: java.lang.NullPointerException - name: event @@ -1564,7 +1586,8 @@ example: sda - name: directory level: extended - type: wildcard + type: keyword + ignore_above: 1024 description: Directory where the file is located. It should include the drive letter, when appropriate. example: /home/alice @@ -1658,7 +1681,8 @@ example: alice - name: path level: extended - type: wildcard + type: keyword + ignore_above: 1024 multi_fields: - name: text type: text @@ -1708,7 +1732,8 @@ default_field: false - name: pe.original_file_name level: extended - type: wildcard + type: keyword + ignore_above: 1024 description: Internal name of the file, provided at compile-time. example: MSPAINT.EXE default_field: false @@ -1728,7 +1753,8 @@ example: 16384 - name: target_path level: extended - type: wildcard + type: keyword + ignore_above: 1024 multi_fields: - name: text type: text @@ -1772,7 +1798,8 @@ default_field: false - name: x509.issuer.distinguished_name level: extended - type: wildcard + type: keyword + ignore_above: 1024 description: Distinguished name (DN) of issuing certificate authority. example: C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA @@ -1878,7 +1905,8 @@ default_field: false - name: x509.subject.distinguished_name level: extended - type: wildcard + type: keyword + ignore_above: 1024 description: Distinguished name (DN) of the certificate subject entity. example: C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net default_field: false @@ -1957,7 +1985,8 @@ example: '{ "lon": -73.614830, "lat": 45.505918 }' - name: name level: extended - type: wildcard + type: keyword + ignore_above: 1024 description: 'User-defined description of a location, at the level of granularity they care about. @@ -2090,7 +2119,8 @@ example: '{ "lon": -73.614830, "lat": 45.505918 }' - name: geo.name level: extended - type: wildcard + type: keyword + ignore_above: 1024 description: 'User-defined description of a location, at the level of granularity they care about. @@ -2113,7 +2143,8 @@ example: Quebec - name: hostname level: core - type: wildcard + type: keyword + ignore_above: 1024 description: 'Hostname of the host. It normally contains what the `hostname` command returns on the host machine.' @@ -2152,7 +2183,8 @@ example: debian - name: os.full level: extended - type: wildcard + type: keyword + ignore_above: 1024 multi_fields: - name: text type: text @@ -2168,7 +2200,8 @@ example: 4.4.0-112-generic - name: os.name level: extended - type: wildcard + type: keyword + ignore_above: 1024 multi_fields: - name: text type: text @@ -2226,11 +2259,13 @@ For example, an LDAP or Active Directory domain name.' - name: user.email level: extended - type: wildcard + type: keyword + ignore_above: 1024 description: User email address. - name: user.full_name level: extended - type: wildcard + type: keyword + ignore_above: 1024 multi_fields: - name: text type: text @@ -2271,7 +2306,8 @@ description: Unique identifier of the user. - name: user.name level: core - type: wildcard + type: keyword + ignore_above: 1024 multi_fields: - name: text type: text @@ -2301,7 +2337,8 @@ example: 887 - name: request.body.content level: extended - type: wildcard + type: keyword + ignore_above: 1024 multi_fields: - name: text type: text @@ -2343,7 +2380,8 @@ default_field: false - name: request.referrer level: extended - type: wildcard + type: keyword + ignore_above: 1024 description: Referrer for this HTTP request. example: https://blog.example.com/ - name: response.body.bytes @@ -2354,7 +2392,8 @@ example: 887 - name: response.body.content level: extended - type: wildcard + type: keyword + ignore_above: 1024 multi_fields: - name: text type: text @@ -2440,7 +2479,8 @@ fields: - name: file.path level: extended - type: wildcard + type: keyword + ignore_above: 1024 description: 'Full path to the log file this event came from, including the file name. It should include the drive letter, when appropriate. @@ -2461,7 +2501,8 @@ example: error - name: logger level: core - type: wildcard + type: keyword + ignore_above: 1024 description: The name of the logger inside an application. This is usually the name of the class which initialized the logger, or can be a custom name. example: org.elasticsearch.bootstrap.Bootstrap @@ -2807,7 +2848,8 @@ example: '{ "lon": -73.614830, "lat": 45.505918 }' - name: geo.name level: extended - type: wildcard + type: keyword + ignore_above: 1024 description: 'User-defined description of a location, at the level of granularity they care about. @@ -2915,7 +2957,8 @@ example: debian - name: os.full level: extended - type: wildcard + type: keyword + ignore_above: 1024 multi_fields: - name: text type: text @@ -2931,7 +2974,8 @@ example: 4.4.0-112-generic - name: os.name level: extended - type: wildcard + type: keyword + ignore_above: 1024 multi_fields: - name: text type: text @@ -3014,7 +3058,8 @@ description: Unique identifier for the organization. - name: name level: extended - type: wildcard + type: keyword + ignore_above: 1024 multi_fields: - name: text type: text @@ -3035,7 +3080,8 @@ example: debian - name: full level: extended - type: wildcard + type: keyword + ignore_above: 1024 multi_fields: - name: text type: text @@ -3051,7 +3097,8 @@ example: 4.4.0-112-generic - name: name level: extended - type: wildcard + type: keyword + ignore_above: 1024 multi_fields: - name: text type: text @@ -3231,7 +3278,8 @@ default_field: false - name: original_file_name level: extended - type: wildcard + type: keyword + ignore_above: 1024 description: Internal name of the file, provided at compile-time. example: MSPAINT.EXE default_field: false @@ -3315,7 +3363,8 @@ default_field: false - name: command_line level: extended - type: wildcard + type: keyword + ignore_above: 1024 multi_fields: - name: text type: text @@ -3343,7 +3392,8 @@ default_field: false - name: executable level: extended - type: wildcard + type: keyword + ignore_above: 1024 multi_fields: - name: text type: text @@ -3382,7 +3432,8 @@ description: SHA512 hash. - name: name level: extended - type: wildcard + type: keyword + ignore_above: 1024 multi_fields: - name: text type: text @@ -3456,7 +3507,8 @@ default_field: false - name: parent.command_line level: extended - type: wildcard + type: keyword + ignore_above: 1024 multi_fields: - name: text type: text @@ -3484,7 +3536,8 @@ default_field: false - name: parent.executable level: extended - type: wildcard + type: keyword + ignore_above: 1024 multi_fields: - name: text type: text @@ -3527,7 +3580,8 @@ default_field: false - name: parent.name level: extended - type: wildcard + type: keyword + ignore_above: 1024 multi_fields: - name: text type: text @@ -3578,7 +3632,8 @@ default_field: false - name: parent.pe.original_file_name level: extended - type: wildcard + type: keyword + ignore_above: 1024 description: Internal name of the file, provided at compile-time. example: MSPAINT.EXE default_field: false @@ -3624,13 +3679,15 @@ default_field: false - name: parent.thread.name level: extended - type: wildcard + type: keyword + ignore_above: 1024 description: Thread name. example: thread-0 default_field: false - name: parent.title level: extended - type: wildcard + type: keyword + ignore_above: 1024 multi_fields: - name: text type: text @@ -3648,7 +3705,8 @@ default_field: false - name: parent.working_directory level: extended - type: wildcard + type: keyword + ignore_above: 1024 multi_fields: - name: text type: text @@ -3697,7 +3755,8 @@ default_field: false - name: pe.original_file_name level: extended - type: wildcard + type: keyword + ignore_above: 1024 description: Internal name of the file, provided at compile-time. example: MSPAINT.EXE default_field: false @@ -3738,12 +3797,14 @@ example: 4242 - name: thread.name level: extended - type: wildcard + type: keyword + ignore_above: 1024 description: Thread name. example: thread-0 - name: title level: extended - type: wildcard + type: keyword + ignore_above: 1024 multi_fields: - name: text type: text @@ -3760,7 +3821,8 @@ example: 1325 - name: working_directory level: extended - type: wildcard + type: keyword + ignore_above: 1024 multi_fields: - name: text type: text @@ -3787,7 +3849,8 @@ default_field: false - name: data.strings level: core - type: wildcard + type: keyword + ignore_above: 1024 description: 'Content when writing string types. Populated as an array when writing string data to the registry. For single @@ -3813,13 +3876,15 @@ default_field: false - name: key level: core - type: wildcard + type: keyword + ignore_above: 1024 description: Hive-relative path of keys. example: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe default_field: false - name: path level: core - type: wildcard + type: keyword + ignore_above: 1024 description: Full path, including hive, key and value example: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe\Debugger @@ -4004,7 +4069,8 @@ example: 15169 - name: as.organization.name level: extended - type: wildcard + type: keyword + ignore_above: 1024 multi_fields: - name: text type: text @@ -4020,7 +4086,8 @@ example: 184 - name: domain level: core - type: wildcard + type: keyword + ignore_above: 1024 description: Server domain. - name: geo.city_name level: core @@ -4053,7 +4120,8 @@ example: '{ "lon": -73.614830, "lat": 45.505918 }' - name: geo.name level: extended - type: wildcard + type: keyword + ignore_above: 1024 description: 'User-defined description of a location, at the level of granularity they care about. @@ -4110,7 +4178,8 @@ description: Port of the server. - name: registered_domain level: extended - type: wildcard + type: keyword + ignore_above: 1024 description: 'The highest registered server domain, stripped of the subdomain. For example, the registered domain for "foo.example.com" is "example.com". @@ -4154,11 +4223,13 @@ For example, an LDAP or Active Directory domain name.' - name: user.email level: extended - type: wildcard + type: keyword + ignore_above: 1024 description: User email address. - name: user.full_name level: extended - type: wildcard + type: keyword + ignore_above: 1024 multi_fields: - name: text type: text @@ -4199,7 +4270,8 @@ description: Unique identifier of the user. - name: user.name level: core - type: wildcard + type: keyword + ignore_above: 1024 multi_fields: - name: text type: text @@ -4333,7 +4405,8 @@ example: 15169 - name: as.organization.name level: extended - type: wildcard + type: keyword + ignore_above: 1024 multi_fields: - name: text type: text @@ -4349,7 +4422,8 @@ example: 184 - name: domain level: core - type: wildcard + type: keyword + ignore_above: 1024 description: Source domain. - name: geo.city_name level: core @@ -4382,7 +4456,8 @@ example: '{ "lon": -73.614830, "lat": 45.505918 }' - name: geo.name level: extended - type: wildcard + type: keyword + ignore_above: 1024 description: 'User-defined description of a location, at the level of granularity they care about. @@ -4439,7 +4514,8 @@ description: Port of the source. - name: registered_domain level: extended - type: wildcard + type: keyword + ignore_above: 1024 description: 'The highest registered source domain, stripped of the subdomain. For example, the registered domain for "foo.example.com" is "example.com". @@ -4483,11 +4559,13 @@ For example, an LDAP or Active Directory domain name.' - name: user.email level: extended - type: wildcard + type: keyword + ignore_above: 1024 description: User email address. - name: user.full_name level: extended - type: wildcard + type: keyword + ignore_above: 1024 multi_fields: - name: text type: text @@ -4528,7 +4606,8 @@ description: Unique identifier of the user. - name: user.name level: core - type: wildcard + type: keyword + ignore_above: 1024 multi_fields: - name: text type: text @@ -4702,7 +4781,8 @@ default_field: false - name: client.issuer level: extended - type: wildcard + type: keyword + ignore_above: 1024 description: Distinguished name of subject of the issuer of the x.509 certificate presented by the client. example: CN=Example Root CA, OU=Infrastructure Team, DC=example, DC=com @@ -4740,7 +4820,8 @@ default_field: false - name: client.subject level: extended - type: wildcard + type: keyword + ignore_above: 1024 description: Distinguished name of subject of the x.509 certificate presented by the client. example: CN=myclient, OU=Documentation Team, DC=example, DC=com @@ -4778,7 +4859,8 @@ default_field: false - name: client.x509.issuer.distinguished_name level: extended - type: wildcard + type: keyword + ignore_above: 1024 description: Distinguished name (DN) of issuing certificate authority. example: C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA @@ -4884,7 +4966,8 @@ default_field: false - name: client.x509.subject.distinguished_name level: extended - type: wildcard + type: keyword + ignore_above: 1024 description: Distinguished name (DN) of the certificate subject entity. example: C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net default_field: false @@ -4997,7 +5080,8 @@ default_field: false - name: server.issuer level: extended - type: wildcard + type: keyword + ignore_above: 1024 description: Subject of the issuer of the x.509 certificate presented by the server. example: CN=Example Root CA, OU=Infrastructure Team, DC=example, DC=com @@ -5026,7 +5110,8 @@ default_field: false - name: server.subject level: extended - type: wildcard + type: keyword + ignore_above: 1024 description: Subject of the x.509 certificate presented by the server. example: CN=www.example.com, OU=Infrastructure Team, DC=example, DC=com default_field: false @@ -5055,7 +5140,8 @@ default_field: false - name: server.x509.issuer.distinguished_name level: extended - type: wildcard + type: keyword + ignore_above: 1024 description: Distinguished name (DN) of issuing certificate authority. example: C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA @@ -5161,7 +5247,8 @@ default_field: false - name: server.x509.subject.distinguished_name level: extended - type: wildcard + type: keyword + ignore_above: 1024 description: Distinguished name (DN) of the certificate subject entity. example: C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net default_field: false @@ -5250,7 +5337,8 @@ fields: - name: domain level: extended - type: wildcard + type: keyword + ignore_above: 1024 description: 'Domain of the url, such as "www.elastic.co". In some cases a URL may refer to an IP and/or port directly, without a domain @@ -5284,7 +5372,8 @@ The `#` is not part of the fragment.' - name: full level: extended - type: wildcard + type: keyword + ignore_above: 1024 multi_fields: - name: text type: text @@ -5296,7 +5385,8 @@ example: https://www.elastic.co:443/search?q=elasticsearch#top - name: original level: extended - type: wildcard + type: keyword + ignore_above: 1024 multi_fields: - name: text type: text @@ -5316,7 +5406,8 @@ description: Password of the request. - name: path level: extended - type: wildcard + type: keyword + ignore_above: 1024 description: Path of the request, such as "/search". - name: port level: extended @@ -5337,7 +5428,8 @@ the two cases.' - name: registered_domain level: extended - type: wildcard + type: keyword + ignore_above: 1024 description: 'The highest registered url domain, stripped of the subdomain. For example, the registered domain for "foo.example.com" is "example.com". @@ -5405,12 +5497,14 @@ default_field: false - name: changes.email level: extended - type: wildcard + type: keyword + ignore_above: 1024 description: User email address. default_field: false - name: changes.full_name level: extended - type: wildcard + type: keyword + ignore_above: 1024 multi_fields: - name: text type: text @@ -5456,7 +5550,8 @@ default_field: false - name: changes.name level: core - type: wildcard + type: keyword + ignore_above: 1024 multi_fields: - name: text type: text @@ -5488,12 +5583,14 @@ default_field: false - name: effective.email level: extended - type: wildcard + type: keyword + ignore_above: 1024 description: User email address. default_field: false - name: effective.full_name level: extended - type: wildcard + type: keyword + ignore_above: 1024 multi_fields: - name: text type: text @@ -5539,7 +5636,8 @@ default_field: false - name: effective.name level: core - type: wildcard + type: keyword + ignore_above: 1024 multi_fields: - name: text type: text @@ -5556,11 +5654,13 @@ default_field: false - name: email level: extended - type: wildcard + type: keyword + ignore_above: 1024 description: User email address. - name: full_name level: extended - type: wildcard + type: keyword + ignore_above: 1024 multi_fields: - name: text type: text @@ -5601,7 +5701,8 @@ description: Unique identifier of the user. - name: name level: core - type: wildcard + type: keyword + ignore_above: 1024 multi_fields: - name: text type: text @@ -5626,12 +5727,14 @@ default_field: false - name: target.email level: extended - type: wildcard + type: keyword + ignore_above: 1024 description: User email address. default_field: false - name: target.full_name level: extended - type: wildcard + type: keyword + ignore_above: 1024 multi_fields: - name: text type: text @@ -5677,7 +5780,8 @@ default_field: false - name: target.name level: core - type: wildcard + type: keyword + ignore_above: 1024 multi_fields: - name: text type: text @@ -5714,7 +5818,8 @@ example: Safari - name: original level: extended - type: wildcard + type: keyword + ignore_above: 1024 multi_fields: - name: text type: text @@ -5730,7 +5835,8 @@ example: debian - name: os.full level: extended - type: wildcard + type: keyword + ignore_above: 1024 multi_fields: - name: text type: text @@ -5746,7 +5852,8 @@ example: 4.4.0-112-generic - name: os.name level: extended - type: wildcard + type: keyword + ignore_above: 1024 multi_fields: - name: text type: text @@ -5993,7 +6100,8 @@ default_field: false - name: issuer.distinguished_name level: extended - type: wildcard + type: keyword + ignore_above: 1024 description: Distinguished name (DN) of issuing certificate authority. example: C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA @@ -6099,7 +6207,8 @@ default_field: false - name: subject.distinguished_name level: extended - type: wildcard + type: keyword + ignore_above: 1024 description: Distinguished name (DN) of the certificate subject entity. example: C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net default_field: false diff --git a/generated/csv/fields.csv b/generated/csv/fields.csv index 374aec3e21..cd996051dc 100644 --- a/generated/csv/fields.csv +++ b/generated/csv/fields.csv @@ -3,7 +3,7 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description 1.8.0-dev,true,base,labels,object,core,,"{""application"": ""foo-bar"", ""env"": ""production""}",Custom key/value pairs. 1.8.0-dev,true,base,message,text,core,,Hello World,Log message optimized for viewing in a log viewer. 1.8.0-dev,true,base,tags,keyword,core,array,"[""production"", ""env2""]",List of keywords used to tag each event. -1.8.0-dev,true,agent,agent.build.original,wildcard,core,,"metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]",Extended build information for the agent. +1.8.0-dev,true,agent,agent.build.original,keyword,core,,"metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]",Extended build information for the agent. 1.8.0-dev,true,agent,agent.ephemeral_id,keyword,extended,,8a4f500f,Ephemeral identifier of this agent. 1.8.0-dev,true,agent,agent.id,keyword,core,,8a4f500d,Unique identifier of this agent. 1.8.0-dev,true,agent,agent.name,keyword,core,,foo,Custom name of the agent. @@ -11,16 +11,16 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description 1.8.0-dev,true,agent,agent.version,keyword,core,,6.0.0-rc2,Version of the agent. 1.8.0-dev,true,client,client.address,keyword,extended,,,Client network address. 1.8.0-dev,true,client,client.as.number,long,extended,,15169,Unique number allocated to the autonomous system. -1.8.0-dev,true,client,client.as.organization.name,wildcard,extended,,Google LLC,Organization name. +1.8.0-dev,true,client,client.as.organization.name,keyword,extended,,Google LLC,Organization name. 1.8.0-dev,true,client,client.as.organization.name.text,text,extended,,Google LLC,Organization name. 1.8.0-dev,true,client,client.bytes,long,core,,184,Bytes sent from the client to the server. -1.8.0-dev,true,client,client.domain,wildcard,core,,,Client domain. +1.8.0-dev,true,client,client.domain,keyword,core,,,Client domain. 1.8.0-dev,true,client,client.geo.city_name,keyword,core,,Montreal,City name. 1.8.0-dev,true,client,client.geo.continent_name,keyword,core,,North America,Name of the continent. 1.8.0-dev,true,client,client.geo.country_iso_code,keyword,core,,CA,Country ISO code. 1.8.0-dev,true,client,client.geo.country_name,keyword,core,,Canada,Country name. 1.8.0-dev,true,client,client.geo.location,geo_point,core,,"{ ""lon"": -73.614830, ""lat"": 45.505918 }",Longitude and latitude. -1.8.0-dev,true,client,client.geo.name,wildcard,extended,,boston-dc,User-defined description of a location. +1.8.0-dev,true,client,client.geo.name,keyword,extended,,boston-dc,User-defined description of a location. 1.8.0-dev,true,client,client.geo.region_iso_code,keyword,core,,CA-QC,Region ISO code. 1.8.0-dev,true,client,client.geo.region_name,keyword,core,,Quebec,Region name. 1.8.0-dev,true,client,client.ip,ip,core,,,IP address of the client. @@ -29,19 +29,19 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description 1.8.0-dev,true,client,client.nat.port,long,extended,,,Client NAT port 1.8.0-dev,true,client,client.packets,long,core,,12,Packets sent from the client to the server. 1.8.0-dev,true,client,client.port,long,core,,,Port of the client. -1.8.0-dev,true,client,client.registered_domain,wildcard,extended,,example.com,"The highest registered client domain, stripped of the subdomain." +1.8.0-dev,true,client,client.registered_domain,keyword,extended,,example.com,"The highest registered client domain, stripped of the subdomain." 1.8.0-dev,true,client,client.subdomain,keyword,extended,,east,The subdomain of the domain. 1.8.0-dev,true,client,client.top_level_domain,keyword,extended,,co.uk,"The effective top level domain (com, org, net, co.uk)." 1.8.0-dev,true,client,client.user.domain,keyword,extended,,,Name of the directory the user is a member of. -1.8.0-dev,true,client,client.user.email,wildcard,extended,,,User email address. -1.8.0-dev,true,client,client.user.full_name,wildcard,extended,,Albert Einstein,"User's full name, if available." +1.8.0-dev,true,client,client.user.email,keyword,extended,,,User email address. +1.8.0-dev,true,client,client.user.full_name,keyword,extended,,Albert Einstein,"User's full name, if available." 1.8.0-dev,true,client,client.user.full_name.text,text,extended,,Albert Einstein,"User's full name, if available." 1.8.0-dev,true,client,client.user.group.domain,keyword,extended,,,Name of the directory the group is a member of. 1.8.0-dev,true,client,client.user.group.id,keyword,extended,,,Unique identifier for the group on the system/platform. 1.8.0-dev,true,client,client.user.group.name,keyword,extended,,,Name of the group. 1.8.0-dev,true,client,client.user.hash,keyword,extended,,,Unique user hash to correlate information for a user in anonymized form. 1.8.0-dev,true,client,client.user.id,keyword,core,,,Unique identifier of the user. -1.8.0-dev,true,client,client.user.name,wildcard,core,,albert,Short name or login of the user. +1.8.0-dev,true,client,client.user.name,keyword,core,,albert,Short name or login of the user. 1.8.0-dev,true,client,client.user.name.text,text,core,,albert,Short name or login of the user. 1.8.0-dev,true,client,client.user.roles,keyword,extended,array,"[""kibana_admin"", ""reporting_user""]",Array of user roles at the time of the event. 1.8.0-dev,true,cloud,cloud.account.id,keyword,extended,,666777888999,The cloud account or organization id. @@ -62,16 +62,16 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description 1.8.0-dev,true,container,container.runtime,keyword,extended,,docker,Runtime managing this container. 1.8.0-dev,true,destination,destination.address,keyword,extended,,,Destination network address. 1.8.0-dev,true,destination,destination.as.number,long,extended,,15169,Unique number allocated to the autonomous system. -1.8.0-dev,true,destination,destination.as.organization.name,wildcard,extended,,Google LLC,Organization name. +1.8.0-dev,true,destination,destination.as.organization.name,keyword,extended,,Google LLC,Organization name. 1.8.0-dev,true,destination,destination.as.organization.name.text,text,extended,,Google LLC,Organization name. 1.8.0-dev,true,destination,destination.bytes,long,core,,184,Bytes sent from the destination to the source. -1.8.0-dev,true,destination,destination.domain,wildcard,core,,,Destination domain. +1.8.0-dev,true,destination,destination.domain,keyword,core,,,Destination domain. 1.8.0-dev,true,destination,destination.geo.city_name,keyword,core,,Montreal,City name. 1.8.0-dev,true,destination,destination.geo.continent_name,keyword,core,,North America,Name of the continent. 1.8.0-dev,true,destination,destination.geo.country_iso_code,keyword,core,,CA,Country ISO code. 1.8.0-dev,true,destination,destination.geo.country_name,keyword,core,,Canada,Country name. 1.8.0-dev,true,destination,destination.geo.location,geo_point,core,,"{ ""lon"": -73.614830, ""lat"": 45.505918 }",Longitude and latitude. -1.8.0-dev,true,destination,destination.geo.name,wildcard,extended,,boston-dc,User-defined description of a location. +1.8.0-dev,true,destination,destination.geo.name,keyword,extended,,boston-dc,User-defined description of a location. 1.8.0-dev,true,destination,destination.geo.region_iso_code,keyword,core,,CA-QC,Region ISO code. 1.8.0-dev,true,destination,destination.geo.region_name,keyword,core,,Quebec,Region name. 1.8.0-dev,true,destination,destination.ip,ip,core,,,IP address of the destination. @@ -80,19 +80,19 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description 1.8.0-dev,true,destination,destination.nat.port,long,extended,,,Destination NAT Port 1.8.0-dev,true,destination,destination.packets,long,core,,12,Packets sent from the destination to the source. 1.8.0-dev,true,destination,destination.port,long,core,,,Port of the destination. -1.8.0-dev,true,destination,destination.registered_domain,wildcard,extended,,example.com,"The highest registered destination domain, stripped of the subdomain." +1.8.0-dev,true,destination,destination.registered_domain,keyword,extended,,example.com,"The highest registered destination domain, stripped of the subdomain." 1.8.0-dev,true,destination,destination.subdomain,keyword,extended,,east,The subdomain of the domain. 1.8.0-dev,true,destination,destination.top_level_domain,keyword,extended,,co.uk,"The effective top level domain (com, org, net, co.uk)." 1.8.0-dev,true,destination,destination.user.domain,keyword,extended,,,Name of the directory the user is a member of. -1.8.0-dev,true,destination,destination.user.email,wildcard,extended,,,User email address. -1.8.0-dev,true,destination,destination.user.full_name,wildcard,extended,,Albert Einstein,"User's full name, if available." +1.8.0-dev,true,destination,destination.user.email,keyword,extended,,,User email address. +1.8.0-dev,true,destination,destination.user.full_name,keyword,extended,,Albert Einstein,"User's full name, if available." 1.8.0-dev,true,destination,destination.user.full_name.text,text,extended,,Albert Einstein,"User's full name, if available." 1.8.0-dev,true,destination,destination.user.group.domain,keyword,extended,,,Name of the directory the group is a member of. 1.8.0-dev,true,destination,destination.user.group.id,keyword,extended,,,Unique identifier for the group on the system/platform. 1.8.0-dev,true,destination,destination.user.group.name,keyword,extended,,,Name of the group. 1.8.0-dev,true,destination,destination.user.hash,keyword,extended,,,Unique user hash to correlate information for a user in anonymized form. 1.8.0-dev,true,destination,destination.user.id,keyword,core,,,Unique identifier of the user. -1.8.0-dev,true,destination,destination.user.name,wildcard,core,,albert,Short name or login of the user. +1.8.0-dev,true,destination,destination.user.name,keyword,core,,albert,Short name or login of the user. 1.8.0-dev,true,destination,destination.user.name.text,text,core,,albert,Short name or login of the user. 1.8.0-dev,true,destination,destination.user.roles,keyword,extended,array,"[""kibana_admin"", ""reporting_user""]",Array of user roles at the time of the event. 1.8.0-dev,true,dll,dll.code_signature.exists,boolean,core,,true,Boolean to capture if a signature is present. @@ -111,11 +111,11 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description 1.8.0-dev,true,dll,dll.pe.description,keyword,extended,,Paint,"Internal description of the file, provided at compile-time." 1.8.0-dev,true,dll,dll.pe.file_version,keyword,extended,,6.3.9600.17415,Process name. 1.8.0-dev,true,dll,dll.pe.imphash,keyword,extended,,0c6803c4e922103c4dca5963aad36ddf,A hash of the imports in a PE file. -1.8.0-dev,true,dll,dll.pe.original_file_name,wildcard,extended,,MSPAINT.EXE,"Internal name of the file, provided at compile-time." +1.8.0-dev,true,dll,dll.pe.original_file_name,keyword,extended,,MSPAINT.EXE,"Internal name of the file, provided at compile-time." 1.8.0-dev,true,dll,dll.pe.product,keyword,extended,,Microsoft® Windows® Operating System,"Internal product name of the file, provided at compile-time." 1.8.0-dev,true,dns,dns.answers,object,extended,array,,Array of DNS answers. 1.8.0-dev,true,dns,dns.answers.class,keyword,extended,,IN,The class of DNS data contained in this resource record. -1.8.0-dev,true,dns,dns.answers.data,wildcard,extended,,10.10.10.10,The data describing the resource. +1.8.0-dev,true,dns,dns.answers.data,keyword,extended,,10.10.10.10,The data describing the resource. 1.8.0-dev,true,dns,dns.answers.name,keyword,extended,,www.example.com,The domain name to which this resource record pertains. 1.8.0-dev,true,dns,dns.answers.ttl,long,extended,,180,The time interval in seconds that this resource record may be cached before it should be discarded. 1.8.0-dev,true,dns,dns.answers.type,keyword,extended,,CNAME,The type of data contained in this resource record. @@ -123,7 +123,7 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description 1.8.0-dev,true,dns,dns.id,keyword,extended,,62111,The DNS packet identifier assigned by the program that generated the query. The identifier is copied to the response. 1.8.0-dev,true,dns,dns.op_code,keyword,extended,,QUERY,The DNS operation code that specifies the kind of query in the message. 1.8.0-dev,true,dns,dns.question.class,keyword,extended,,IN,The class of records being queried. -1.8.0-dev,true,dns,dns.question.name,wildcard,extended,,www.example.com,The name being queried. +1.8.0-dev,true,dns,dns.question.name,keyword,extended,,www.example.com,The name being queried. 1.8.0-dev,true,dns,dns.question.registered_domain,keyword,extended,,example.com,"The highest registered domain, stripped of the subdomain." 1.8.0-dev,true,dns,dns.question.subdomain,keyword,extended,,www,The subdomain of the domain. 1.8.0-dev,true,dns,dns.question.top_level_domain,keyword,extended,,co.uk,"The effective top level domain (com, org, net, co.uk)." @@ -135,9 +135,9 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description 1.8.0-dev,true,error,error.code,keyword,core,,,Error code describing the error. 1.8.0-dev,true,error,error.id,keyword,core,,,Unique identifier for the error. 1.8.0-dev,true,error,error.message,text,core,,,Error message. -1.8.0-dev,true,error,error.stack_trace,wildcard,extended,,,The stack trace of this error in plain text. -1.8.0-dev,true,error,error.stack_trace.text,text,extended,,,The stack trace of this error in plain text. -1.8.0-dev,true,error,error.type,wildcard,extended,,java.lang.NullPointerException,"The type of the error, for example the class name of the exception." +1.8.0-dev,false,error,error.stack_trace,keyword,extended,,,The stack trace of this error in plain text. +1.8.0-dev,false,error,error.stack_trace.text,text,extended,,,The stack trace of this error in plain text. +1.8.0-dev,true,error,error.type,keyword,extended,,java.lang.NullPointerException,"The type of the error, for example the class name of the exception." 1.8.0-dev,true,event,event.action,keyword,core,,user-password-change,The action captured by the event. 1.8.0-dev,true,event,event.category,keyword,core,array,authentication,Event category. The second categorization field in the hierarchy. 1.8.0-dev,true,event,event.code,keyword,extended,,4648,Identification code for this event. @@ -173,7 +173,7 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description 1.8.0-dev,true,file,file.created,date,extended,,,File creation time. 1.8.0-dev,true,file,file.ctime,date,extended,,,Last time the file attributes or metadata changed. 1.8.0-dev,true,file,file.device,keyword,extended,,sda,Device that is the source of the file. -1.8.0-dev,true,file,file.directory,wildcard,extended,,/home/alice,Directory where the file is located. +1.8.0-dev,true,file,file.directory,keyword,extended,,/home/alice,Directory where the file is located. 1.8.0-dev,true,file,file.drive_letter,keyword,extended,,C,Drive letter where the file is located. 1.8.0-dev,true,file,file.extension,keyword,extended,,png,"File extension, excluding the leading dot." 1.8.0-dev,true,file,file.gid,keyword,extended,,1001,Primary group ID (GID) of the file. @@ -188,24 +188,24 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description 1.8.0-dev,true,file,file.mtime,date,extended,,,Last time the file content was modified. 1.8.0-dev,true,file,file.name,keyword,extended,,example.png,"Name of the file including the extension, without the directory." 1.8.0-dev,true,file,file.owner,keyword,extended,,alice,File owner's username. -1.8.0-dev,true,file,file.path,wildcard,extended,,/home/alice/example.png,"Full path to the file, including the file name." +1.8.0-dev,true,file,file.path,keyword,extended,,/home/alice/example.png,"Full path to the file, including the file name." 1.8.0-dev,true,file,file.path.text,text,extended,,/home/alice/example.png,"Full path to the file, including the file name." 1.8.0-dev,true,file,file.pe.architecture,keyword,extended,,x64,CPU architecture target for the file. 1.8.0-dev,true,file,file.pe.company,keyword,extended,,Microsoft Corporation,"Internal company name of the file, provided at compile-time." 1.8.0-dev,true,file,file.pe.description,keyword,extended,,Paint,"Internal description of the file, provided at compile-time." 1.8.0-dev,true,file,file.pe.file_version,keyword,extended,,6.3.9600.17415,Process name. 1.8.0-dev,true,file,file.pe.imphash,keyword,extended,,0c6803c4e922103c4dca5963aad36ddf,A hash of the imports in a PE file. -1.8.0-dev,true,file,file.pe.original_file_name,wildcard,extended,,MSPAINT.EXE,"Internal name of the file, provided at compile-time." +1.8.0-dev,true,file,file.pe.original_file_name,keyword,extended,,MSPAINT.EXE,"Internal name of the file, provided at compile-time." 1.8.0-dev,true,file,file.pe.product,keyword,extended,,Microsoft® Windows® Operating System,"Internal product name of the file, provided at compile-time." 1.8.0-dev,true,file,file.size,long,extended,,16384,File size in bytes. -1.8.0-dev,true,file,file.target_path,wildcard,extended,,,Target path for symlinks. +1.8.0-dev,true,file,file.target_path,keyword,extended,,,Target path for symlinks. 1.8.0-dev,true,file,file.target_path.text,text,extended,,,Target path for symlinks. 1.8.0-dev,true,file,file.type,keyword,extended,,file,"File type (file, dir, or symlink)." 1.8.0-dev,true,file,file.uid,keyword,extended,,1001,The user ID (UID) or security identifier (SID) of the file owner. 1.8.0-dev,true,file,file.x509.alternative_names,keyword,extended,array,*.elastic.co,List of subject alternative names (SAN). 1.8.0-dev,true,file,file.x509.issuer.common_name,keyword,extended,array,Example SHA2 High Assurance Server CA,List of common name (CN) of issuing certificate authority. 1.8.0-dev,true,file,file.x509.issuer.country,keyword,extended,array,US,List of country (C) codes -1.8.0-dev,true,file,file.x509.issuer.distinguished_name,wildcard,extended,,"C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA",Distinguished name (DN) of issuing certificate authority. +1.8.0-dev,true,file,file.x509.issuer.distinguished_name,keyword,extended,,"C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA",Distinguished name (DN) of issuing certificate authority. 1.8.0-dev,true,file,file.x509.issuer.locality,keyword,extended,array,Mountain View,List of locality names (L) 1.8.0-dev,true,file,file.x509.issuer.organization,keyword,extended,array,Example Inc,List of organizations (O) of issuing certificate authority. 1.8.0-dev,true,file,file.x509.issuer.organizational_unit,keyword,extended,array,www.example.com,List of organizational units (OU) of issuing certificate authority. @@ -220,7 +220,7 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description 1.8.0-dev,true,file,file.x509.signature_algorithm,keyword,extended,,SHA256-RSA,Identifier for certificate signature algorithm. 1.8.0-dev,true,file,file.x509.subject.common_name,keyword,extended,array,shared.global.example.net,List of common names (CN) of subject. 1.8.0-dev,true,file,file.x509.subject.country,keyword,extended,array,US,List of country (C) code -1.8.0-dev,true,file,file.x509.subject.distinguished_name,wildcard,extended,,"C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net",Distinguished name (DN) of the certificate subject entity. +1.8.0-dev,true,file,file.x509.subject.distinguished_name,keyword,extended,,"C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net",Distinguished name (DN) of the certificate subject entity. 1.8.0-dev,true,file,file.x509.subject.locality,keyword,extended,array,San Francisco,List of locality names (L) 1.8.0-dev,true,file,file.x509.subject.organization,keyword,extended,array,"Example, Inc.",List of organizations (O) of subject. 1.8.0-dev,true,file,file.x509.subject.organizational_unit,keyword,extended,array,,List of organizational units (OU) of subject. @@ -236,19 +236,19 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description 1.8.0-dev,true,host,host.geo.country_iso_code,keyword,core,,CA,Country ISO code. 1.8.0-dev,true,host,host.geo.country_name,keyword,core,,Canada,Country name. 1.8.0-dev,true,host,host.geo.location,geo_point,core,,"{ ""lon"": -73.614830, ""lat"": 45.505918 }",Longitude and latitude. -1.8.0-dev,true,host,host.geo.name,wildcard,extended,,boston-dc,User-defined description of a location. +1.8.0-dev,true,host,host.geo.name,keyword,extended,,boston-dc,User-defined description of a location. 1.8.0-dev,true,host,host.geo.region_iso_code,keyword,core,,CA-QC,Region ISO code. 1.8.0-dev,true,host,host.geo.region_name,keyword,core,,Quebec,Region name. -1.8.0-dev,true,host,host.hostname,wildcard,core,,,Hostname of the host. +1.8.0-dev,true,host,host.hostname,keyword,core,,,Hostname of the host. 1.8.0-dev,true,host,host.id,keyword,core,,,Unique host id. 1.8.0-dev,true,host,host.ip,ip,core,array,,Host ip addresses. 1.8.0-dev,true,host,host.mac,keyword,core,array,,Host mac addresses. 1.8.0-dev,true,host,host.name,keyword,core,,,Name of the host. 1.8.0-dev,true,host,host.os.family,keyword,extended,,debian,"OS family (such as redhat, debian, freebsd, windows)." -1.8.0-dev,true,host,host.os.full,wildcard,extended,,Mac OS Mojave,"Operating system name, including the version or code name." +1.8.0-dev,true,host,host.os.full,keyword,extended,,Mac OS Mojave,"Operating system name, including the version or code name." 1.8.0-dev,true,host,host.os.full.text,text,extended,,Mac OS Mojave,"Operating system name, including the version or code name." 1.8.0-dev,true,host,host.os.kernel,keyword,extended,,4.4.0-112-generic,Operating system kernel version as a raw string. -1.8.0-dev,true,host,host.os.name,wildcard,extended,,Mac OS X,"Operating system name, without the version." +1.8.0-dev,true,host,host.os.name,keyword,extended,,Mac OS X,"Operating system name, without the version." 1.8.0-dev,true,host,host.os.name.text,text,extended,,Mac OS X,"Operating system name, without the version." 1.8.0-dev,true,host,host.os.platform,keyword,extended,,darwin,"Operating system platform (such centos, ubuntu, windows)." 1.8.0-dev,true,host,host.os.type,keyword,extended,,macos,"Which commercial OS family (one of: linux, macos, unix or windows)." @@ -256,34 +256,34 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description 1.8.0-dev,true,host,host.type,keyword,core,,,Type of host. 1.8.0-dev,true,host,host.uptime,long,extended,,1325,Seconds the host has been up. 1.8.0-dev,true,host,host.user.domain,keyword,extended,,,Name of the directory the user is a member of. -1.8.0-dev,true,host,host.user.email,wildcard,extended,,,User email address. -1.8.0-dev,true,host,host.user.full_name,wildcard,extended,,Albert Einstein,"User's full name, if available." +1.8.0-dev,true,host,host.user.email,keyword,extended,,,User email address. +1.8.0-dev,true,host,host.user.full_name,keyword,extended,,Albert Einstein,"User's full name, if available." 1.8.0-dev,true,host,host.user.full_name.text,text,extended,,Albert Einstein,"User's full name, if available." 1.8.0-dev,true,host,host.user.group.domain,keyword,extended,,,Name of the directory the group is a member of. 1.8.0-dev,true,host,host.user.group.id,keyword,extended,,,Unique identifier for the group on the system/platform. 1.8.0-dev,true,host,host.user.group.name,keyword,extended,,,Name of the group. 1.8.0-dev,true,host,host.user.hash,keyword,extended,,,Unique user hash to correlate information for a user in anonymized form. 1.8.0-dev,true,host,host.user.id,keyword,core,,,Unique identifier of the user. -1.8.0-dev,true,host,host.user.name,wildcard,core,,albert,Short name or login of the user. +1.8.0-dev,true,host,host.user.name,keyword,core,,albert,Short name or login of the user. 1.8.0-dev,true,host,host.user.name.text,text,core,,albert,Short name or login of the user. 1.8.0-dev,true,host,host.user.roles,keyword,extended,array,"[""kibana_admin"", ""reporting_user""]",Array of user roles at the time of the event. 1.8.0-dev,true,http,http.request.body.bytes,long,extended,,887,Size in bytes of the request body. -1.8.0-dev,true,http,http.request.body.content,wildcard,extended,,Hello world,The full HTTP request body. +1.8.0-dev,true,http,http.request.body.content,keyword,extended,,Hello world,The full HTTP request body. 1.8.0-dev,true,http,http.request.body.content.text,text,extended,,Hello world,The full HTTP request body. 1.8.0-dev,true,http,http.request.bytes,long,extended,,1437,Total size in bytes of the request (body and headers). 1.8.0-dev,true,http,http.request.method,keyword,extended,,"GET, POST, PUT, PoST",HTTP request method. 1.8.0-dev,true,http,http.request.mime_type,keyword,extended,,image/gif,Mime type of the body of the request. -1.8.0-dev,true,http,http.request.referrer,wildcard,extended,,https://blog.example.com/,Referrer for this HTTP request. +1.8.0-dev,true,http,http.request.referrer,keyword,extended,,https://blog.example.com/,Referrer for this HTTP request. 1.8.0-dev,true,http,http.response.body.bytes,long,extended,,887,Size in bytes of the response body. -1.8.0-dev,true,http,http.response.body.content,wildcard,extended,,Hello world,The full HTTP response body. +1.8.0-dev,true,http,http.response.body.content,keyword,extended,,Hello world,The full HTTP response body. 1.8.0-dev,true,http,http.response.body.content.text,text,extended,,Hello world,The full HTTP response body. 1.8.0-dev,true,http,http.response.bytes,long,extended,,1437,Total size in bytes of the response (body and headers). 1.8.0-dev,true,http,http.response.mime_type,keyword,extended,,image/gif,Mime type of the body of the response. 1.8.0-dev,true,http,http.response.status_code,long,extended,,404,HTTP response status code. 1.8.0-dev,true,http,http.version,keyword,extended,,1.1,HTTP version. -1.8.0-dev,true,log,log.file.path,wildcard,extended,,/var/log/fun-times.log,Full path to the log file this event came from. +1.8.0-dev,true,log,log.file.path,keyword,extended,,/var/log/fun-times.log,Full path to the log file this event came from. 1.8.0-dev,true,log,log.level,keyword,core,,error,Log level of the log event. -1.8.0-dev,true,log,log.logger,wildcard,core,,org.elasticsearch.bootstrap.Bootstrap,Name of the logger. +1.8.0-dev,true,log,log.logger,keyword,core,,org.elasticsearch.bootstrap.Bootstrap,Name of the logger. 1.8.0-dev,true,log,log.origin.file.line,integer,extended,,42,The line number of the file which originated the log event. 1.8.0-dev,true,log,log.origin.file.name,keyword,extended,,Bootstrap.java,The code file which originated the log event. 1.8.0-dev,true,log,log.origin.function,keyword,extended,,init,The function which originated the log event. @@ -322,7 +322,7 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description 1.8.0-dev,true,observer,observer.geo.country_iso_code,keyword,core,,CA,Country ISO code. 1.8.0-dev,true,observer,observer.geo.country_name,keyword,core,,Canada,Country name. 1.8.0-dev,true,observer,observer.geo.location,geo_point,core,,"{ ""lon"": -73.614830, ""lat"": 45.505918 }",Longitude and latitude. -1.8.0-dev,true,observer,observer.geo.name,wildcard,extended,,boston-dc,User-defined description of a location. +1.8.0-dev,true,observer,observer.geo.name,keyword,extended,,boston-dc,User-defined description of a location. 1.8.0-dev,true,observer,observer.geo.region_iso_code,keyword,core,,CA-QC,Region ISO code. 1.8.0-dev,true,observer,observer.geo.region_name,keyword,core,,Quebec,Region name. 1.8.0-dev,true,observer,observer.hostname,keyword,core,,,Hostname of the observer. @@ -337,10 +337,10 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description 1.8.0-dev,true,observer,observer.mac,keyword,core,array,,MAC addresses of the observer 1.8.0-dev,true,observer,observer.name,keyword,extended,,1_proxySG,Custom name of the observer. 1.8.0-dev,true,observer,observer.os.family,keyword,extended,,debian,"OS family (such as redhat, debian, freebsd, windows)." -1.8.0-dev,true,observer,observer.os.full,wildcard,extended,,Mac OS Mojave,"Operating system name, including the version or code name." +1.8.0-dev,true,observer,observer.os.full,keyword,extended,,Mac OS Mojave,"Operating system name, including the version or code name." 1.8.0-dev,true,observer,observer.os.full.text,text,extended,,Mac OS Mojave,"Operating system name, including the version or code name." 1.8.0-dev,true,observer,observer.os.kernel,keyword,extended,,4.4.0-112-generic,Operating system kernel version as a raw string. -1.8.0-dev,true,observer,observer.os.name,wildcard,extended,,Mac OS X,"Operating system name, without the version." +1.8.0-dev,true,observer,observer.os.name,keyword,extended,,Mac OS X,"Operating system name, without the version." 1.8.0-dev,true,observer,observer.os.name.text,text,extended,,Mac OS X,"Operating system name, without the version." 1.8.0-dev,true,observer,observer.os.platform,keyword,extended,,darwin,"Operating system platform (such centos, ubuntu, windows)." 1.8.0-dev,true,observer,observer.os.type,keyword,extended,,macos,"Which commercial OS family (one of: linux, macos, unix or windows)." @@ -351,7 +351,7 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description 1.8.0-dev,true,observer,observer.vendor,keyword,core,,Symantec,Vendor name of the observer. 1.8.0-dev,true,observer,observer.version,keyword,core,,,Observer version. 1.8.0-dev,true,organization,organization.id,keyword,extended,,,Unique identifier for the organization. -1.8.0-dev,true,organization,organization.name,wildcard,extended,,,Organization name. +1.8.0-dev,true,organization,organization.name,keyword,extended,,,Organization name. 1.8.0-dev,true,organization,organization.name.text,text,extended,,,Organization name. 1.8.0-dev,true,package,package.architecture,keyword,extended,,x86_64,Package architecture. 1.8.0-dev,true,package,package.build_version,keyword,extended,,36f4f7e89dd61b0988b12ee000b98966867710cd,Build version information @@ -373,17 +373,17 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description 1.8.0-dev,true,process,process.code_signature.subject_name,keyword,core,,Microsoft Corporation,Subject name of the code signer 1.8.0-dev,true,process,process.code_signature.trusted,boolean,extended,,true,Stores the trust status of the certificate chain. 1.8.0-dev,true,process,process.code_signature.valid,boolean,extended,,true,Boolean to capture if the digital signature is verified against the binary content. -1.8.0-dev,true,process,process.command_line,wildcard,extended,,/usr/bin/ssh -l user 10.0.0.16,Full command line that started the process. +1.8.0-dev,true,process,process.command_line,keyword,extended,,/usr/bin/ssh -l user 10.0.0.16,Full command line that started the process. 1.8.0-dev,true,process,process.command_line.text,text,extended,,/usr/bin/ssh -l user 10.0.0.16,Full command line that started the process. 1.8.0-dev,true,process,process.entity_id,keyword,extended,,c2c455d9f99375d,Unique identifier for the process. -1.8.0-dev,true,process,process.executable,wildcard,extended,,/usr/bin/ssh,Absolute path to the process executable. +1.8.0-dev,true,process,process.executable,keyword,extended,,/usr/bin/ssh,Absolute path to the process executable. 1.8.0-dev,true,process,process.executable.text,text,extended,,/usr/bin/ssh,Absolute path to the process executable. 1.8.0-dev,true,process,process.exit_code,long,extended,,137,The exit code of the process. 1.8.0-dev,true,process,process.hash.md5,keyword,extended,,,MD5 hash. 1.8.0-dev,true,process,process.hash.sha1,keyword,extended,,,SHA1 hash. 1.8.0-dev,true,process,process.hash.sha256,keyword,extended,,,SHA256 hash. 1.8.0-dev,true,process,process.hash.sha512,keyword,extended,,,SHA512 hash. -1.8.0-dev,true,process,process.name,wildcard,extended,,ssh,Process name. +1.8.0-dev,true,process,process.name,keyword,extended,,ssh,Process name. 1.8.0-dev,true,process,process.name.text,text,extended,,ssh,Process name. 1.8.0-dev,true,process,process.parent.args,keyword,extended,array,"[""/usr/bin/ssh"", ""-l"", ""user"", ""10.0.0.16""]",Array of process arguments. 1.8.0-dev,true,process,process.parent.args_count,long,extended,,4,Length of the process.args array. @@ -392,60 +392,60 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description 1.8.0-dev,true,process,process.parent.code_signature.subject_name,keyword,core,,Microsoft Corporation,Subject name of the code signer 1.8.0-dev,true,process,process.parent.code_signature.trusted,boolean,extended,,true,Stores the trust status of the certificate chain. 1.8.0-dev,true,process,process.parent.code_signature.valid,boolean,extended,,true,Boolean to capture if the digital signature is verified against the binary content. -1.8.0-dev,true,process,process.parent.command_line,wildcard,extended,,/usr/bin/ssh -l user 10.0.0.16,Full command line that started the process. +1.8.0-dev,true,process,process.parent.command_line,keyword,extended,,/usr/bin/ssh -l user 10.0.0.16,Full command line that started the process. 1.8.0-dev,true,process,process.parent.command_line.text,text,extended,,/usr/bin/ssh -l user 10.0.0.16,Full command line that started the process. 1.8.0-dev,true,process,process.parent.entity_id,keyword,extended,,c2c455d9f99375d,Unique identifier for the process. -1.8.0-dev,true,process,process.parent.executable,wildcard,extended,,/usr/bin/ssh,Absolute path to the process executable. +1.8.0-dev,true,process,process.parent.executable,keyword,extended,,/usr/bin/ssh,Absolute path to the process executable. 1.8.0-dev,true,process,process.parent.executable.text,text,extended,,/usr/bin/ssh,Absolute path to the process executable. 1.8.0-dev,true,process,process.parent.exit_code,long,extended,,137,The exit code of the process. 1.8.0-dev,true,process,process.parent.hash.md5,keyword,extended,,,MD5 hash. 1.8.0-dev,true,process,process.parent.hash.sha1,keyword,extended,,,SHA1 hash. 1.8.0-dev,true,process,process.parent.hash.sha256,keyword,extended,,,SHA256 hash. 1.8.0-dev,true,process,process.parent.hash.sha512,keyword,extended,,,SHA512 hash. -1.8.0-dev,true,process,process.parent.name,wildcard,extended,,ssh,Process name. +1.8.0-dev,true,process,process.parent.name,keyword,extended,,ssh,Process name. 1.8.0-dev,true,process,process.parent.name.text,text,extended,,ssh,Process name. 1.8.0-dev,true,process,process.parent.pe.architecture,keyword,extended,,x64,CPU architecture target for the file. 1.8.0-dev,true,process,process.parent.pe.company,keyword,extended,,Microsoft Corporation,"Internal company name of the file, provided at compile-time." 1.8.0-dev,true,process,process.parent.pe.description,keyword,extended,,Paint,"Internal description of the file, provided at compile-time." 1.8.0-dev,true,process,process.parent.pe.file_version,keyword,extended,,6.3.9600.17415,Process name. 1.8.0-dev,true,process,process.parent.pe.imphash,keyword,extended,,0c6803c4e922103c4dca5963aad36ddf,A hash of the imports in a PE file. -1.8.0-dev,true,process,process.parent.pe.original_file_name,wildcard,extended,,MSPAINT.EXE,"Internal name of the file, provided at compile-time." +1.8.0-dev,true,process,process.parent.pe.original_file_name,keyword,extended,,MSPAINT.EXE,"Internal name of the file, provided at compile-time." 1.8.0-dev,true,process,process.parent.pe.product,keyword,extended,,Microsoft® Windows® Operating System,"Internal product name of the file, provided at compile-time." 1.8.0-dev,true,process,process.parent.pgid,long,extended,,,Identifier of the group of processes the process belongs to. 1.8.0-dev,true,process,process.parent.pid,long,core,,4242,Process id. 1.8.0-dev,true,process,process.parent.ppid,long,extended,,4241,Parent process' pid. 1.8.0-dev,true,process,process.parent.start,date,extended,,2016-05-23T08:05:34.853Z,The time the process started. 1.8.0-dev,true,process,process.parent.thread.id,long,extended,,4242,Thread ID. -1.8.0-dev,true,process,process.parent.thread.name,wildcard,extended,,thread-0,Thread name. -1.8.0-dev,true,process,process.parent.title,wildcard,extended,,,Process title. +1.8.0-dev,true,process,process.parent.thread.name,keyword,extended,,thread-0,Thread name. +1.8.0-dev,true,process,process.parent.title,keyword,extended,,,Process title. 1.8.0-dev,true,process,process.parent.title.text,text,extended,,,Process title. 1.8.0-dev,true,process,process.parent.uptime,long,extended,,1325,Seconds the process has been up. -1.8.0-dev,true,process,process.parent.working_directory,wildcard,extended,,/home/alice,The working directory of the process. +1.8.0-dev,true,process,process.parent.working_directory,keyword,extended,,/home/alice,The working directory of the process. 1.8.0-dev,true,process,process.parent.working_directory.text,text,extended,,/home/alice,The working directory of the process. 1.8.0-dev,true,process,process.pe.architecture,keyword,extended,,x64,CPU architecture target for the file. 1.8.0-dev,true,process,process.pe.company,keyword,extended,,Microsoft Corporation,"Internal company name of the file, provided at compile-time." 1.8.0-dev,true,process,process.pe.description,keyword,extended,,Paint,"Internal description of the file, provided at compile-time." 1.8.0-dev,true,process,process.pe.file_version,keyword,extended,,6.3.9600.17415,Process name. 1.8.0-dev,true,process,process.pe.imphash,keyword,extended,,0c6803c4e922103c4dca5963aad36ddf,A hash of the imports in a PE file. -1.8.0-dev,true,process,process.pe.original_file_name,wildcard,extended,,MSPAINT.EXE,"Internal name of the file, provided at compile-time." +1.8.0-dev,true,process,process.pe.original_file_name,keyword,extended,,MSPAINT.EXE,"Internal name of the file, provided at compile-time." 1.8.0-dev,true,process,process.pe.product,keyword,extended,,Microsoft® Windows® Operating System,"Internal product name of the file, provided at compile-time." 1.8.0-dev,true,process,process.pgid,long,extended,,,Identifier of the group of processes the process belongs to. 1.8.0-dev,true,process,process.pid,long,core,,4242,Process id. 1.8.0-dev,true,process,process.ppid,long,extended,,4241,Parent process' pid. 1.8.0-dev,true,process,process.start,date,extended,,2016-05-23T08:05:34.853Z,The time the process started. 1.8.0-dev,true,process,process.thread.id,long,extended,,4242,Thread ID. -1.8.0-dev,true,process,process.thread.name,wildcard,extended,,thread-0,Thread name. -1.8.0-dev,true,process,process.title,wildcard,extended,,,Process title. +1.8.0-dev,true,process,process.thread.name,keyword,extended,,thread-0,Thread name. +1.8.0-dev,true,process,process.title,keyword,extended,,,Process title. 1.8.0-dev,true,process,process.title.text,text,extended,,,Process title. 1.8.0-dev,true,process,process.uptime,long,extended,,1325,Seconds the process has been up. -1.8.0-dev,true,process,process.working_directory,wildcard,extended,,/home/alice,The working directory of the process. +1.8.0-dev,true,process,process.working_directory,keyword,extended,,/home/alice,The working directory of the process. 1.8.0-dev,true,process,process.working_directory.text,text,extended,,/home/alice,The working directory of the process. 1.8.0-dev,true,registry,registry.data.bytes,keyword,extended,,ZQBuAC0AVQBTAAAAZQBuAAAAAAA=,Original bytes written with base64 encoding. -1.8.0-dev,true,registry,registry.data.strings,wildcard,core,array,"[""C:\rta\red_ttp\bin\myapp.exe""]",List of strings representing what was written to the registry. +1.8.0-dev,true,registry,registry.data.strings,keyword,core,array,"[""C:\rta\red_ttp\bin\myapp.exe""]",List of strings representing what was written to the registry. 1.8.0-dev,true,registry,registry.data.type,keyword,core,,REG_SZ,Standard registry type for encoding contents 1.8.0-dev,true,registry,registry.hive,keyword,core,,HKLM,Abbreviated name for the hive. -1.8.0-dev,true,registry,registry.key,wildcard,core,,SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe,Hive-relative path of keys. -1.8.0-dev,true,registry,registry.path,wildcard,core,,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe\Debugger,"Full path, including hive, key and value" +1.8.0-dev,true,registry,registry.key,keyword,core,,SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe,Hive-relative path of keys. +1.8.0-dev,true,registry,registry.path,keyword,core,,HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe\Debugger,"Full path, including hive, key and value" 1.8.0-dev,true,registry,registry.value,keyword,core,,Debugger,Name of the value written. 1.8.0-dev,true,related,related.hash,keyword,extended,array,,All the hashes seen on your event. 1.8.0-dev,true,related,related.hosts,keyword,extended,array,,All the host identifiers seen on your event. @@ -463,16 +463,16 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description 1.8.0-dev,true,rule,rule.version,keyword,extended,,1.1,Rule version 1.8.0-dev,true,server,server.address,keyword,extended,,,Server network address. 1.8.0-dev,true,server,server.as.number,long,extended,,15169,Unique number allocated to the autonomous system. -1.8.0-dev,true,server,server.as.organization.name,wildcard,extended,,Google LLC,Organization name. +1.8.0-dev,true,server,server.as.organization.name,keyword,extended,,Google LLC,Organization name. 1.8.0-dev,true,server,server.as.organization.name.text,text,extended,,Google LLC,Organization name. 1.8.0-dev,true,server,server.bytes,long,core,,184,Bytes sent from the server to the client. -1.8.0-dev,true,server,server.domain,wildcard,core,,,Server domain. +1.8.0-dev,true,server,server.domain,keyword,core,,,Server domain. 1.8.0-dev,true,server,server.geo.city_name,keyword,core,,Montreal,City name. 1.8.0-dev,true,server,server.geo.continent_name,keyword,core,,North America,Name of the continent. 1.8.0-dev,true,server,server.geo.country_iso_code,keyword,core,,CA,Country ISO code. 1.8.0-dev,true,server,server.geo.country_name,keyword,core,,Canada,Country name. 1.8.0-dev,true,server,server.geo.location,geo_point,core,,"{ ""lon"": -73.614830, ""lat"": 45.505918 }",Longitude and latitude. -1.8.0-dev,true,server,server.geo.name,wildcard,extended,,boston-dc,User-defined description of a location. +1.8.0-dev,true,server,server.geo.name,keyword,extended,,boston-dc,User-defined description of a location. 1.8.0-dev,true,server,server.geo.region_iso_code,keyword,core,,CA-QC,Region ISO code. 1.8.0-dev,true,server,server.geo.region_name,keyword,core,,Quebec,Region name. 1.8.0-dev,true,server,server.ip,ip,core,,,IP address of the server. @@ -481,19 +481,19 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description 1.8.0-dev,true,server,server.nat.port,long,extended,,,Server NAT port 1.8.0-dev,true,server,server.packets,long,core,,12,Packets sent from the server to the client. 1.8.0-dev,true,server,server.port,long,core,,,Port of the server. -1.8.0-dev,true,server,server.registered_domain,wildcard,extended,,example.com,"The highest registered server domain, stripped of the subdomain." +1.8.0-dev,true,server,server.registered_domain,keyword,extended,,example.com,"The highest registered server domain, stripped of the subdomain." 1.8.0-dev,true,server,server.subdomain,keyword,extended,,east,The subdomain of the domain. 1.8.0-dev,true,server,server.top_level_domain,keyword,extended,,co.uk,"The effective top level domain (com, org, net, co.uk)." 1.8.0-dev,true,server,server.user.domain,keyword,extended,,,Name of the directory the user is a member of. -1.8.0-dev,true,server,server.user.email,wildcard,extended,,,User email address. -1.8.0-dev,true,server,server.user.full_name,wildcard,extended,,Albert Einstein,"User's full name, if available." +1.8.0-dev,true,server,server.user.email,keyword,extended,,,User email address. +1.8.0-dev,true,server,server.user.full_name,keyword,extended,,Albert Einstein,"User's full name, if available." 1.8.0-dev,true,server,server.user.full_name.text,text,extended,,Albert Einstein,"User's full name, if available." 1.8.0-dev,true,server,server.user.group.domain,keyword,extended,,,Name of the directory the group is a member of. 1.8.0-dev,true,server,server.user.group.id,keyword,extended,,,Unique identifier for the group on the system/platform. 1.8.0-dev,true,server,server.user.group.name,keyword,extended,,,Name of the group. 1.8.0-dev,true,server,server.user.hash,keyword,extended,,,Unique user hash to correlate information for a user in anonymized form. 1.8.0-dev,true,server,server.user.id,keyword,core,,,Unique identifier of the user. -1.8.0-dev,true,server,server.user.name,wildcard,core,,albert,Short name or login of the user. +1.8.0-dev,true,server,server.user.name,keyword,core,,albert,Short name or login of the user. 1.8.0-dev,true,server,server.user.name.text,text,core,,albert,Short name or login of the user. 1.8.0-dev,true,server,server.user.roles,keyword,extended,array,"[""kibana_admin"", ""reporting_user""]",Array of user roles at the time of the event. 1.8.0-dev,true,service,service.ephemeral_id,keyword,extended,,8a4f500f,Ephemeral identifier of this service. @@ -505,16 +505,16 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description 1.8.0-dev,true,service,service.version,keyword,core,,3.2.4,Version of the service. 1.8.0-dev,true,source,source.address,keyword,extended,,,Source network address. 1.8.0-dev,true,source,source.as.number,long,extended,,15169,Unique number allocated to the autonomous system. -1.8.0-dev,true,source,source.as.organization.name,wildcard,extended,,Google LLC,Organization name. +1.8.0-dev,true,source,source.as.organization.name,keyword,extended,,Google LLC,Organization name. 1.8.0-dev,true,source,source.as.organization.name.text,text,extended,,Google LLC,Organization name. 1.8.0-dev,true,source,source.bytes,long,core,,184,Bytes sent from the source to the destination. -1.8.0-dev,true,source,source.domain,wildcard,core,,,Source domain. +1.8.0-dev,true,source,source.domain,keyword,core,,,Source domain. 1.8.0-dev,true,source,source.geo.city_name,keyword,core,,Montreal,City name. 1.8.0-dev,true,source,source.geo.continent_name,keyword,core,,North America,Name of the continent. 1.8.0-dev,true,source,source.geo.country_iso_code,keyword,core,,CA,Country ISO code. 1.8.0-dev,true,source,source.geo.country_name,keyword,core,,Canada,Country name. 1.8.0-dev,true,source,source.geo.location,geo_point,core,,"{ ""lon"": -73.614830, ""lat"": 45.505918 }",Longitude and latitude. -1.8.0-dev,true,source,source.geo.name,wildcard,extended,,boston-dc,User-defined description of a location. +1.8.0-dev,true,source,source.geo.name,keyword,extended,,boston-dc,User-defined description of a location. 1.8.0-dev,true,source,source.geo.region_iso_code,keyword,core,,CA-QC,Region ISO code. 1.8.0-dev,true,source,source.geo.region_name,keyword,core,,Quebec,Region name. 1.8.0-dev,true,source,source.ip,ip,core,,,IP address of the source. @@ -523,19 +523,19 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description 1.8.0-dev,true,source,source.nat.port,long,extended,,,Source NAT port 1.8.0-dev,true,source,source.packets,long,core,,12,Packets sent from the source to the destination. 1.8.0-dev,true,source,source.port,long,core,,,Port of the source. -1.8.0-dev,true,source,source.registered_domain,wildcard,extended,,example.com,"The highest registered source domain, stripped of the subdomain." +1.8.0-dev,true,source,source.registered_domain,keyword,extended,,example.com,"The highest registered source domain, stripped of the subdomain." 1.8.0-dev,true,source,source.subdomain,keyword,extended,,east,The subdomain of the domain. 1.8.0-dev,true,source,source.top_level_domain,keyword,extended,,co.uk,"The effective top level domain (com, org, net, co.uk)." 1.8.0-dev,true,source,source.user.domain,keyword,extended,,,Name of the directory the user is a member of. -1.8.0-dev,true,source,source.user.email,wildcard,extended,,,User email address. -1.8.0-dev,true,source,source.user.full_name,wildcard,extended,,Albert Einstein,"User's full name, if available." +1.8.0-dev,true,source,source.user.email,keyword,extended,,,User email address. +1.8.0-dev,true,source,source.user.full_name,keyword,extended,,Albert Einstein,"User's full name, if available." 1.8.0-dev,true,source,source.user.full_name.text,text,extended,,Albert Einstein,"User's full name, if available." 1.8.0-dev,true,source,source.user.group.domain,keyword,extended,,,Name of the directory the group is a member of. 1.8.0-dev,true,source,source.user.group.id,keyword,extended,,,Unique identifier for the group on the system/platform. 1.8.0-dev,true,source,source.user.group.name,keyword,extended,,,Name of the group. 1.8.0-dev,true,source,source.user.hash,keyword,extended,,,Unique user hash to correlate information for a user in anonymized form. 1.8.0-dev,true,source,source.user.id,keyword,core,,,Unique identifier of the user. -1.8.0-dev,true,source,source.user.name,wildcard,core,,albert,Short name or login of the user. +1.8.0-dev,true,source,source.user.name,keyword,core,,albert,Short name or login of the user. 1.8.0-dev,true,source,source.user.name.text,text,core,,albert,Short name or login of the user. 1.8.0-dev,true,source,source.user.roles,keyword,extended,array,"[""kibana_admin"", ""reporting_user""]",Array of user roles at the time of the event. 1.8.0-dev,true,span,span.id,keyword,extended,,3ff9a8981b7ccd5a,Unique identifier of the span within the scope of its trace. @@ -557,17 +557,17 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description 1.8.0-dev,true,tls,tls.client.hash.md5,keyword,extended,,0F76C7F2C55BFD7D8E8B8F4BFBF0C9EC,Certificate fingerprint using the MD5 digest of DER-encoded version of certificate offered by the client. 1.8.0-dev,true,tls,tls.client.hash.sha1,keyword,extended,,9E393D93138888D288266C2D915214D1D1CCEB2A,Certificate fingerprint using the SHA1 digest of DER-encoded version of certificate offered by the client. 1.8.0-dev,true,tls,tls.client.hash.sha256,keyword,extended,,0687F666A054EF17A08E2F2162EAB4CBC0D265E1D7875BE74BF3C712CA92DAF0,Certificate fingerprint using the SHA256 digest of DER-encoded version of certificate offered by the client. -1.8.0-dev,true,tls,tls.client.issuer,wildcard,extended,,"CN=Example Root CA, OU=Infrastructure Team, DC=example, DC=com",Distinguished name of subject of the issuer of the x.509 certificate presented by the client. +1.8.0-dev,true,tls,tls.client.issuer,keyword,extended,,"CN=Example Root CA, OU=Infrastructure Team, DC=example, DC=com",Distinguished name of subject of the issuer of the x.509 certificate presented by the client. 1.8.0-dev,true,tls,tls.client.ja3,keyword,extended,,d4e5b18d6b55c71272893221c96ba240,A hash that identifies clients based on how they perform an SSL/TLS handshake. 1.8.0-dev,true,tls,tls.client.not_after,date,extended,,2021-01-01T00:00:00.000Z,Date/Time indicating when client certificate is no longer considered valid. 1.8.0-dev,true,tls,tls.client.not_before,date,extended,,1970-01-01T00:00:00.000Z,Date/Time indicating when client certificate is first considered valid. 1.8.0-dev,true,tls,tls.client.server_name,keyword,extended,,www.elastic.co,Hostname the client is trying to connect to. Also called the SNI. -1.8.0-dev,true,tls,tls.client.subject,wildcard,extended,,"CN=myclient, OU=Documentation Team, DC=example, DC=com",Distinguished name of subject of the x.509 certificate presented by the client. +1.8.0-dev,true,tls,tls.client.subject,keyword,extended,,"CN=myclient, OU=Documentation Team, DC=example, DC=com",Distinguished name of subject of the x.509 certificate presented by the client. 1.8.0-dev,true,tls,tls.client.supported_ciphers,keyword,extended,array,"[""TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"", ""TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"", ""...""]",Array of ciphers offered by the client during the client hello. 1.8.0-dev,true,tls,tls.client.x509.alternative_names,keyword,extended,array,*.elastic.co,List of subject alternative names (SAN). 1.8.0-dev,true,tls,tls.client.x509.issuer.common_name,keyword,extended,array,Example SHA2 High Assurance Server CA,List of common name (CN) of issuing certificate authority. 1.8.0-dev,true,tls,tls.client.x509.issuer.country,keyword,extended,array,US,List of country (C) codes -1.8.0-dev,true,tls,tls.client.x509.issuer.distinguished_name,wildcard,extended,,"C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA",Distinguished name (DN) of issuing certificate authority. +1.8.0-dev,true,tls,tls.client.x509.issuer.distinguished_name,keyword,extended,,"C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA",Distinguished name (DN) of issuing certificate authority. 1.8.0-dev,true,tls,tls.client.x509.issuer.locality,keyword,extended,array,Mountain View,List of locality names (L) 1.8.0-dev,true,tls,tls.client.x509.issuer.organization,keyword,extended,array,Example Inc,List of organizations (O) of issuing certificate authority. 1.8.0-dev,true,tls,tls.client.x509.issuer.organizational_unit,keyword,extended,array,www.example.com,List of organizational units (OU) of issuing certificate authority. @@ -582,7 +582,7 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description 1.8.0-dev,true,tls,tls.client.x509.signature_algorithm,keyword,extended,,SHA256-RSA,Identifier for certificate signature algorithm. 1.8.0-dev,true,tls,tls.client.x509.subject.common_name,keyword,extended,array,shared.global.example.net,List of common names (CN) of subject. 1.8.0-dev,true,tls,tls.client.x509.subject.country,keyword,extended,array,US,List of country (C) code -1.8.0-dev,true,tls,tls.client.x509.subject.distinguished_name,wildcard,extended,,"C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net",Distinguished name (DN) of the certificate subject entity. +1.8.0-dev,true,tls,tls.client.x509.subject.distinguished_name,keyword,extended,,"C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net",Distinguished name (DN) of the certificate subject entity. 1.8.0-dev,true,tls,tls.client.x509.subject.locality,keyword,extended,array,San Francisco,List of locality names (L) 1.8.0-dev,true,tls,tls.client.x509.subject.organization,keyword,extended,array,"Example, Inc.",List of organizations (O) of subject. 1.8.0-dev,true,tls,tls.client.x509.subject.organizational_unit,keyword,extended,array,,List of organizational units (OU) of subject. @@ -597,15 +597,15 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description 1.8.0-dev,true,tls,tls.server.hash.md5,keyword,extended,,0F76C7F2C55BFD7D8E8B8F4BFBF0C9EC,Certificate fingerprint using the MD5 digest of DER-encoded version of certificate offered by the server. 1.8.0-dev,true,tls,tls.server.hash.sha1,keyword,extended,,9E393D93138888D288266C2D915214D1D1CCEB2A,Certificate fingerprint using the SHA1 digest of DER-encoded version of certificate offered by the server. 1.8.0-dev,true,tls,tls.server.hash.sha256,keyword,extended,,0687F666A054EF17A08E2F2162EAB4CBC0D265E1D7875BE74BF3C712CA92DAF0,Certificate fingerprint using the SHA256 digest of DER-encoded version of certificate offered by the server. -1.8.0-dev,true,tls,tls.server.issuer,wildcard,extended,,"CN=Example Root CA, OU=Infrastructure Team, DC=example, DC=com",Subject of the issuer of the x.509 certificate presented by the server. +1.8.0-dev,true,tls,tls.server.issuer,keyword,extended,,"CN=Example Root CA, OU=Infrastructure Team, DC=example, DC=com",Subject of the issuer of the x.509 certificate presented by the server. 1.8.0-dev,true,tls,tls.server.ja3s,keyword,extended,,394441ab65754e2207b1e1b457b3641d,A hash that identifies servers based on how they perform an SSL/TLS handshake. 1.8.0-dev,true,tls,tls.server.not_after,date,extended,,2021-01-01T00:00:00.000Z,Timestamp indicating when server certificate is no longer considered valid. 1.8.0-dev,true,tls,tls.server.not_before,date,extended,,1970-01-01T00:00:00.000Z,Timestamp indicating when server certificate is first considered valid. -1.8.0-dev,true,tls,tls.server.subject,wildcard,extended,,"CN=www.example.com, OU=Infrastructure Team, DC=example, DC=com",Subject of the x.509 certificate presented by the server. +1.8.0-dev,true,tls,tls.server.subject,keyword,extended,,"CN=www.example.com, OU=Infrastructure Team, DC=example, DC=com",Subject of the x.509 certificate presented by the server. 1.8.0-dev,true,tls,tls.server.x509.alternative_names,keyword,extended,array,*.elastic.co,List of subject alternative names (SAN). 1.8.0-dev,true,tls,tls.server.x509.issuer.common_name,keyword,extended,array,Example SHA2 High Assurance Server CA,List of common name (CN) of issuing certificate authority. 1.8.0-dev,true,tls,tls.server.x509.issuer.country,keyword,extended,array,US,List of country (C) codes -1.8.0-dev,true,tls,tls.server.x509.issuer.distinguished_name,wildcard,extended,,"C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA",Distinguished name (DN) of issuing certificate authority. +1.8.0-dev,true,tls,tls.server.x509.issuer.distinguished_name,keyword,extended,,"C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA",Distinguished name (DN) of issuing certificate authority. 1.8.0-dev,true,tls,tls.server.x509.issuer.locality,keyword,extended,array,Mountain View,List of locality names (L) 1.8.0-dev,true,tls,tls.server.x509.issuer.organization,keyword,extended,array,Example Inc,List of organizations (O) of issuing certificate authority. 1.8.0-dev,true,tls,tls.server.x509.issuer.organizational_unit,keyword,extended,array,www.example.com,List of organizational units (OU) of issuing certificate authority. @@ -620,7 +620,7 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description 1.8.0-dev,true,tls,tls.server.x509.signature_algorithm,keyword,extended,,SHA256-RSA,Identifier for certificate signature algorithm. 1.8.0-dev,true,tls,tls.server.x509.subject.common_name,keyword,extended,array,shared.global.example.net,List of common names (CN) of subject. 1.8.0-dev,true,tls,tls.server.x509.subject.country,keyword,extended,array,US,List of country (C) code -1.8.0-dev,true,tls,tls.server.x509.subject.distinguished_name,wildcard,extended,,"C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net",Distinguished name (DN) of the certificate subject entity. +1.8.0-dev,true,tls,tls.server.x509.subject.distinguished_name,keyword,extended,,"C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net",Distinguished name (DN) of the certificate subject entity. 1.8.0-dev,true,tls,tls.server.x509.subject.locality,keyword,extended,array,San Francisco,List of locality names (L) 1.8.0-dev,true,tls,tls.server.x509.subject.organization,keyword,extended,array,"Example, Inc.",List of organizations (O) of subject. 1.8.0-dev,true,tls,tls.server.x509.subject.organizational_unit,keyword,extended,array,,List of organizational units (OU) of subject. @@ -630,79 +630,79 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description 1.8.0-dev,true,tls,tls.version_protocol,keyword,extended,,tls,Normalized lowercase protocol name parsed from original string. 1.8.0-dev,true,trace,trace.id,keyword,extended,,4bf92f3577b34da6a3ce929d0e0e4736,Unique identifier of the trace. 1.8.0-dev,true,transaction,transaction.id,keyword,extended,,00f067aa0ba902b7,Unique identifier of the transaction within the scope of its trace. -1.8.0-dev,true,url,url.domain,wildcard,extended,,www.elastic.co,Domain of the url. +1.8.0-dev,true,url,url.domain,keyword,extended,,www.elastic.co,Domain of the url. 1.8.0-dev,true,url,url.extension,keyword,extended,,png,"File extension from the request url, excluding the leading dot." 1.8.0-dev,true,url,url.fragment,keyword,extended,,,Portion of the url after the `#`. -1.8.0-dev,true,url,url.full,wildcard,extended,,https://www.elastic.co:443/search?q=elasticsearch#top,Full unparsed URL. +1.8.0-dev,true,url,url.full,keyword,extended,,https://www.elastic.co:443/search?q=elasticsearch#top,Full unparsed URL. 1.8.0-dev,true,url,url.full.text,text,extended,,https://www.elastic.co:443/search?q=elasticsearch#top,Full unparsed URL. -1.8.0-dev,true,url,url.original,wildcard,extended,,https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch,Unmodified original url as seen in the event source. +1.8.0-dev,true,url,url.original,keyword,extended,,https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch,Unmodified original url as seen in the event source. 1.8.0-dev,true,url,url.original.text,text,extended,,https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch,Unmodified original url as seen in the event source. 1.8.0-dev,true,url,url.password,keyword,extended,,,Password of the request. -1.8.0-dev,true,url,url.path,wildcard,extended,,,"Path of the request, such as ""/search""." +1.8.0-dev,true,url,url.path,keyword,extended,,,"Path of the request, such as ""/search""." 1.8.0-dev,true,url,url.port,long,extended,,443,"Port of the request, such as 443." 1.8.0-dev,true,url,url.query,keyword,extended,,,Query string of the request. -1.8.0-dev,true,url,url.registered_domain,wildcard,extended,,example.com,"The highest registered url domain, stripped of the subdomain." +1.8.0-dev,true,url,url.registered_domain,keyword,extended,,example.com,"The highest registered url domain, stripped of the subdomain." 1.8.0-dev,true,url,url.scheme,keyword,extended,,https,Scheme of the url. 1.8.0-dev,true,url,url.subdomain,keyword,extended,,east,The subdomain of the domain. 1.8.0-dev,true,url,url.top_level_domain,keyword,extended,,co.uk,"The effective top level domain (com, org, net, co.uk)." 1.8.0-dev,true,url,url.username,keyword,extended,,,Username of the request. 1.8.0-dev,true,user,user.changes.domain,keyword,extended,,,Name of the directory the user is a member of. -1.8.0-dev,true,user,user.changes.email,wildcard,extended,,,User email address. -1.8.0-dev,true,user,user.changes.full_name,wildcard,extended,,Albert Einstein,"User's full name, if available." +1.8.0-dev,true,user,user.changes.email,keyword,extended,,,User email address. +1.8.0-dev,true,user,user.changes.full_name,keyword,extended,,Albert Einstein,"User's full name, if available." 1.8.0-dev,true,user,user.changes.full_name.text,text,extended,,Albert Einstein,"User's full name, if available." 1.8.0-dev,true,user,user.changes.group.domain,keyword,extended,,,Name of the directory the group is a member of. 1.8.0-dev,true,user,user.changes.group.id,keyword,extended,,,Unique identifier for the group on the system/platform. 1.8.0-dev,true,user,user.changes.group.name,keyword,extended,,,Name of the group. 1.8.0-dev,true,user,user.changes.hash,keyword,extended,,,Unique user hash to correlate information for a user in anonymized form. 1.8.0-dev,true,user,user.changes.id,keyword,core,,,Unique identifier of the user. -1.8.0-dev,true,user,user.changes.name,wildcard,core,,albert,Short name or login of the user. +1.8.0-dev,true,user,user.changes.name,keyword,core,,albert,Short name or login of the user. 1.8.0-dev,true,user,user.changes.name.text,text,core,,albert,Short name or login of the user. 1.8.0-dev,true,user,user.changes.roles,keyword,extended,array,"[""kibana_admin"", ""reporting_user""]",Array of user roles at the time of the event. 1.8.0-dev,true,user,user.domain,keyword,extended,,,Name of the directory the user is a member of. 1.8.0-dev,true,user,user.effective.domain,keyword,extended,,,Name of the directory the user is a member of. -1.8.0-dev,true,user,user.effective.email,wildcard,extended,,,User email address. -1.8.0-dev,true,user,user.effective.full_name,wildcard,extended,,Albert Einstein,"User's full name, if available." +1.8.0-dev,true,user,user.effective.email,keyword,extended,,,User email address. +1.8.0-dev,true,user,user.effective.full_name,keyword,extended,,Albert Einstein,"User's full name, if available." 1.8.0-dev,true,user,user.effective.full_name.text,text,extended,,Albert Einstein,"User's full name, if available." 1.8.0-dev,true,user,user.effective.group.domain,keyword,extended,,,Name of the directory the group is a member of. 1.8.0-dev,true,user,user.effective.group.id,keyword,extended,,,Unique identifier for the group on the system/platform. 1.8.0-dev,true,user,user.effective.group.name,keyword,extended,,,Name of the group. 1.8.0-dev,true,user,user.effective.hash,keyword,extended,,,Unique user hash to correlate information for a user in anonymized form. 1.8.0-dev,true,user,user.effective.id,keyword,core,,,Unique identifier of the user. -1.8.0-dev,true,user,user.effective.name,wildcard,core,,albert,Short name or login of the user. +1.8.0-dev,true,user,user.effective.name,keyword,core,,albert,Short name or login of the user. 1.8.0-dev,true,user,user.effective.name.text,text,core,,albert,Short name or login of the user. 1.8.0-dev,true,user,user.effective.roles,keyword,extended,array,"[""kibana_admin"", ""reporting_user""]",Array of user roles at the time of the event. -1.8.0-dev,true,user,user.email,wildcard,extended,,,User email address. -1.8.0-dev,true,user,user.full_name,wildcard,extended,,Albert Einstein,"User's full name, if available." +1.8.0-dev,true,user,user.email,keyword,extended,,,User email address. +1.8.0-dev,true,user,user.full_name,keyword,extended,,Albert Einstein,"User's full name, if available." 1.8.0-dev,true,user,user.full_name.text,text,extended,,Albert Einstein,"User's full name, if available." 1.8.0-dev,true,user,user.group.domain,keyword,extended,,,Name of the directory the group is a member of. 1.8.0-dev,true,user,user.group.id,keyword,extended,,,Unique identifier for the group on the system/platform. 1.8.0-dev,true,user,user.group.name,keyword,extended,,,Name of the group. 1.8.0-dev,true,user,user.hash,keyword,extended,,,Unique user hash to correlate information for a user in anonymized form. 1.8.0-dev,true,user,user.id,keyword,core,,,Unique identifier of the user. -1.8.0-dev,true,user,user.name,wildcard,core,,albert,Short name or login of the user. +1.8.0-dev,true,user,user.name,keyword,core,,albert,Short name or login of the user. 1.8.0-dev,true,user,user.name.text,text,core,,albert,Short name or login of the user. 1.8.0-dev,true,user,user.roles,keyword,extended,array,"[""kibana_admin"", ""reporting_user""]",Array of user roles at the time of the event. 1.8.0-dev,true,user,user.target.domain,keyword,extended,,,Name of the directory the user is a member of. -1.8.0-dev,true,user,user.target.email,wildcard,extended,,,User email address. -1.8.0-dev,true,user,user.target.full_name,wildcard,extended,,Albert Einstein,"User's full name, if available." +1.8.0-dev,true,user,user.target.email,keyword,extended,,,User email address. +1.8.0-dev,true,user,user.target.full_name,keyword,extended,,Albert Einstein,"User's full name, if available." 1.8.0-dev,true,user,user.target.full_name.text,text,extended,,Albert Einstein,"User's full name, if available." 1.8.0-dev,true,user,user.target.group.domain,keyword,extended,,,Name of the directory the group is a member of. 1.8.0-dev,true,user,user.target.group.id,keyword,extended,,,Unique identifier for the group on the system/platform. 1.8.0-dev,true,user,user.target.group.name,keyword,extended,,,Name of the group. 1.8.0-dev,true,user,user.target.hash,keyword,extended,,,Unique user hash to correlate information for a user in anonymized form. 1.8.0-dev,true,user,user.target.id,keyword,core,,,Unique identifier of the user. -1.8.0-dev,true,user,user.target.name,wildcard,core,,albert,Short name or login of the user. +1.8.0-dev,true,user,user.target.name,keyword,core,,albert,Short name or login of the user. 1.8.0-dev,true,user,user.target.name.text,text,core,,albert,Short name or login of the user. 1.8.0-dev,true,user,user.target.roles,keyword,extended,array,"[""kibana_admin"", ""reporting_user""]",Array of user roles at the time of the event. 1.8.0-dev,true,user_agent,user_agent.device.name,keyword,extended,,iPhone,Name of the device. 1.8.0-dev,true,user_agent,user_agent.name,keyword,extended,,Safari,Name of the user agent. -1.8.0-dev,true,user_agent,user_agent.original,wildcard,extended,,"Mozilla/5.0 (iPhone; CPU iPhone OS 12_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1",Unparsed user_agent string. +1.8.0-dev,true,user_agent,user_agent.original,keyword,extended,,"Mozilla/5.0 (iPhone; CPU iPhone OS 12_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1",Unparsed user_agent string. 1.8.0-dev,true,user_agent,user_agent.original.text,text,extended,,"Mozilla/5.0 (iPhone; CPU iPhone OS 12_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1",Unparsed user_agent string. 1.8.0-dev,true,user_agent,user_agent.os.family,keyword,extended,,debian,"OS family (such as redhat, debian, freebsd, windows)." -1.8.0-dev,true,user_agent,user_agent.os.full,wildcard,extended,,Mac OS Mojave,"Operating system name, including the version or code name." +1.8.0-dev,true,user_agent,user_agent.os.full,keyword,extended,,Mac OS Mojave,"Operating system name, including the version or code name." 1.8.0-dev,true,user_agent,user_agent.os.full.text,text,extended,,Mac OS Mojave,"Operating system name, including the version or code name." 1.8.0-dev,true,user_agent,user_agent.os.kernel,keyword,extended,,4.4.0-112-generic,Operating system kernel version as a raw string. -1.8.0-dev,true,user_agent,user_agent.os.name,wildcard,extended,,Mac OS X,"Operating system name, without the version." +1.8.0-dev,true,user_agent,user_agent.os.name,keyword,extended,,Mac OS X,"Operating system name, without the version." 1.8.0-dev,true,user_agent,user_agent.os.name.text,text,extended,,Mac OS X,"Operating system name, without the version." 1.8.0-dev,true,user_agent,user_agent.os.platform,keyword,extended,,darwin,"Operating system platform (such centos, ubuntu, windows)." 1.8.0-dev,true,user_agent,user_agent.os.type,keyword,extended,,macos,"Which commercial OS family (one of: linux, macos, unix or windows)." diff --git a/generated/ecs/ecs_flat.yml b/generated/ecs/ecs_flat.yml index 7e7347eba8..a7569c16f7 100644 --- a/generated/ecs/ecs_flat.yml +++ b/generated/ecs/ecs_flat.yml @@ -18,8 +18,6 @@ short: Date/time when the event originated. type: date agent.build.original: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: agent-build-original description: 'Extended build information for the agent. @@ -28,11 +26,12 @@ agent.build.original: example: metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC] flat_name: agent.build.original + ignore_above: 1024 level: core name: build.original normalize: [] short: Extended build information for the agent. - type: wildcard + type: keyword agent.ephemeral_id: dashed_name: agent-ephemeral-id description: 'Ephemeral identifier of this agent (if one exists). @@ -130,12 +129,11 @@ client.as.number: short: Unique number allocated to the autonomous system. type: long client.as.organization.name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: client-as-organization-name description: Organization name. example: Google LLC flat_name: client.as.organization.name + ignore_above: 1024 level: extended multi_fields: - flat_name: client.as.organization.name.text @@ -146,7 +144,7 @@ client.as.organization.name: normalize: [] original_fieldset: as short: Organization name. - type: wildcard + type: keyword client.bytes: dashed_name: client-bytes description: Bytes sent from the client to the server. @@ -159,16 +157,15 @@ client.bytes: short: Bytes sent from the client to the server. type: long client.domain: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: client-domain description: Client domain. flat_name: client.domain + ignore_above: 1024 level: core name: domain normalize: [] short: Client domain. - type: wildcard + type: keyword client.geo.city_name: dashed_name: client-geo-city-name description: City name. @@ -229,8 +226,6 @@ client.geo.location: short: Longitude and latitude. type: geo_point client.geo.name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: client-geo-name description: 'User-defined description of a location, at the level of granularity they care about. @@ -241,12 +236,13 @@ client.geo.name: Not typically used in automated geolocation.' example: boston-dc flat_name: client.geo.name + ignore_above: 1024 level: extended name: name normalize: [] original_fieldset: geo short: User-defined description of a location. - type: wildcard + type: keyword client.geo.region_iso_code: dashed_name: client-geo-region-iso-code description: Region ISO code. @@ -336,8 +332,6 @@ client.port: short: Port of the client. type: long client.registered_domain: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: client-registered-domain description: 'The highest registered client domain, stripped of the subdomain. @@ -348,11 +342,12 @@ client.registered_domain: two labels will not work well for TLDs such as "co.uk".' example: example.com flat_name: client.registered_domain + ignore_above: 1024 level: extended name: registered_domain normalize: [] short: The highest registered client domain, stripped of the subdomain. - type: wildcard + type: keyword client.subdomain: dashed_name: client-subdomain description: 'The subdomain portion of a fully qualified domain name includes all @@ -402,24 +397,22 @@ client.user.domain: short: Name of the directory the user is a member of. type: keyword client.user.email: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: client-user-email description: User email address. flat_name: client.user.email + ignore_above: 1024 level: extended name: email normalize: [] original_fieldset: user short: User email address. - type: wildcard + type: keyword client.user.full_name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: client-user-full-name description: User's full name, if available. example: Albert Einstein flat_name: client.user.full_name + ignore_above: 1024 level: extended multi_fields: - flat_name: client.user.full_name.text @@ -430,7 +423,7 @@ client.user.full_name: normalize: [] original_fieldset: user short: User's full name, if available. - type: wildcard + type: keyword client.user.group.domain: dashed_name: client-user-group-domain description: 'Name of the directory the group is a member of. @@ -493,12 +486,11 @@ client.user.id: short: Unique identifier of the user. type: keyword client.user.name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: client-user-name description: Short name or login of the user. example: albert flat_name: client.user.name + ignore_above: 1024 level: core multi_fields: - flat_name: client.user.name.text @@ -509,7 +501,7 @@ client.user.name: normalize: [] original_fieldset: user short: Short name or login of the user. - type: wildcard + type: keyword client.user.roles: dashed_name: client-user-roles description: Array of user roles at the time of the event. @@ -733,12 +725,11 @@ destination.as.number: short: Unique number allocated to the autonomous system. type: long destination.as.organization.name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: destination-as-organization-name description: Organization name. example: Google LLC flat_name: destination.as.organization.name + ignore_above: 1024 level: extended multi_fields: - flat_name: destination.as.organization.name.text @@ -749,7 +740,7 @@ destination.as.organization.name: normalize: [] original_fieldset: as short: Organization name. - type: wildcard + type: keyword destination.bytes: dashed_name: destination-bytes description: Bytes sent from the destination to the source. @@ -762,16 +753,15 @@ destination.bytes: short: Bytes sent from the destination to the source. type: long destination.domain: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: destination-domain description: Destination domain. flat_name: destination.domain + ignore_above: 1024 level: core name: domain normalize: [] short: Destination domain. - type: wildcard + type: keyword destination.geo.city_name: dashed_name: destination-geo-city-name description: City name. @@ -832,8 +822,6 @@ destination.geo.location: short: Longitude and latitude. type: geo_point destination.geo.name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: destination-geo-name description: 'User-defined description of a location, at the level of granularity they care about. @@ -844,12 +832,13 @@ destination.geo.name: Not typically used in automated geolocation.' example: boston-dc flat_name: destination.geo.name + ignore_above: 1024 level: extended name: name normalize: [] original_fieldset: geo short: User-defined description of a location. - type: wildcard + type: keyword destination.geo.region_iso_code: dashed_name: destination-geo-region-iso-code description: Region ISO code. @@ -938,8 +927,6 @@ destination.port: short: Port of the destination. type: long destination.registered_domain: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: destination-registered-domain description: 'The highest registered destination domain, stripped of the subdomain. @@ -950,11 +937,12 @@ destination.registered_domain: two labels will not work well for TLDs such as "co.uk".' example: example.com flat_name: destination.registered_domain + ignore_above: 1024 level: extended name: registered_domain normalize: [] short: The highest registered destination domain, stripped of the subdomain. - type: wildcard + type: keyword destination.subdomain: dashed_name: destination-subdomain description: 'The subdomain portion of a fully qualified domain name includes all @@ -1004,24 +992,22 @@ destination.user.domain: short: Name of the directory the user is a member of. type: keyword destination.user.email: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: destination-user-email description: User email address. flat_name: destination.user.email + ignore_above: 1024 level: extended name: email normalize: [] original_fieldset: user short: User email address. - type: wildcard + type: keyword destination.user.full_name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: destination-user-full-name description: User's full name, if available. example: Albert Einstein flat_name: destination.user.full_name + ignore_above: 1024 level: extended multi_fields: - flat_name: destination.user.full_name.text @@ -1032,7 +1018,7 @@ destination.user.full_name: normalize: [] original_fieldset: user short: User's full name, if available. - type: wildcard + type: keyword destination.user.group.domain: dashed_name: destination-user-group-domain description: 'Name of the directory the group is a member of. @@ -1095,12 +1081,11 @@ destination.user.id: short: Unique identifier of the user. type: keyword destination.user.name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: destination-user-name description: Short name or login of the user. example: albert flat_name: destination.user.name + ignore_above: 1024 level: core multi_fields: - flat_name: destination.user.name.text @@ -1111,7 +1096,7 @@ destination.user.name: normalize: [] original_fieldset: user short: Short name or login of the user. - type: wildcard + type: keyword destination.user.roles: dashed_name: destination-user-roles description: Array of user roles at the time of the event. @@ -1326,18 +1311,17 @@ dll.pe.imphash: short: A hash of the imports in a PE file. type: keyword dll.pe.original_file_name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: dll-pe-original-file-name description: Internal name of the file, provided at compile-time. example: MSPAINT.EXE flat_name: dll.pe.original_file_name + ignore_above: 1024 level: extended name: original_file_name normalize: [] original_fieldset: pe short: Internal name of the file, provided at compile-time. - type: wildcard + type: keyword dll.pe.product: dashed_name: dll-pe-product description: Internal product name of the file, provided at compile-time. @@ -1381,19 +1365,18 @@ dns.answers.class: short: The class of DNS data contained in this resource record. type: keyword dns.answers.data: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: dns-answers-data description: 'The data describing the resource. The meaning of this data depends on the type and class of the resource record.' example: 10.10.10.10 flat_name: dns.answers.data + ignore_above: 1024 level: extended name: answers.data normalize: [] short: The data describing the resource. - type: wildcard + type: keyword dns.answers.name: dashed_name: dns-answers-name description: 'The domain name to which this resource record pertains. @@ -1483,8 +1466,6 @@ dns.question.class: short: The class of records being queried. type: keyword dns.question.name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: dns-question-name description: 'The name being queried. @@ -1494,11 +1475,12 @@ dns.question.name: converted to \t, \r, and \n respectively.' example: www.example.com flat_name: dns.question.name + ignore_above: 1024 level: extended name: question.name normalize: [] short: The name being queried. - type: wildcard + type: keyword dns.question.registered_domain: dashed_name: dns-question-registered-domain description: 'The highest registered domain, stripped of the subdomain. @@ -1651,11 +1633,12 @@ error.message: short: Error message. type: text error.stack_trace: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: error-stack-trace description: The stack trace of this error in plain text. + doc_values: false flat_name: error.stack_trace + ignore_above: 1024 + index: false level: extended multi_fields: - flat_name: error.stack_trace.text @@ -1665,19 +1648,18 @@ error.stack_trace: name: stack_trace normalize: [] short: The stack trace of this error in plain text. - type: wildcard + type: keyword error.type: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: error-type description: The type of the error, for example the class name of the exception. example: java.lang.NullPointerException flat_name: error.type + ignore_above: 1024 level: extended name: type normalize: [] short: The type of the error, for example the class name of the exception. - type: wildcard + type: keyword event.action: dashed_name: event-action description: 'The action captured by the event. @@ -2555,18 +2537,17 @@ file.device: short: Device that is the source of the file. type: keyword file.directory: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: file-directory description: Directory where the file is located. It should include the drive letter, when appropriate. example: /home/alice flat_name: file.directory + ignore_above: 1024 level: extended name: directory normalize: [] short: Directory where the file is located. - type: wildcard + type: keyword file.drive_letter: dashed_name: file-drive-letter description: 'Drive letter where the file is located. This field is only relevant @@ -2728,13 +2709,12 @@ file.owner: short: File owner's username. type: keyword file.path: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: file-path description: Full path to the file, including the file name. It should include the drive letter, when appropriate. example: /home/alice/example.png flat_name: file.path + ignore_above: 1024 level: extended multi_fields: - flat_name: file.path.text @@ -2744,7 +2724,7 @@ file.path: name: path normalize: [] short: Full path to the file, including the file name. - type: wildcard + type: keyword file.pe.architecture: dashed_name: file-pe-architecture description: CPU architecture target for the file. @@ -2810,18 +2790,17 @@ file.pe.imphash: short: A hash of the imports in a PE file. type: keyword file.pe.original_file_name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: file-pe-original-file-name description: Internal name of the file, provided at compile-time. example: MSPAINT.EXE flat_name: file.pe.original_file_name + ignore_above: 1024 level: extended name: original_file_name normalize: [] original_fieldset: pe short: Internal name of the file, provided at compile-time. - type: wildcard + type: keyword file.pe.product: dashed_name: file-pe-product description: Internal product name of the file, provided at compile-time. @@ -2847,11 +2826,10 @@ file.size: short: File size in bytes. type: long file.target_path: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: file-target-path description: Target path for symlinks. flat_name: file.target_path + ignore_above: 1024 level: extended multi_fields: - flat_name: file.target_path.text @@ -2861,7 +2839,7 @@ file.target_path: name: target_path normalize: [] short: Target path for symlinks. - type: wildcard + type: keyword file.type: dashed_name: file-type description: File type (file, dir, or symlink). @@ -2926,19 +2904,18 @@ file.x509.issuer.country: short: List of country (C) codes type: keyword file.x509.issuer.distinguished_name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: file-x509-issuer-distinguished-name description: Distinguished name (DN) of issuing certificate authority. example: C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA flat_name: file.x509.issuer.distinguished_name + ignore_above: 1024 level: extended name: issuer.distinguished_name normalize: [] original_fieldset: x509 short: Distinguished name (DN) of issuing certificate authority. - type: wildcard + type: keyword file.x509.issuer.locality: dashed_name: file-x509-issuer-locality description: List of locality names (L) @@ -3117,18 +3094,17 @@ file.x509.subject.country: short: List of country (C) code type: keyword file.x509.subject.distinguished_name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: file-x509-subject-distinguished-name description: Distinguished name (DN) of the certificate subject entity. example: C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net flat_name: file.x509.subject.distinguished_name + ignore_above: 1024 level: extended name: subject.distinguished_name normalize: [] original_fieldset: x509 short: Distinguished name (DN) of the certificate subject entity. - type: wildcard + type: keyword file.x509.subject.locality: dashed_name: file-x509-subject-locality description: List of locality names (L) @@ -3309,8 +3285,6 @@ host.geo.location: short: Longitude and latitude. type: geo_point host.geo.name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: host-geo-name description: 'User-defined description of a location, at the level of granularity they care about. @@ -3321,12 +3295,13 @@ host.geo.name: Not typically used in automated geolocation.' example: boston-dc flat_name: host.geo.name + ignore_above: 1024 level: extended name: name normalize: [] original_fieldset: geo short: User-defined description of a location. - type: wildcard + type: keyword host.geo.region_iso_code: dashed_name: host-geo-region-iso-code description: Region ISO code. @@ -3352,18 +3327,17 @@ host.geo.region_name: short: Region name. type: keyword host.hostname: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: host-hostname description: 'Hostname of the host. It normally contains what the `hostname` command returns on the host machine.' flat_name: host.hostname + ignore_above: 1024 level: core name: hostname normalize: [] short: Hostname of the host. - type: wildcard + type: keyword host.id: dashed_name: host-id description: 'Unique host id. @@ -3425,12 +3399,11 @@ host.os.family: short: OS family (such as redhat, debian, freebsd, windows). type: keyword host.os.full: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: host-os-full description: Operating system name, including the version or code name. example: Mac OS Mojave flat_name: host.os.full + ignore_above: 1024 level: extended multi_fields: - flat_name: host.os.full.text @@ -3441,7 +3414,7 @@ host.os.full: normalize: [] original_fieldset: os short: Operating system name, including the version or code name. - type: wildcard + type: keyword host.os.kernel: dashed_name: host-os-kernel description: Operating system kernel version as a raw string. @@ -3455,12 +3428,11 @@ host.os.kernel: short: Operating system kernel version as a raw string. type: keyword host.os.name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: host-os-name description: Operating system name, without the version. example: Mac OS X flat_name: host.os.name + ignore_above: 1024 level: extended multi_fields: - flat_name: host.os.name.text @@ -3471,7 +3443,7 @@ host.os.name: normalize: [] original_fieldset: os short: Operating system name, without the version. - type: wildcard + type: keyword host.os.platform: dashed_name: host-os-platform description: Operating system platform (such centos, ubuntu, windows). @@ -3552,24 +3524,22 @@ host.user.domain: short: Name of the directory the user is a member of. type: keyword host.user.email: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: host-user-email description: User email address. flat_name: host.user.email + ignore_above: 1024 level: extended name: email normalize: [] original_fieldset: user short: User email address. - type: wildcard + type: keyword host.user.full_name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: host-user-full-name description: User's full name, if available. example: Albert Einstein flat_name: host.user.full_name + ignore_above: 1024 level: extended multi_fields: - flat_name: host.user.full_name.text @@ -3580,7 +3550,7 @@ host.user.full_name: normalize: [] original_fieldset: user short: User's full name, if available. - type: wildcard + type: keyword host.user.group.domain: dashed_name: host-user-group-domain description: 'Name of the directory the group is a member of. @@ -3643,12 +3613,11 @@ host.user.id: short: Unique identifier of the user. type: keyword host.user.name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: host-user-name description: Short name or login of the user. example: albert flat_name: host.user.name + ignore_above: 1024 level: core multi_fields: - flat_name: host.user.name.text @@ -3659,7 +3628,7 @@ host.user.name: normalize: [] original_fieldset: user short: Short name or login of the user. - type: wildcard + type: keyword host.user.roles: dashed_name: host-user-roles description: Array of user roles at the time of the event. @@ -3685,12 +3654,11 @@ http.request.body.bytes: short: Size in bytes of the request body. type: long http.request.body.content: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: http-request-body-content description: The full HTTP request body. example: Hello world flat_name: http.request.body.content + ignore_above: 1024 level: extended multi_fields: - flat_name: http.request.body.content.text @@ -3700,7 +3668,7 @@ http.request.body.content: name: request.body.content normalize: [] short: The full HTTP request body. - type: wildcard + type: keyword http.request.bytes: dashed_name: http-request-bytes description: Total size in bytes of the request (body and headers). @@ -3746,17 +3714,16 @@ http.request.mime_type: short: Mime type of the body of the request. type: keyword http.request.referrer: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: http-request-referrer description: Referrer for this HTTP request. example: https://blog.example.com/ flat_name: http.request.referrer + ignore_above: 1024 level: extended name: request.referrer normalize: [] short: Referrer for this HTTP request. - type: wildcard + type: keyword http.response.body.bytes: dashed_name: http-response-body-bytes description: Size in bytes of the response body. @@ -3769,12 +3736,11 @@ http.response.body.bytes: short: Size in bytes of the response body. type: long http.response.body.content: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: http-response-body-content description: The full HTTP response body. example: Hello world flat_name: http.response.body.content + ignore_above: 1024 level: extended multi_fields: - flat_name: http.response.body.content.text @@ -3784,7 +3750,7 @@ http.response.body.content: name: response.body.content normalize: [] short: The full HTTP response body. - type: wildcard + type: keyword http.response.bytes: dashed_name: http-response-bytes description: Total size in bytes of the response (body and headers). @@ -3850,8 +3816,6 @@ labels: short: Custom key/value pairs. type: object log.file.path: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: log-file-path description: 'Full path to the log file this event came from, including the file name. It should include the drive letter, when appropriate. @@ -3859,11 +3823,12 @@ log.file.path: If the event wasn''t read from a log file, do not populate this field.' example: /var/log/fun-times.log flat_name: log.file.path + ignore_above: 1024 level: extended name: file.path normalize: [] short: Full path to the log file this event came from. - type: wildcard + type: keyword log.level: dashed_name: log-level description: 'Original log level of the log event. @@ -3882,18 +3847,17 @@ log.level: short: Log level of the log event. type: keyword log.logger: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: log-logger description: The name of the logger inside an application. This is usually the name of the class which initialized the logger, or can be a custom name. example: org.elasticsearch.bootstrap.Bootstrap flat_name: log.logger + ignore_above: 1024 level: core name: logger normalize: [] short: Name of the logger. - type: wildcard + type: keyword log.origin.file.line: dashed_name: log-origin-file-line description: The line number of the file containing the source code which originated @@ -4414,8 +4378,6 @@ observer.geo.location: short: Longitude and latitude. type: geo_point observer.geo.name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: observer-geo-name description: 'User-defined description of a location, at the level of granularity they care about. @@ -4426,12 +4388,13 @@ observer.geo.name: Not typically used in automated geolocation.' example: boston-dc flat_name: observer.geo.name + ignore_above: 1024 level: extended name: name normalize: [] original_fieldset: geo short: User-defined description of a location. - type: wildcard + type: keyword observer.geo.region_iso_code: dashed_name: observer-geo-region-iso-code description: Region ISO code. @@ -4602,12 +4565,11 @@ observer.os.family: short: OS family (such as redhat, debian, freebsd, windows). type: keyword observer.os.full: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: observer-os-full description: Operating system name, including the version or code name. example: Mac OS Mojave flat_name: observer.os.full + ignore_above: 1024 level: extended multi_fields: - flat_name: observer.os.full.text @@ -4618,7 +4580,7 @@ observer.os.full: normalize: [] original_fieldset: os short: Operating system name, including the version or code name. - type: wildcard + type: keyword observer.os.kernel: dashed_name: observer-os-kernel description: Operating system kernel version as a raw string. @@ -4632,12 +4594,11 @@ observer.os.kernel: short: Operating system kernel version as a raw string. type: keyword observer.os.name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: observer-os-name description: Operating system name, without the version. example: Mac OS X flat_name: observer.os.name + ignore_above: 1024 level: extended multi_fields: - flat_name: observer.os.name.text @@ -4648,7 +4609,7 @@ observer.os.name: normalize: [] original_fieldset: os short: Operating system name, without the version. - type: wildcard + type: keyword observer.os.platform: dashed_name: observer-os-platform description: Operating system platform (such centos, ubuntu, windows). @@ -4759,11 +4720,10 @@ organization.id: short: Unique identifier for the organization. type: keyword organization.name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: organization-name description: Organization name. flat_name: organization.name + ignore_above: 1024 level: extended multi_fields: - flat_name: organization.name.text @@ -4773,7 +4733,7 @@ organization.name: name: name normalize: [] short: Organization name. - type: wildcard + type: keyword package.architecture: dashed_name: package-architecture description: Package architecture. @@ -5021,8 +4981,6 @@ process.code_signature.valid: content. type: boolean process.command_line: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: process-command-line description: 'Full command line that started the process, including the absolute path to the executable, and all arguments. @@ -5030,6 +4988,7 @@ process.command_line: Some arguments may be filtered to protect sensitive information.' example: /usr/bin/ssh -l user 10.0.0.16 flat_name: process.command_line + ignore_above: 1024 level: extended multi_fields: - flat_name: process.command_line.text @@ -5039,7 +4998,7 @@ process.command_line: name: command_line normalize: [] short: Full command line that started the process. - type: wildcard + type: keyword process.entity_id: dashed_name: process-entity-id description: 'Unique identifier for the process. @@ -5060,12 +5019,11 @@ process.entity_id: short: Unique identifier for the process. type: keyword process.executable: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: process-executable description: Absolute path to the process executable. example: /usr/bin/ssh flat_name: process.executable + ignore_above: 1024 level: extended multi_fields: - flat_name: process.executable.text @@ -5075,7 +5033,7 @@ process.executable: name: executable normalize: [] short: Absolute path to the process executable. - type: wildcard + type: keyword process.exit_code: dashed_name: process-exit-code description: 'The exit code of the process, if this is a termination event. @@ -5134,14 +5092,13 @@ process.hash.sha512: short: SHA512 hash. type: keyword process.name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: process-name description: 'Process name. Sometimes called program name or similar.' example: ssh flat_name: process.name + ignore_above: 1024 level: extended multi_fields: - flat_name: process.name.text @@ -5151,7 +5108,7 @@ process.name: name: name normalize: [] short: Process name. - type: wildcard + type: keyword process.parent.args: dashed_name: process-parent-args description: 'Array of process arguments, starting with the absolute path to the @@ -5252,8 +5209,6 @@ process.parent.code_signature.valid: content. type: boolean process.parent.command_line: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: process-parent-command-line description: 'Full command line that started the process, including the absolute path to the executable, and all arguments. @@ -5261,6 +5216,7 @@ process.parent.command_line: Some arguments may be filtered to protect sensitive information.' example: /usr/bin/ssh -l user 10.0.0.16 flat_name: process.parent.command_line + ignore_above: 1024 level: extended multi_fields: - flat_name: process.parent.command_line.text @@ -5271,7 +5227,7 @@ process.parent.command_line: normalize: [] original_fieldset: process short: Full command line that started the process. - type: wildcard + type: keyword process.parent.entity_id: dashed_name: process-parent-entity-id description: 'Unique identifier for the process. @@ -5293,12 +5249,11 @@ process.parent.entity_id: short: Unique identifier for the process. type: keyword process.parent.executable: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: process-parent-executable description: Absolute path to the process executable. example: /usr/bin/ssh flat_name: process.parent.executable + ignore_above: 1024 level: extended multi_fields: - flat_name: process.parent.executable.text @@ -5309,7 +5264,7 @@ process.parent.executable: normalize: [] original_fieldset: process short: Absolute path to the process executable. - type: wildcard + type: keyword process.parent.exit_code: dashed_name: process-parent-exit-code description: 'The exit code of the process, if this is a termination event. @@ -5369,14 +5324,13 @@ process.parent.hash.sha512: short: SHA512 hash. type: keyword process.parent.name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: process-parent-name description: 'Process name. Sometimes called program name or similar.' example: ssh flat_name: process.parent.name + ignore_above: 1024 level: extended multi_fields: - flat_name: process.parent.name.text @@ -5387,7 +5341,7 @@ process.parent.name: normalize: [] original_fieldset: process short: Process name. - type: wildcard + type: keyword process.parent.pe.architecture: dashed_name: process-parent-pe-architecture description: CPU architecture target for the file. @@ -5453,18 +5407,17 @@ process.parent.pe.imphash: short: A hash of the imports in a PE file. type: keyword process.parent.pe.original_file_name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: process-parent-pe-original-file-name description: Internal name of the file, provided at compile-time. example: MSPAINT.EXE flat_name: process.parent.pe.original_file_name + ignore_above: 1024 level: extended name: original_file_name normalize: [] original_fieldset: pe short: Internal name of the file, provided at compile-time. - type: wildcard + type: keyword process.parent.pe.product: dashed_name: process-parent-pe-product description: Internal product name of the file, provided at compile-time. @@ -5536,27 +5489,25 @@ process.parent.thread.id: short: Thread ID. type: long process.parent.thread.name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: process-parent-thread-name description: Thread name. example: thread-0 flat_name: process.parent.thread.name + ignore_above: 1024 level: extended name: thread.name normalize: [] original_fieldset: process short: Thread name. - type: wildcard + type: keyword process.parent.title: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: process-parent-title description: 'Process title. The proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened.' flat_name: process.parent.title + ignore_above: 1024 level: extended multi_fields: - flat_name: process.parent.title.text @@ -5567,7 +5518,7 @@ process.parent.title: normalize: [] original_fieldset: process short: Process title. - type: wildcard + type: keyword process.parent.uptime: dashed_name: process-parent-uptime description: Seconds the process has been up. @@ -5580,12 +5531,11 @@ process.parent.uptime: short: Seconds the process has been up. type: long process.parent.working_directory: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: process-parent-working-directory description: The working directory of the process. example: /home/alice flat_name: process.parent.working_directory + ignore_above: 1024 level: extended multi_fields: - flat_name: process.parent.working_directory.text @@ -5596,7 +5546,7 @@ process.parent.working_directory: normalize: [] original_fieldset: process short: The working directory of the process. - type: wildcard + type: keyword process.pe.architecture: dashed_name: process-pe-architecture description: CPU architecture target for the file. @@ -5662,18 +5612,17 @@ process.pe.imphash: short: A hash of the imports in a PE file. type: keyword process.pe.original_file_name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: process-pe-original-file-name description: Internal name of the file, provided at compile-time. example: MSPAINT.EXE flat_name: process.pe.original_file_name + ignore_above: 1024 level: extended name: original_file_name normalize: [] original_fieldset: pe short: Internal name of the file, provided at compile-time. - type: wildcard + type: keyword process.pe.product: dashed_name: process-pe-product description: Internal product name of the file, provided at compile-time. @@ -5740,26 +5689,24 @@ process.thread.id: short: Thread ID. type: long process.thread.name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: process-thread-name description: Thread name. example: thread-0 flat_name: process.thread.name + ignore_above: 1024 level: extended name: thread.name normalize: [] short: Thread name. - type: wildcard + type: keyword process.title: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: process-title description: 'Process title. The proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened.' flat_name: process.title + ignore_above: 1024 level: extended multi_fields: - flat_name: process.title.text @@ -5769,7 +5716,7 @@ process.title: name: title normalize: [] short: Process title. - type: wildcard + type: keyword process.uptime: dashed_name: process-uptime description: Seconds the process has been up. @@ -5781,12 +5728,11 @@ process.uptime: short: Seconds the process has been up. type: long process.working_directory: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: process-working-directory description: The working directory of the process. example: /home/alice flat_name: process.working_directory + ignore_above: 1024 level: extended multi_fields: - flat_name: process.working_directory.text @@ -5796,7 +5742,7 @@ process.working_directory: name: working_directory normalize: [] short: The working directory of the process. - type: wildcard + type: keyword registry.data.bytes: dashed_name: registry-data-bytes description: 'Original bytes written with base64 encoding. @@ -5813,8 +5759,6 @@ registry.data.bytes: short: Original bytes written with base64 encoding. type: keyword registry.data.strings: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: registry-data-strings description: 'Content when writing string types. @@ -5825,12 +5769,13 @@ registry.data.strings: the decimal representation (e.g `"1"`).' example: '["C:\rta\red_ttp\bin\myapp.exe"]' flat_name: registry.data.strings + ignore_above: 1024 level: core name: data.strings normalize: - array short: List of strings representing what was written to the registry. - type: wildcard + type: keyword registry.data.type: dashed_name: registry-data-type description: Standard registry type for encoding contents @@ -5854,30 +5799,28 @@ registry.hive: short: Abbreviated name for the hive. type: keyword registry.key: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: registry-key description: Hive-relative path of keys. example: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe flat_name: registry.key + ignore_above: 1024 level: core name: key normalize: [] short: Hive-relative path of keys. - type: wildcard + type: keyword registry.path: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: registry-path description: Full path, including hive, key and value example: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe\Debugger flat_name: registry.path + ignore_above: 1024 level: core name: path normalize: [] short: Full path, including hive, key and value - type: wildcard + type: keyword registry.value: dashed_name: registry-value description: Name of the value written. @@ -6085,12 +6028,11 @@ server.as.number: short: Unique number allocated to the autonomous system. type: long server.as.organization.name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: server-as-organization-name description: Organization name. example: Google LLC flat_name: server.as.organization.name + ignore_above: 1024 level: extended multi_fields: - flat_name: server.as.organization.name.text @@ -6101,7 +6043,7 @@ server.as.organization.name: normalize: [] original_fieldset: as short: Organization name. - type: wildcard + type: keyword server.bytes: dashed_name: server-bytes description: Bytes sent from the server to the client. @@ -6114,16 +6056,15 @@ server.bytes: short: Bytes sent from the server to the client. type: long server.domain: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: server-domain description: Server domain. flat_name: server.domain + ignore_above: 1024 level: core name: domain normalize: [] short: Server domain. - type: wildcard + type: keyword server.geo.city_name: dashed_name: server-geo-city-name description: City name. @@ -6184,8 +6125,6 @@ server.geo.location: short: Longitude and latitude. type: geo_point server.geo.name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: server-geo-name description: 'User-defined description of a location, at the level of granularity they care about. @@ -6196,12 +6135,13 @@ server.geo.name: Not typically used in automated geolocation.' example: boston-dc flat_name: server.geo.name + ignore_above: 1024 level: extended name: name normalize: [] original_fieldset: geo short: User-defined description of a location. - type: wildcard + type: keyword server.geo.region_iso_code: dashed_name: server-geo-region-iso-code description: Region ISO code. @@ -6291,8 +6231,6 @@ server.port: short: Port of the server. type: long server.registered_domain: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: server-registered-domain description: 'The highest registered server domain, stripped of the subdomain. @@ -6303,11 +6241,12 @@ server.registered_domain: two labels will not work well for TLDs such as "co.uk".' example: example.com flat_name: server.registered_domain + ignore_above: 1024 level: extended name: registered_domain normalize: [] short: The highest registered server domain, stripped of the subdomain. - type: wildcard + type: keyword server.subdomain: dashed_name: server-subdomain description: 'The subdomain portion of a fully qualified domain name includes all @@ -6357,24 +6296,22 @@ server.user.domain: short: Name of the directory the user is a member of. type: keyword server.user.email: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: server-user-email description: User email address. flat_name: server.user.email + ignore_above: 1024 level: extended name: email normalize: [] original_fieldset: user short: User email address. - type: wildcard + type: keyword server.user.full_name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: server-user-full-name description: User's full name, if available. example: Albert Einstein flat_name: server.user.full_name + ignore_above: 1024 level: extended multi_fields: - flat_name: server.user.full_name.text @@ -6385,7 +6322,7 @@ server.user.full_name: normalize: [] original_fieldset: user short: User's full name, if available. - type: wildcard + type: keyword server.user.group.domain: dashed_name: server-user-group-domain description: 'Name of the directory the group is a member of. @@ -6448,12 +6385,11 @@ server.user.id: short: Unique identifier of the user. type: keyword server.user.name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: server-user-name description: Short name or login of the user. example: albert flat_name: server.user.name + ignore_above: 1024 level: core multi_fields: - flat_name: server.user.name.text @@ -6464,7 +6400,7 @@ server.user.name: normalize: [] original_fieldset: user short: Short name or login of the user. - type: wildcard + type: keyword server.user.roles: dashed_name: server-user-roles description: Array of user roles at the time of the event. @@ -6618,12 +6554,11 @@ source.as.number: short: Unique number allocated to the autonomous system. type: long source.as.organization.name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: source-as-organization-name description: Organization name. example: Google LLC flat_name: source.as.organization.name + ignore_above: 1024 level: extended multi_fields: - flat_name: source.as.organization.name.text @@ -6634,7 +6569,7 @@ source.as.organization.name: normalize: [] original_fieldset: as short: Organization name. - type: wildcard + type: keyword source.bytes: dashed_name: source-bytes description: Bytes sent from the source to the destination. @@ -6647,16 +6582,15 @@ source.bytes: short: Bytes sent from the source to the destination. type: long source.domain: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: source-domain description: Source domain. flat_name: source.domain + ignore_above: 1024 level: core name: domain normalize: [] short: Source domain. - type: wildcard + type: keyword source.geo.city_name: dashed_name: source-geo-city-name description: City name. @@ -6717,8 +6651,6 @@ source.geo.location: short: Longitude and latitude. type: geo_point source.geo.name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: source-geo-name description: 'User-defined description of a location, at the level of granularity they care about. @@ -6729,12 +6661,13 @@ source.geo.name: Not typically used in automated geolocation.' example: boston-dc flat_name: source.geo.name + ignore_above: 1024 level: extended name: name normalize: [] original_fieldset: geo short: User-defined description of a location. - type: wildcard + type: keyword source.geo.region_iso_code: dashed_name: source-geo-region-iso-code description: Region ISO code. @@ -6824,8 +6757,6 @@ source.port: short: Port of the source. type: long source.registered_domain: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: source-registered-domain description: 'The highest registered source domain, stripped of the subdomain. @@ -6836,11 +6767,12 @@ source.registered_domain: two labels will not work well for TLDs such as "co.uk".' example: example.com flat_name: source.registered_domain + ignore_above: 1024 level: extended name: registered_domain normalize: [] short: The highest registered source domain, stripped of the subdomain. - type: wildcard + type: keyword source.subdomain: dashed_name: source-subdomain description: 'The subdomain portion of a fully qualified domain name includes all @@ -6890,24 +6822,22 @@ source.user.domain: short: Name of the directory the user is a member of. type: keyword source.user.email: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: source-user-email description: User email address. flat_name: source.user.email + ignore_above: 1024 level: extended name: email normalize: [] original_fieldset: user short: User email address. - type: wildcard + type: keyword source.user.full_name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: source-user-full-name description: User's full name, if available. example: Albert Einstein flat_name: source.user.full_name + ignore_above: 1024 level: extended multi_fields: - flat_name: source.user.full_name.text @@ -6918,7 +6848,7 @@ source.user.full_name: normalize: [] original_fieldset: user short: User's full name, if available. - type: wildcard + type: keyword source.user.group.domain: dashed_name: source-user-group-domain description: 'Name of the directory the group is a member of. @@ -6981,12 +6911,11 @@ source.user.id: short: Unique identifier of the user. type: keyword source.user.name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: source-user-name description: Short name or login of the user. example: albert flat_name: source.user.name + ignore_above: 1024 level: core multi_fields: - flat_name: source.user.name.text @@ -6997,7 +6926,7 @@ source.user.name: normalize: [] original_fieldset: user short: Short name or login of the user. - type: wildcard + type: keyword source.user.roles: dashed_name: source-user-roles description: Array of user roles at the time of the event. @@ -7261,19 +7190,18 @@ tls.client.hash.sha256: certificate offered by the client. type: keyword tls.client.issuer: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: tls-client-issuer description: Distinguished name of subject of the issuer of the x.509 certificate presented by the client. example: CN=Example Root CA, OU=Infrastructure Team, DC=example, DC=com flat_name: tls.client.issuer + ignore_above: 1024 level: extended name: client.issuer normalize: [] short: Distinguished name of subject of the issuer of the x.509 certificate presented by the client. - type: wildcard + type: keyword tls.client.ja3: dashed_name: tls-client-ja3 description: A hash that identifies clients based on how they perform an SSL/TLS @@ -7321,18 +7249,17 @@ tls.client.server_name: short: Hostname the client is trying to connect to. Also called the SNI. type: keyword tls.client.subject: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: tls-client-subject description: Distinguished name of subject of the x.509 certificate presented by the client. example: CN=myclient, OU=Documentation Team, DC=example, DC=com flat_name: tls.client.subject + ignore_above: 1024 level: extended name: client.subject normalize: [] short: Distinguished name of subject of the x.509 certificate presented by the client. - type: wildcard + type: keyword tls.client.supported_ciphers: dashed_name: tls-client-supported-ciphers description: Array of ciphers offered by the client during the client hello. @@ -7388,19 +7315,18 @@ tls.client.x509.issuer.country: short: List of country (C) codes type: keyword tls.client.x509.issuer.distinguished_name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: tls-client-x509-issuer-distinguished-name description: Distinguished name (DN) of issuing certificate authority. example: C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA flat_name: tls.client.x509.issuer.distinguished_name + ignore_above: 1024 level: extended name: issuer.distinguished_name normalize: [] original_fieldset: x509 short: Distinguished name (DN) of issuing certificate authority. - type: wildcard + type: keyword tls.client.x509.issuer.locality: dashed_name: tls-client-x509-issuer-locality description: List of locality names (L) @@ -7579,18 +7505,17 @@ tls.client.x509.subject.country: short: List of country (C) code type: keyword tls.client.x509.subject.distinguished_name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: tls-client-x509-subject-distinguished-name description: Distinguished name (DN) of the certificate subject entity. example: C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net flat_name: tls.client.x509.subject.distinguished_name + ignore_above: 1024 level: extended name: subject.distinguished_name normalize: [] original_fieldset: x509 short: Distinguished name (DN) of the certificate subject entity. - type: wildcard + type: keyword tls.client.x509.subject.locality: dashed_name: tls-client-x509-subject-locality description: List of locality names (L) @@ -7771,17 +7696,16 @@ tls.server.hash.sha256: certificate offered by the server. type: keyword tls.server.issuer: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: tls-server-issuer description: Subject of the issuer of the x.509 certificate presented by the server. example: CN=Example Root CA, OU=Infrastructure Team, DC=example, DC=com flat_name: tls.server.issuer + ignore_above: 1024 level: extended name: server.issuer normalize: [] short: Subject of the issuer of the x.509 certificate presented by the server. - type: wildcard + type: keyword tls.server.ja3s: dashed_name: tls-server-ja3s description: A hash that identifies servers based on how they perform an SSL/TLS @@ -7816,17 +7740,16 @@ tls.server.not_before: short: Timestamp indicating when server certificate is first considered valid. type: date tls.server.subject: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: tls-server-subject description: Subject of the x.509 certificate presented by the server. example: CN=www.example.com, OU=Infrastructure Team, DC=example, DC=com flat_name: tls.server.subject + ignore_above: 1024 level: extended name: server.subject normalize: [] short: Subject of the x.509 certificate presented by the server. - type: wildcard + type: keyword tls.server.x509.alternative_names: dashed_name: tls-server-x509-alternative-names description: List of subject alternative names (SAN). Name types vary by certificate @@ -7869,19 +7792,18 @@ tls.server.x509.issuer.country: short: List of country (C) codes type: keyword tls.server.x509.issuer.distinguished_name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: tls-server-x509-issuer-distinguished-name description: Distinguished name (DN) of issuing certificate authority. example: C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA flat_name: tls.server.x509.issuer.distinguished_name + ignore_above: 1024 level: extended name: issuer.distinguished_name normalize: [] original_fieldset: x509 short: Distinguished name (DN) of issuing certificate authority. - type: wildcard + type: keyword tls.server.x509.issuer.locality: dashed_name: tls-server-x509-issuer-locality description: List of locality names (L) @@ -8060,18 +7982,17 @@ tls.server.x509.subject.country: short: List of country (C) code type: keyword tls.server.x509.subject.distinguished_name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: tls-server-x509-subject-distinguished-name description: Distinguished name (DN) of the certificate subject entity. example: C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net flat_name: tls.server.x509.subject.distinguished_name + ignore_above: 1024 level: extended name: subject.distinguished_name normalize: [] original_fieldset: x509 short: Distinguished name (DN) of the certificate subject entity. - type: wildcard + type: keyword tls.server.x509.subject.locality: dashed_name: tls-server-x509-subject-locality description: List of locality names (L) @@ -8186,8 +8107,6 @@ transaction.id: short: Unique identifier of the transaction within the scope of its trace. type: keyword url.domain: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: url-domain description: 'Domain of the url, such as "www.elastic.co". @@ -8198,11 +8117,12 @@ url.domain: the `[` and `]` characters should also be captured in the `domain` field.' example: www.elastic.co flat_name: url.domain + ignore_above: 1024 level: extended name: domain normalize: [] short: Domain of the url. - type: wildcard + type: keyword url.extension: dashed_name: url-extension description: 'The field contains the file extension from the original request url, @@ -8236,13 +8156,12 @@ url.fragment: short: Portion of the url after the `#`. type: keyword url.full: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: url-full description: If full URLs are important to your use case, they should be stored in `url.full`, whether this field is reconstructed or present in the event source. example: https://www.elastic.co:443/search?q=elasticsearch#top flat_name: url.full + ignore_above: 1024 level: extended multi_fields: - flat_name: url.full.text @@ -8252,10 +8171,8 @@ url.full: name: full normalize: [] short: Full unparsed URL. - type: wildcard + type: keyword url.original: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: url-original description: 'Unmodified original url as seen in the event source. @@ -8265,6 +8182,7 @@ url.original: This field is meant to represent the URL as it was observed, complete or not.' example: https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch flat_name: url.original + ignore_above: 1024 level: extended multi_fields: - flat_name: url.original.text @@ -8274,7 +8192,7 @@ url.original: name: original normalize: [] short: Unmodified original url as seen in the event source. - type: wildcard + type: keyword url.password: dashed_name: url-password description: Password of the request. @@ -8286,16 +8204,15 @@ url.password: short: Password of the request. type: keyword url.path: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: url-path description: Path of the request, such as "/search". flat_name: url.path + ignore_above: 1024 level: extended name: path normalize: [] short: Path of the request, such as "/search". - type: wildcard + type: keyword url.port: dashed_name: url-port description: Port of the request, such as 443. @@ -8324,8 +8241,6 @@ url.query: short: Query string of the request. type: keyword url.registered_domain: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: url-registered-domain description: 'The highest registered url domain, stripped of the subdomain. @@ -8336,11 +8251,12 @@ url.registered_domain: two labels will not work well for TLDs such as "co.uk".' example: example.com flat_name: url.registered_domain + ignore_above: 1024 level: extended name: registered_domain normalize: [] short: The highest registered url domain, stripped of the subdomain. - type: wildcard + type: keyword url.scheme: dashed_name: url-scheme description: 'Scheme of the request, such as "https". @@ -8413,24 +8329,22 @@ user.changes.domain: short: Name of the directory the user is a member of. type: keyword user.changes.email: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: user-changes-email description: User email address. flat_name: user.changes.email + ignore_above: 1024 level: extended name: email normalize: [] original_fieldset: user short: User email address. - type: wildcard + type: keyword user.changes.full_name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: user-changes-full-name description: User's full name, if available. example: Albert Einstein flat_name: user.changes.full_name + ignore_above: 1024 level: extended multi_fields: - flat_name: user.changes.full_name.text @@ -8441,7 +8355,7 @@ user.changes.full_name: normalize: [] original_fieldset: user short: User's full name, if available. - type: wildcard + type: keyword user.changes.group.domain: dashed_name: user-changes-group-domain description: 'Name of the directory the group is a member of. @@ -8504,12 +8418,11 @@ user.changes.id: short: Unique identifier of the user. type: keyword user.changes.name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: user-changes-name description: Short name or login of the user. example: albert flat_name: user.changes.name + ignore_above: 1024 level: core multi_fields: - flat_name: user.changes.name.text @@ -8520,7 +8433,7 @@ user.changes.name: normalize: [] original_fieldset: user short: Short name or login of the user. - type: wildcard + type: keyword user.changes.roles: dashed_name: user-changes-roles description: Array of user roles at the time of the event. @@ -8560,24 +8473,22 @@ user.effective.domain: short: Name of the directory the user is a member of. type: keyword user.effective.email: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: user-effective-email description: User email address. flat_name: user.effective.email + ignore_above: 1024 level: extended name: email normalize: [] original_fieldset: user short: User email address. - type: wildcard + type: keyword user.effective.full_name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: user-effective-full-name description: User's full name, if available. example: Albert Einstein flat_name: user.effective.full_name + ignore_above: 1024 level: extended multi_fields: - flat_name: user.effective.full_name.text @@ -8588,7 +8499,7 @@ user.effective.full_name: normalize: [] original_fieldset: user short: User's full name, if available. - type: wildcard + type: keyword user.effective.group.domain: dashed_name: user-effective-group-domain description: 'Name of the directory the group is a member of. @@ -8651,12 +8562,11 @@ user.effective.id: short: Unique identifier of the user. type: keyword user.effective.name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: user-effective-name description: Short name or login of the user. example: albert flat_name: user.effective.name + ignore_above: 1024 level: core multi_fields: - flat_name: user.effective.name.text @@ -8667,7 +8577,7 @@ user.effective.name: normalize: [] original_fieldset: user short: Short name or login of the user. - type: wildcard + type: keyword user.effective.roles: dashed_name: user-effective-roles description: Array of user roles at the time of the event. @@ -8682,23 +8592,21 @@ user.effective.roles: short: Array of user roles at the time of the event. type: keyword user.email: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: user-email description: User email address. flat_name: user.email + ignore_above: 1024 level: extended name: email normalize: [] short: User email address. - type: wildcard + type: keyword user.full_name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: user-full-name description: User's full name, if available. example: Albert Einstein flat_name: user.full_name + ignore_above: 1024 level: extended multi_fields: - flat_name: user.full_name.text @@ -8708,7 +8616,7 @@ user.full_name: name: full_name normalize: [] short: User's full name, if available. - type: wildcard + type: keyword user.group.domain: dashed_name: user-group-domain description: 'Name of the directory the group is a member of. @@ -8769,12 +8677,11 @@ user.id: short: Unique identifier of the user. type: keyword user.name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: user-name description: Short name or login of the user. example: albert flat_name: user.name + ignore_above: 1024 level: core multi_fields: - flat_name: user.name.text @@ -8784,7 +8691,7 @@ user.name: name: name normalize: [] short: Short name or login of the user. - type: wildcard + type: keyword user.roles: dashed_name: user-roles description: Array of user roles at the time of the event. @@ -8811,24 +8718,22 @@ user.target.domain: short: Name of the directory the user is a member of. type: keyword user.target.email: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: user-target-email description: User email address. flat_name: user.target.email + ignore_above: 1024 level: extended name: email normalize: [] original_fieldset: user short: User email address. - type: wildcard + type: keyword user.target.full_name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: user-target-full-name description: User's full name, if available. example: Albert Einstein flat_name: user.target.full_name + ignore_above: 1024 level: extended multi_fields: - flat_name: user.target.full_name.text @@ -8839,7 +8744,7 @@ user.target.full_name: normalize: [] original_fieldset: user short: User's full name, if available. - type: wildcard + type: keyword user.target.group.domain: dashed_name: user-target-group-domain description: 'Name of the directory the group is a member of. @@ -8902,12 +8807,11 @@ user.target.id: short: Unique identifier of the user. type: keyword user.target.name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: user-target-name description: Short name or login of the user. example: albert flat_name: user.target.name + ignore_above: 1024 level: core multi_fields: - flat_name: user.target.name.text @@ -8918,7 +8822,7 @@ user.target.name: normalize: [] original_fieldset: user short: Short name or login of the user. - type: wildcard + type: keyword user.target.roles: dashed_name: user-target-roles description: Array of user roles at the time of the event. @@ -8955,13 +8859,12 @@ user_agent.name: short: Name of the user agent. type: keyword user_agent.original: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: user-agent-original description: Unparsed user_agent string. example: Mozilla/5.0 (iPhone; CPU iPhone OS 12_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1 flat_name: user_agent.original + ignore_above: 1024 level: extended multi_fields: - flat_name: user_agent.original.text @@ -8971,7 +8874,7 @@ user_agent.original: name: original normalize: [] short: Unparsed user_agent string. - type: wildcard + type: keyword user_agent.os.family: dashed_name: user-agent-os-family description: OS family (such as redhat, debian, freebsd, windows). @@ -8985,12 +8888,11 @@ user_agent.os.family: short: OS family (such as redhat, debian, freebsd, windows). type: keyword user_agent.os.full: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: user-agent-os-full description: Operating system name, including the version or code name. example: Mac OS Mojave flat_name: user_agent.os.full + ignore_above: 1024 level: extended multi_fields: - flat_name: user_agent.os.full.text @@ -9001,7 +8903,7 @@ user_agent.os.full: normalize: [] original_fieldset: os short: Operating system name, including the version or code name. - type: wildcard + type: keyword user_agent.os.kernel: dashed_name: user-agent-os-kernel description: Operating system kernel version as a raw string. @@ -9015,12 +8917,11 @@ user_agent.os.kernel: short: Operating system kernel version as a raw string. type: keyword user_agent.os.name: - beta: Note the usage of `wildcard` type is considered beta. This field used to be - type `keyword`. dashed_name: user-agent-os-name description: Operating system name, without the version. example: Mac OS X flat_name: user_agent.os.name + ignore_above: 1024 level: extended multi_fields: - flat_name: user_agent.os.name.text @@ -9031,7 +8932,7 @@ user_agent.os.name: normalize: [] original_fieldset: os short: Operating system name, without the version. - type: wildcard + type: keyword user_agent.os.platform: dashed_name: user-agent-os-platform description: Operating system platform (such centos, ubuntu, windows). diff --git a/generated/ecs/ecs_nested.yml b/generated/ecs/ecs_nested.yml index 47cd8526ef..a544901609 100644 --- a/generated/ecs/ecs_nested.yml +++ b/generated/ecs/ecs_nested.yml @@ -8,8 +8,6 @@ agent: event happened or the measurement was taken.' fields: agent.build.original: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: agent-build-original description: 'Extended build information for the agent. @@ -18,11 +16,12 @@ agent: example: metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC] flat_name: agent.build.original + ignore_above: 1024 level: core name: build.original normalize: [] short: Extended build information for the agent. - type: wildcard + type: keyword agent.ephemeral_id: dashed_name: agent-ephemeral-id description: 'Ephemeral identifier of this agent (if one exists). @@ -120,12 +119,11 @@ as: short: Unique number allocated to the autonomous system. type: long as.organization.name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: as-organization-name description: Organization name. example: Google LLC flat_name: as.organization.name + ignore_above: 1024 level: extended multi_fields: - flat_name: as.organization.name.text @@ -135,7 +133,7 @@ as: name: organization.name normalize: [] short: Organization name. - type: wildcard + type: keyword group: 2 name: as prefix: as. @@ -277,12 +275,11 @@ client: short: Unique number allocated to the autonomous system. type: long client.as.organization.name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: client-as-organization-name description: Organization name. example: Google LLC flat_name: client.as.organization.name + ignore_above: 1024 level: extended multi_fields: - flat_name: client.as.organization.name.text @@ -293,7 +290,7 @@ client: normalize: [] original_fieldset: as short: Organization name. - type: wildcard + type: keyword client.bytes: dashed_name: client-bytes description: Bytes sent from the client to the server. @@ -306,16 +303,15 @@ client: short: Bytes sent from the client to the server. type: long client.domain: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: client-domain description: Client domain. flat_name: client.domain + ignore_above: 1024 level: core name: domain normalize: [] short: Client domain. - type: wildcard + type: keyword client.geo.city_name: dashed_name: client-geo-city-name description: City name. @@ -376,8 +372,6 @@ client: short: Longitude and latitude. type: geo_point client.geo.name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: client-geo-name description: 'User-defined description of a location, at the level of granularity they care about. @@ -388,12 +382,13 @@ client: Not typically used in automated geolocation.' example: boston-dc flat_name: client.geo.name + ignore_above: 1024 level: extended name: name normalize: [] original_fieldset: geo short: User-defined description of a location. - type: wildcard + type: keyword client.geo.region_iso_code: dashed_name: client-geo-region-iso-code description: Region ISO code. @@ -483,8 +478,6 @@ client: short: Port of the client. type: long client.registered_domain: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: client-registered-domain description: 'The highest registered client domain, stripped of the subdomain. @@ -495,11 +488,12 @@ client: the last two labels will not work well for TLDs such as "co.uk".' example: example.com flat_name: client.registered_domain + ignore_above: 1024 level: extended name: registered_domain normalize: [] short: The highest registered client domain, stripped of the subdomain. - type: wildcard + type: keyword client.subdomain: dashed_name: client-subdomain description: 'The subdomain portion of a fully qualified domain name includes @@ -549,24 +543,22 @@ client: short: Name of the directory the user is a member of. type: keyword client.user.email: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: client-user-email description: User email address. flat_name: client.user.email + ignore_above: 1024 level: extended name: email normalize: [] original_fieldset: user short: User email address. - type: wildcard + type: keyword client.user.full_name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: client-user-full-name description: User's full name, if available. example: Albert Einstein flat_name: client.user.full_name + ignore_above: 1024 level: extended multi_fields: - flat_name: client.user.full_name.text @@ -577,7 +569,7 @@ client: normalize: [] original_fieldset: user short: User's full name, if available. - type: wildcard + type: keyword client.user.group.domain: dashed_name: client-user-group-domain description: 'Name of the directory the group is a member of. @@ -640,12 +632,11 @@ client: short: Unique identifier of the user. type: keyword client.user.name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: client-user-name description: Short name or login of the user. example: albert flat_name: client.user.name + ignore_above: 1024 level: core multi_fields: - flat_name: client.user.name.text @@ -656,7 +647,7 @@ client: normalize: [] original_fieldset: user short: Short name or login of the user. - type: wildcard + type: keyword client.user.roles: dashed_name: client-user-roles description: Array of user roles at the time of the event. @@ -1022,12 +1013,11 @@ destination: short: Unique number allocated to the autonomous system. type: long destination.as.organization.name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: destination-as-organization-name description: Organization name. example: Google LLC flat_name: destination.as.organization.name + ignore_above: 1024 level: extended multi_fields: - flat_name: destination.as.organization.name.text @@ -1038,7 +1028,7 @@ destination: normalize: [] original_fieldset: as short: Organization name. - type: wildcard + type: keyword destination.bytes: dashed_name: destination-bytes description: Bytes sent from the destination to the source. @@ -1051,16 +1041,15 @@ destination: short: Bytes sent from the destination to the source. type: long destination.domain: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: destination-domain description: Destination domain. flat_name: destination.domain + ignore_above: 1024 level: core name: domain normalize: [] short: Destination domain. - type: wildcard + type: keyword destination.geo.city_name: dashed_name: destination-geo-city-name description: City name. @@ -1121,8 +1110,6 @@ destination: short: Longitude and latitude. type: geo_point destination.geo.name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: destination-geo-name description: 'User-defined description of a location, at the level of granularity they care about. @@ -1133,12 +1120,13 @@ destination: Not typically used in automated geolocation.' example: boston-dc flat_name: destination.geo.name + ignore_above: 1024 level: extended name: name normalize: [] original_fieldset: geo short: User-defined description of a location. - type: wildcard + type: keyword destination.geo.region_iso_code: dashed_name: destination-geo-region-iso-code description: Region ISO code. @@ -1227,8 +1215,6 @@ destination: short: Port of the destination. type: long destination.registered_domain: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: destination-registered-domain description: 'The highest registered destination domain, stripped of the subdomain. @@ -1239,11 +1225,12 @@ destination: the last two labels will not work well for TLDs such as "co.uk".' example: example.com flat_name: destination.registered_domain + ignore_above: 1024 level: extended name: registered_domain normalize: [] short: The highest registered destination domain, stripped of the subdomain. - type: wildcard + type: keyword destination.subdomain: dashed_name: destination-subdomain description: 'The subdomain portion of a fully qualified domain name includes @@ -1293,24 +1280,22 @@ destination: short: Name of the directory the user is a member of. type: keyword destination.user.email: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: destination-user-email description: User email address. flat_name: destination.user.email + ignore_above: 1024 level: extended name: email normalize: [] original_fieldset: user short: User email address. - type: wildcard + type: keyword destination.user.full_name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: destination-user-full-name description: User's full name, if available. example: Albert Einstein flat_name: destination.user.full_name + ignore_above: 1024 level: extended multi_fields: - flat_name: destination.user.full_name.text @@ -1321,7 +1306,7 @@ destination: normalize: [] original_fieldset: user short: User's full name, if available. - type: wildcard + type: keyword destination.user.group.domain: dashed_name: destination-user-group-domain description: 'Name of the directory the group is a member of. @@ -1384,12 +1369,11 @@ destination: short: Unique identifier of the user. type: keyword destination.user.name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: destination-user-name description: Short name or login of the user. example: albert flat_name: destination.user.name + ignore_above: 1024 level: core multi_fields: - flat_name: destination.user.name.text @@ -1400,7 +1384,7 @@ destination: normalize: [] original_fieldset: user short: Short name or login of the user. - type: wildcard + type: keyword destination.user.roles: dashed_name: destination-user-roles description: Array of user roles at the time of the event. @@ -1649,18 +1633,17 @@ dll: short: A hash of the imports in a PE file. type: keyword dll.pe.original_file_name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: dll-pe-original-file-name description: Internal name of the file, provided at compile-time. example: MSPAINT.EXE flat_name: dll.pe.original_file_name + ignore_above: 1024 level: extended name: original_file_name normalize: [] original_fieldset: pe short: Internal name of the file, provided at compile-time. - type: wildcard + type: keyword dll.pe.product: dashed_name: dll-pe-product description: Internal product name of the file, provided at compile-time. @@ -1732,19 +1715,18 @@ dns: short: The class of DNS data contained in this resource record. type: keyword dns.answers.data: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: dns-answers-data description: 'The data describing the resource. The meaning of this data depends on the type and class of the resource record.' example: 10.10.10.10 flat_name: dns.answers.data + ignore_above: 1024 level: extended name: answers.data normalize: [] short: The data describing the resource. - type: wildcard + type: keyword dns.answers.name: dashed_name: dns-answers-name description: 'The domain name to which this resource record pertains. @@ -1836,8 +1818,6 @@ dns: short: The class of records being queried. type: keyword dns.question.name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: dns-question-name description: 'The name being queried. @@ -1847,11 +1827,12 @@ dns: feeds should be converted to \t, \r, and \n respectively.' example: www.example.com flat_name: dns.question.name + ignore_above: 1024 level: extended name: question.name normalize: [] short: The name being queried. - type: wildcard + type: keyword dns.question.registered_domain: dashed_name: dns-question-registered-domain description: 'The highest registered domain, stripped of the subdomain. @@ -2025,11 +2006,12 @@ error: short: Error message. type: text error.stack_trace: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: error-stack-trace description: The stack trace of this error in plain text. + doc_values: false flat_name: error.stack_trace + ignore_above: 1024 + index: false level: extended multi_fields: - flat_name: error.stack_trace.text @@ -2039,19 +2021,18 @@ error: name: stack_trace normalize: [] short: The stack trace of this error in plain text. - type: wildcard + type: keyword error.type: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: error-type description: The type of the error, for example the class name of the exception. example: java.lang.NullPointerException flat_name: error.type + ignore_above: 1024 level: extended name: type normalize: [] short: The type of the error, for example the class name of the exception. - type: wildcard + type: keyword group: 2 name: error prefix: error. @@ -2980,18 +2961,17 @@ file: short: Device that is the source of the file. type: keyword file.directory: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: file-directory description: Directory where the file is located. It should include the drive letter, when appropriate. example: /home/alice flat_name: file.directory + ignore_above: 1024 level: extended name: directory normalize: [] short: Directory where the file is located. - type: wildcard + type: keyword file.drive_letter: dashed_name: file-drive-letter description: 'Drive letter where the file is located. This field is only relevant @@ -3153,13 +3133,12 @@ file: short: File owner's username. type: keyword file.path: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: file-path description: Full path to the file, including the file name. It should include the drive letter, when appropriate. example: /home/alice/example.png flat_name: file.path + ignore_above: 1024 level: extended multi_fields: - flat_name: file.path.text @@ -3169,7 +3148,7 @@ file: name: path normalize: [] short: Full path to the file, including the file name. - type: wildcard + type: keyword file.pe.architecture: dashed_name: file-pe-architecture description: CPU architecture target for the file. @@ -3235,18 +3214,17 @@ file: short: A hash of the imports in a PE file. type: keyword file.pe.original_file_name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: file-pe-original-file-name description: Internal name of the file, provided at compile-time. example: MSPAINT.EXE flat_name: file.pe.original_file_name + ignore_above: 1024 level: extended name: original_file_name normalize: [] original_fieldset: pe short: Internal name of the file, provided at compile-time. - type: wildcard + type: keyword file.pe.product: dashed_name: file-pe-product description: Internal product name of the file, provided at compile-time. @@ -3272,11 +3250,10 @@ file: short: File size in bytes. type: long file.target_path: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: file-target-path description: Target path for symlinks. flat_name: file.target_path + ignore_above: 1024 level: extended multi_fields: - flat_name: file.target_path.text @@ -3286,7 +3263,7 @@ file: name: target_path normalize: [] short: Target path for symlinks. - type: wildcard + type: keyword file.type: dashed_name: file-type description: File type (file, dir, or symlink). @@ -3351,19 +3328,18 @@ file: short: List of country (C) codes type: keyword file.x509.issuer.distinguished_name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: file-x509-issuer-distinguished-name description: Distinguished name (DN) of issuing certificate authority. example: C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA flat_name: file.x509.issuer.distinguished_name + ignore_above: 1024 level: extended name: issuer.distinguished_name normalize: [] original_fieldset: x509 short: Distinguished name (DN) of issuing certificate authority. - type: wildcard + type: keyword file.x509.issuer.locality: dashed_name: file-x509-issuer-locality description: List of locality names (L) @@ -3542,18 +3518,17 @@ file: short: List of country (C) code type: keyword file.x509.subject.distinguished_name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: file-x509-subject-distinguished-name description: Distinguished name (DN) of the certificate subject entity. example: C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net flat_name: file.x509.subject.distinguished_name + ignore_above: 1024 level: extended name: subject.distinguished_name normalize: [] original_fieldset: x509 short: Distinguished name (DN) of the certificate subject entity. - type: wildcard + type: keyword file.x509.subject.locality: dashed_name: file-x509-subject-locality description: List of locality names (L) @@ -3703,8 +3678,6 @@ geo: short: Longitude and latitude. type: geo_point geo.name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: geo-name description: 'User-defined description of a location, at the level of granularity they care about. @@ -3715,11 +3688,12 @@ geo: Not typically used in automated geolocation.' example: boston-dc flat_name: geo.name + ignore_above: 1024 level: extended name: name normalize: [] short: User-defined description of a location. - type: wildcard + type: keyword geo.region_iso_code: dashed_name: geo-region-iso-code description: Region ISO code. @@ -3975,8 +3949,6 @@ host: short: Longitude and latitude. type: geo_point host.geo.name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: host-geo-name description: 'User-defined description of a location, at the level of granularity they care about. @@ -3987,12 +3959,13 @@ host: Not typically used in automated geolocation.' example: boston-dc flat_name: host.geo.name + ignore_above: 1024 level: extended name: name normalize: [] original_fieldset: geo short: User-defined description of a location. - type: wildcard + type: keyword host.geo.region_iso_code: dashed_name: host-geo-region-iso-code description: Region ISO code. @@ -4018,18 +3991,17 @@ host: short: Region name. type: keyword host.hostname: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: host-hostname description: 'Hostname of the host. It normally contains what the `hostname` command returns on the host machine.' flat_name: host.hostname + ignore_above: 1024 level: core name: hostname normalize: [] short: Hostname of the host. - type: wildcard + type: keyword host.id: dashed_name: host-id description: 'Unique host id. @@ -4092,12 +4064,11 @@ host: short: OS family (such as redhat, debian, freebsd, windows). type: keyword host.os.full: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: host-os-full description: Operating system name, including the version or code name. example: Mac OS Mojave flat_name: host.os.full + ignore_above: 1024 level: extended multi_fields: - flat_name: host.os.full.text @@ -4108,7 +4079,7 @@ host: normalize: [] original_fieldset: os short: Operating system name, including the version or code name. - type: wildcard + type: keyword host.os.kernel: dashed_name: host-os-kernel description: Operating system kernel version as a raw string. @@ -4122,12 +4093,11 @@ host: short: Operating system kernel version as a raw string. type: keyword host.os.name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: host-os-name description: Operating system name, without the version. example: Mac OS X flat_name: host.os.name + ignore_above: 1024 level: extended multi_fields: - flat_name: host.os.name.text @@ -4138,7 +4108,7 @@ host: normalize: [] original_fieldset: os short: Operating system name, without the version. - type: wildcard + type: keyword host.os.platform: dashed_name: host-os-platform description: Operating system platform (such centos, ubuntu, windows). @@ -4221,24 +4191,22 @@ host: short: Name of the directory the user is a member of. type: keyword host.user.email: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: host-user-email description: User email address. flat_name: host.user.email + ignore_above: 1024 level: extended name: email normalize: [] original_fieldset: user short: User email address. - type: wildcard + type: keyword host.user.full_name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: host-user-full-name description: User's full name, if available. example: Albert Einstein flat_name: host.user.full_name + ignore_above: 1024 level: extended multi_fields: - flat_name: host.user.full_name.text @@ -4249,7 +4217,7 @@ host: normalize: [] original_fieldset: user short: User's full name, if available. - type: wildcard + type: keyword host.user.group.domain: dashed_name: host-user-group-domain description: 'Name of the directory the group is a member of. @@ -4312,12 +4280,11 @@ host: short: Unique identifier of the user. type: keyword host.user.name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: host-user-name description: Short name or login of the user. example: albert flat_name: host.user.name + ignore_above: 1024 level: core multi_fields: - flat_name: host.user.name.text @@ -4328,7 +4295,7 @@ host: normalize: [] original_fieldset: user short: Short name or login of the user. - type: wildcard + type: keyword host.user.roles: dashed_name: host-user-roles description: Array of user roles at the time of the event. @@ -4378,12 +4345,11 @@ http: short: Size in bytes of the request body. type: long http.request.body.content: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: http-request-body-content description: The full HTTP request body. example: Hello world flat_name: http.request.body.content + ignore_above: 1024 level: extended multi_fields: - flat_name: http.request.body.content.text @@ -4393,7 +4359,7 @@ http: name: request.body.content normalize: [] short: The full HTTP request body. - type: wildcard + type: keyword http.request.bytes: dashed_name: http-request-bytes description: Total size in bytes of the request (body and headers). @@ -4441,17 +4407,16 @@ http: short: Mime type of the body of the request. type: keyword http.request.referrer: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: http-request-referrer description: Referrer for this HTTP request. example: https://blog.example.com/ flat_name: http.request.referrer + ignore_above: 1024 level: extended name: request.referrer normalize: [] short: Referrer for this HTTP request. - type: wildcard + type: keyword http.response.body.bytes: dashed_name: http-response-body-bytes description: Size in bytes of the response body. @@ -4464,12 +4429,11 @@ http: short: Size in bytes of the response body. type: long http.response.body.content: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: http-response-body-content description: The full HTTP response body. example: Hello world flat_name: http.response.body.content + ignore_above: 1024 level: extended multi_fields: - flat_name: http.response.body.content.text @@ -4479,7 +4443,7 @@ http: name: response.body.content normalize: [] short: The full HTTP response body. - type: wildcard + type: keyword http.response.bytes: dashed_name: http-response-bytes description: Total size in bytes of the response (body and headers). @@ -4603,8 +4567,6 @@ log: but rather in `event.*` or in other ECS fields.' fields: log.file.path: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: log-file-path description: 'Full path to the log file this event came from, including the file name. It should include the drive letter, when appropriate. @@ -4612,11 +4574,12 @@ log: If the event wasn''t read from a log file, do not populate this field.' example: /var/log/fun-times.log flat_name: log.file.path + ignore_above: 1024 level: extended name: file.path normalize: [] short: Full path to the log file this event came from. - type: wildcard + type: keyword log.level: dashed_name: log-level description: 'Original log level of the log event. @@ -4635,18 +4598,17 @@ log: short: Log level of the log event. type: keyword log.logger: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: log-logger description: The name of the logger inside an application. This is usually the name of the class which initialized the logger, or can be a custom name. example: org.elasticsearch.bootstrap.Bootstrap flat_name: log.logger + ignore_above: 1024 level: core name: logger normalize: [] short: Name of the logger. - type: wildcard + type: keyword log.origin.file.line: dashed_name: log-origin-file-line description: The line number of the file containing the source code which originated @@ -5198,8 +5160,6 @@ observer: short: Longitude and latitude. type: geo_point observer.geo.name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: observer-geo-name description: 'User-defined description of a location, at the level of granularity they care about. @@ -5210,12 +5170,13 @@ observer: Not typically used in automated geolocation.' example: boston-dc flat_name: observer.geo.name + ignore_above: 1024 level: extended name: name normalize: [] original_fieldset: geo short: User-defined description of a location. - type: wildcard + type: keyword observer.geo.region_iso_code: dashed_name: observer-geo-region-iso-code description: Region ISO code. @@ -5387,12 +5348,11 @@ observer: short: OS family (such as redhat, debian, freebsd, windows). type: keyword observer.os.full: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: observer-os-full description: Operating system name, including the version or code name. example: Mac OS Mojave flat_name: observer.os.full + ignore_above: 1024 level: extended multi_fields: - flat_name: observer.os.full.text @@ -5403,7 +5363,7 @@ observer: normalize: [] original_fieldset: os short: Operating system name, including the version or code name. - type: wildcard + type: keyword observer.os.kernel: dashed_name: observer-os-kernel description: Operating system kernel version as a raw string. @@ -5417,12 +5377,11 @@ observer: short: Operating system kernel version as a raw string. type: keyword observer.os.name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: observer-os-name description: Operating system name, without the version. example: Mac OS X flat_name: observer.os.name + ignore_above: 1024 level: extended multi_fields: - flat_name: observer.os.name.text @@ -5433,7 +5392,7 @@ observer: normalize: [] original_fieldset: os short: Operating system name, without the version. - type: wildcard + type: keyword observer.os.platform: dashed_name: observer-os-platform description: Operating system platform (such centos, ubuntu, windows). @@ -5584,11 +5543,10 @@ organization: short: Unique identifier for the organization. type: keyword organization.name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: organization-name description: Organization name. flat_name: organization.name + ignore_above: 1024 level: extended multi_fields: - flat_name: organization.name.text @@ -5598,7 +5556,7 @@ organization: name: name normalize: [] short: Organization name. - type: wildcard + type: keyword group: 2 name: organization prefix: organization. @@ -5620,12 +5578,11 @@ os: short: OS family (such as redhat, debian, freebsd, windows). type: keyword os.full: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: os-full description: Operating system name, including the version or code name. example: Mac OS Mojave flat_name: os.full + ignore_above: 1024 level: extended multi_fields: - flat_name: os.full.text @@ -5635,7 +5592,7 @@ os: name: full normalize: [] short: Operating system name, including the version or code name. - type: wildcard + type: keyword os.kernel: dashed_name: os-kernel description: Operating system kernel version as a raw string. @@ -5648,12 +5605,11 @@ os: short: Operating system kernel version as a raw string. type: keyword os.name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: os-name description: Operating system name, without the version. example: Mac OS X flat_name: os.name + ignore_above: 1024 level: extended multi_fields: - flat_name: os.name.text @@ -5663,7 +5619,7 @@ os: name: name normalize: [] short: Operating system name, without the version. - type: wildcard + type: keyword os.platform: dashed_name: os-platform description: Operating system platform (such centos, ubuntu, windows). @@ -5949,17 +5905,16 @@ pe: short: A hash of the imports in a PE file. type: keyword pe.original_file_name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: pe-original-file-name description: Internal name of the file, provided at compile-time. example: MSPAINT.EXE flat_name: pe.original_file_name + ignore_above: 1024 level: extended name: original_file_name normalize: [] short: Internal name of the file, provided at compile-time. - type: wildcard + type: keyword pe.product: dashed_name: pe-product description: Internal product name of the file, provided at compile-time. @@ -6094,8 +6049,6 @@ process: content. type: boolean process.command_line: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: process-command-line description: 'Full command line that started the process, including the absolute path to the executable, and all arguments. @@ -6103,6 +6056,7 @@ process: Some arguments may be filtered to protect sensitive information.' example: /usr/bin/ssh -l user 10.0.0.16 flat_name: process.command_line + ignore_above: 1024 level: extended multi_fields: - flat_name: process.command_line.text @@ -6112,7 +6066,7 @@ process: name: command_line normalize: [] short: Full command line that started the process. - type: wildcard + type: keyword process.entity_id: dashed_name: process-entity-id description: 'Unique identifier for the process. @@ -6133,12 +6087,11 @@ process: short: Unique identifier for the process. type: keyword process.executable: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: process-executable description: Absolute path to the process executable. example: /usr/bin/ssh flat_name: process.executable + ignore_above: 1024 level: extended multi_fields: - flat_name: process.executable.text @@ -6148,7 +6101,7 @@ process: name: executable normalize: [] short: Absolute path to the process executable. - type: wildcard + type: keyword process.exit_code: dashed_name: process-exit-code description: 'The exit code of the process, if this is a termination event. @@ -6207,14 +6160,13 @@ process: short: SHA512 hash. type: keyword process.name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: process-name description: 'Process name. Sometimes called program name or similar.' example: ssh flat_name: process.name + ignore_above: 1024 level: extended multi_fields: - flat_name: process.name.text @@ -6224,7 +6176,7 @@ process: name: name normalize: [] short: Process name. - type: wildcard + type: keyword process.parent.args: dashed_name: process-parent-args description: 'Array of process arguments, starting with the absolute path to @@ -6325,8 +6277,6 @@ process: content. type: boolean process.parent.command_line: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: process-parent-command-line description: 'Full command line that started the process, including the absolute path to the executable, and all arguments. @@ -6334,6 +6284,7 @@ process: Some arguments may be filtered to protect sensitive information.' example: /usr/bin/ssh -l user 10.0.0.16 flat_name: process.parent.command_line + ignore_above: 1024 level: extended multi_fields: - flat_name: process.parent.command_line.text @@ -6344,7 +6295,7 @@ process: normalize: [] original_fieldset: process short: Full command line that started the process. - type: wildcard + type: keyword process.parent.entity_id: dashed_name: process-parent-entity-id description: 'Unique identifier for the process. @@ -6366,12 +6317,11 @@ process: short: Unique identifier for the process. type: keyword process.parent.executable: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: process-parent-executable description: Absolute path to the process executable. example: /usr/bin/ssh flat_name: process.parent.executable + ignore_above: 1024 level: extended multi_fields: - flat_name: process.parent.executable.text @@ -6382,7 +6332,7 @@ process: normalize: [] original_fieldset: process short: Absolute path to the process executable. - type: wildcard + type: keyword process.parent.exit_code: dashed_name: process-parent-exit-code description: 'The exit code of the process, if this is a termination event. @@ -6442,14 +6392,13 @@ process: short: SHA512 hash. type: keyword process.parent.name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: process-parent-name description: 'Process name. Sometimes called program name or similar.' example: ssh flat_name: process.parent.name + ignore_above: 1024 level: extended multi_fields: - flat_name: process.parent.name.text @@ -6460,7 +6409,7 @@ process: normalize: [] original_fieldset: process short: Process name. - type: wildcard + type: keyword process.parent.pe.architecture: dashed_name: process-parent-pe-architecture description: CPU architecture target for the file. @@ -6526,18 +6475,17 @@ process: short: A hash of the imports in a PE file. type: keyword process.parent.pe.original_file_name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: process-parent-pe-original-file-name description: Internal name of the file, provided at compile-time. example: MSPAINT.EXE flat_name: process.parent.pe.original_file_name + ignore_above: 1024 level: extended name: original_file_name normalize: [] original_fieldset: pe short: Internal name of the file, provided at compile-time. - type: wildcard + type: keyword process.parent.pe.product: dashed_name: process-parent-pe-product description: Internal product name of the file, provided at compile-time. @@ -6609,27 +6557,25 @@ process: short: Thread ID. type: long process.parent.thread.name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: process-parent-thread-name description: Thread name. example: thread-0 flat_name: process.parent.thread.name + ignore_above: 1024 level: extended name: thread.name normalize: [] original_fieldset: process short: Thread name. - type: wildcard + type: keyword process.parent.title: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: process-parent-title description: 'Process title. The proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened.' flat_name: process.parent.title + ignore_above: 1024 level: extended multi_fields: - flat_name: process.parent.title.text @@ -6640,7 +6586,7 @@ process: normalize: [] original_fieldset: process short: Process title. - type: wildcard + type: keyword process.parent.uptime: dashed_name: process-parent-uptime description: Seconds the process has been up. @@ -6653,12 +6599,11 @@ process: short: Seconds the process has been up. type: long process.parent.working_directory: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: process-parent-working-directory description: The working directory of the process. example: /home/alice flat_name: process.parent.working_directory + ignore_above: 1024 level: extended multi_fields: - flat_name: process.parent.working_directory.text @@ -6669,7 +6614,7 @@ process: normalize: [] original_fieldset: process short: The working directory of the process. - type: wildcard + type: keyword process.pe.architecture: dashed_name: process-pe-architecture description: CPU architecture target for the file. @@ -6735,18 +6680,17 @@ process: short: A hash of the imports in a PE file. type: keyword process.pe.original_file_name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: process-pe-original-file-name description: Internal name of the file, provided at compile-time. example: MSPAINT.EXE flat_name: process.pe.original_file_name + ignore_above: 1024 level: extended name: original_file_name normalize: [] original_fieldset: pe short: Internal name of the file, provided at compile-time. - type: wildcard + type: keyword process.pe.product: dashed_name: process-pe-product description: Internal product name of the file, provided at compile-time. @@ -6813,26 +6757,24 @@ process: short: Thread ID. type: long process.thread.name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: process-thread-name description: Thread name. example: thread-0 flat_name: process.thread.name + ignore_above: 1024 level: extended name: thread.name normalize: [] short: Thread name. - type: wildcard + type: keyword process.title: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: process-title description: 'Process title. The proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened.' flat_name: process.title + ignore_above: 1024 level: extended multi_fields: - flat_name: process.title.text @@ -6842,7 +6784,7 @@ process: name: title normalize: [] short: Process title. - type: wildcard + type: keyword process.uptime: dashed_name: process-uptime description: Seconds the process has been up. @@ -6854,12 +6796,11 @@ process: short: Seconds the process has been up. type: long process.working_directory: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: process-working-directory description: The working directory of the process. example: /home/alice flat_name: process.working_directory + ignore_above: 1024 level: extended multi_fields: - flat_name: process.working_directory.text @@ -6869,7 +6810,7 @@ process: name: working_directory normalize: [] short: The working directory of the process. - type: wildcard + type: keyword group: 2 name: process nestings: @@ -6919,8 +6860,6 @@ registry: short: Original bytes written with base64 encoding. type: keyword registry.data.strings: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: registry-data-strings description: 'Content when writing string types. @@ -6931,12 +6870,13 @@ registry: be populated with the decimal representation (e.g `"1"`).' example: '["C:\rta\red_ttp\bin\myapp.exe"]' flat_name: registry.data.strings + ignore_above: 1024 level: core name: data.strings normalize: - array short: List of strings representing what was written to the registry. - type: wildcard + type: keyword registry.data.type: dashed_name: registry-data-type description: Standard registry type for encoding contents @@ -6960,30 +6900,28 @@ registry: short: Abbreviated name for the hive. type: keyword registry.key: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: registry-key description: Hive-relative path of keys. example: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe flat_name: registry.key + ignore_above: 1024 level: core name: key normalize: [] short: Hive-relative path of keys. - type: wildcard + type: keyword registry.path: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: registry-path description: Full path, including hive, key and value example: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe\Debugger flat_name: registry.path + ignore_above: 1024 level: core name: path normalize: [] short: Full path, including hive, key and value - type: wildcard + type: keyword registry.value: dashed_name: registry-value description: Name of the value written. @@ -7248,12 +7186,11 @@ server: short: Unique number allocated to the autonomous system. type: long server.as.organization.name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: server-as-organization-name description: Organization name. example: Google LLC flat_name: server.as.organization.name + ignore_above: 1024 level: extended multi_fields: - flat_name: server.as.organization.name.text @@ -7264,7 +7201,7 @@ server: normalize: [] original_fieldset: as short: Organization name. - type: wildcard + type: keyword server.bytes: dashed_name: server-bytes description: Bytes sent from the server to the client. @@ -7277,16 +7214,15 @@ server: short: Bytes sent from the server to the client. type: long server.domain: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: server-domain description: Server domain. flat_name: server.domain + ignore_above: 1024 level: core name: domain normalize: [] short: Server domain. - type: wildcard + type: keyword server.geo.city_name: dashed_name: server-geo-city-name description: City name. @@ -7347,8 +7283,6 @@ server: short: Longitude and latitude. type: geo_point server.geo.name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: server-geo-name description: 'User-defined description of a location, at the level of granularity they care about. @@ -7359,12 +7293,13 @@ server: Not typically used in automated geolocation.' example: boston-dc flat_name: server.geo.name + ignore_above: 1024 level: extended name: name normalize: [] original_fieldset: geo short: User-defined description of a location. - type: wildcard + type: keyword server.geo.region_iso_code: dashed_name: server-geo-region-iso-code description: Region ISO code. @@ -7454,8 +7389,6 @@ server: short: Port of the server. type: long server.registered_domain: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: server-registered-domain description: 'The highest registered server domain, stripped of the subdomain. @@ -7466,11 +7399,12 @@ server: the last two labels will not work well for TLDs such as "co.uk".' example: example.com flat_name: server.registered_domain + ignore_above: 1024 level: extended name: registered_domain normalize: [] short: The highest registered server domain, stripped of the subdomain. - type: wildcard + type: keyword server.subdomain: dashed_name: server-subdomain description: 'The subdomain portion of a fully qualified domain name includes @@ -7520,24 +7454,22 @@ server: short: Name of the directory the user is a member of. type: keyword server.user.email: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: server-user-email description: User email address. flat_name: server.user.email + ignore_above: 1024 level: extended name: email normalize: [] original_fieldset: user short: User email address. - type: wildcard + type: keyword server.user.full_name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: server-user-full-name description: User's full name, if available. example: Albert Einstein flat_name: server.user.full_name + ignore_above: 1024 level: extended multi_fields: - flat_name: server.user.full_name.text @@ -7548,7 +7480,7 @@ server: normalize: [] original_fieldset: user short: User's full name, if available. - type: wildcard + type: keyword server.user.group.domain: dashed_name: server-user-group-domain description: 'Name of the directory the group is a member of. @@ -7611,12 +7543,11 @@ server: short: Unique identifier of the user. type: keyword server.user.name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: server-user-name description: Short name or login of the user. example: albert flat_name: server.user.name + ignore_above: 1024 level: core multi_fields: - flat_name: server.user.name.text @@ -7627,7 +7558,7 @@ server: normalize: [] original_fieldset: user short: Short name or login of the user. - type: wildcard + type: keyword server.user.roles: dashed_name: server-user-roles description: Array of user roles at the time of the event. @@ -7825,12 +7756,11 @@ source: short: Unique number allocated to the autonomous system. type: long source.as.organization.name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: source-as-organization-name description: Organization name. example: Google LLC flat_name: source.as.organization.name + ignore_above: 1024 level: extended multi_fields: - flat_name: source.as.organization.name.text @@ -7841,7 +7771,7 @@ source: normalize: [] original_fieldset: as short: Organization name. - type: wildcard + type: keyword source.bytes: dashed_name: source-bytes description: Bytes sent from the source to the destination. @@ -7854,16 +7784,15 @@ source: short: Bytes sent from the source to the destination. type: long source.domain: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: source-domain description: Source domain. flat_name: source.domain + ignore_above: 1024 level: core name: domain normalize: [] short: Source domain. - type: wildcard + type: keyword source.geo.city_name: dashed_name: source-geo-city-name description: City name. @@ -7924,8 +7853,6 @@ source: short: Longitude and latitude. type: geo_point source.geo.name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: source-geo-name description: 'User-defined description of a location, at the level of granularity they care about. @@ -7936,12 +7863,13 @@ source: Not typically used in automated geolocation.' example: boston-dc flat_name: source.geo.name + ignore_above: 1024 level: extended name: name normalize: [] original_fieldset: geo short: User-defined description of a location. - type: wildcard + type: keyword source.geo.region_iso_code: dashed_name: source-geo-region-iso-code description: Region ISO code. @@ -8031,8 +7959,6 @@ source: short: Port of the source. type: long source.registered_domain: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: source-registered-domain description: 'The highest registered source domain, stripped of the subdomain. @@ -8043,11 +7969,12 @@ source: the last two labels will not work well for TLDs such as "co.uk".' example: example.com flat_name: source.registered_domain + ignore_above: 1024 level: extended name: registered_domain normalize: [] short: The highest registered source domain, stripped of the subdomain. - type: wildcard + type: keyword source.subdomain: dashed_name: source-subdomain description: 'The subdomain portion of a fully qualified domain name includes @@ -8097,24 +8024,22 @@ source: short: Name of the directory the user is a member of. type: keyword source.user.email: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: source-user-email description: User email address. flat_name: source.user.email + ignore_above: 1024 level: extended name: email normalize: [] original_fieldset: user short: User email address. - type: wildcard + type: keyword source.user.full_name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: source-user-full-name description: User's full name, if available. example: Albert Einstein flat_name: source.user.full_name + ignore_above: 1024 level: extended multi_fields: - flat_name: source.user.full_name.text @@ -8125,7 +8050,7 @@ source: normalize: [] original_fieldset: user short: User's full name, if available. - type: wildcard + type: keyword source.user.group.domain: dashed_name: source-user-group-domain description: 'Name of the directory the group is a member of. @@ -8188,12 +8113,11 @@ source: short: Unique identifier of the user. type: keyword source.user.name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: source-user-name description: Short name or login of the user. example: albert flat_name: source.user.name + ignore_above: 1024 level: core multi_fields: - flat_name: source.user.name.text @@ -8204,7 +8128,7 @@ source: normalize: [] original_fieldset: user short: Short name or login of the user. - type: wildcard + type: keyword source.user.roles: dashed_name: source-user-roles description: Array of user roles at the time of the event. @@ -8482,19 +8406,18 @@ tls: of certificate offered by the client. type: keyword tls.client.issuer: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: tls-client-issuer description: Distinguished name of subject of the issuer of the x.509 certificate presented by the client. example: CN=Example Root CA, OU=Infrastructure Team, DC=example, DC=com flat_name: tls.client.issuer + ignore_above: 1024 level: extended name: client.issuer normalize: [] short: Distinguished name of subject of the issuer of the x.509 certificate presented by the client. - type: wildcard + type: keyword tls.client.ja3: dashed_name: tls-client-ja3 description: A hash that identifies clients based on how they perform an SSL/TLS @@ -8544,19 +8467,18 @@ tls: short: Hostname the client is trying to connect to. Also called the SNI. type: keyword tls.client.subject: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: tls-client-subject description: Distinguished name of subject of the x.509 certificate presented by the client. example: CN=myclient, OU=Documentation Team, DC=example, DC=com flat_name: tls.client.subject + ignore_above: 1024 level: extended name: client.subject normalize: [] short: Distinguished name of subject of the x.509 certificate presented by the client. - type: wildcard + type: keyword tls.client.supported_ciphers: dashed_name: tls-client-supported-ciphers description: Array of ciphers offered by the client during the client hello. @@ -8612,19 +8534,18 @@ tls: short: List of country (C) codes type: keyword tls.client.x509.issuer.distinguished_name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: tls-client-x509-issuer-distinguished-name description: Distinguished name (DN) of issuing certificate authority. example: C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA flat_name: tls.client.x509.issuer.distinguished_name + ignore_above: 1024 level: extended name: issuer.distinguished_name normalize: [] original_fieldset: x509 short: Distinguished name (DN) of issuing certificate authority. - type: wildcard + type: keyword tls.client.x509.issuer.locality: dashed_name: tls-client-x509-issuer-locality description: List of locality names (L) @@ -8803,18 +8724,17 @@ tls: short: List of country (C) code type: keyword tls.client.x509.subject.distinguished_name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: tls-client-x509-subject-distinguished-name description: Distinguished name (DN) of the certificate subject entity. example: C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net flat_name: tls.client.x509.subject.distinguished_name + ignore_above: 1024 level: extended name: subject.distinguished_name normalize: [] original_fieldset: x509 short: Distinguished name (DN) of the certificate subject entity. - type: wildcard + type: keyword tls.client.x509.subject.locality: dashed_name: tls-client-x509-subject-locality description: List of locality names (L) @@ -8995,18 +8915,17 @@ tls: of certificate offered by the server. type: keyword tls.server.issuer: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: tls-server-issuer description: Subject of the issuer of the x.509 certificate presented by the server. example: CN=Example Root CA, OU=Infrastructure Team, DC=example, DC=com flat_name: tls.server.issuer + ignore_above: 1024 level: extended name: server.issuer normalize: [] short: Subject of the issuer of the x.509 certificate presented by the server. - type: wildcard + type: keyword tls.server.ja3s: dashed_name: tls-server-ja3s description: A hash that identifies servers based on how they perform an SSL/TLS @@ -9043,17 +8962,16 @@ tls: short: Timestamp indicating when server certificate is first considered valid. type: date tls.server.subject: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: tls-server-subject description: Subject of the x.509 certificate presented by the server. example: CN=www.example.com, OU=Infrastructure Team, DC=example, DC=com flat_name: tls.server.subject + ignore_above: 1024 level: extended name: server.subject normalize: [] short: Subject of the x.509 certificate presented by the server. - type: wildcard + type: keyword tls.server.x509.alternative_names: dashed_name: tls-server-x509-alternative-names description: List of subject alternative names (SAN). Name types vary by certificate @@ -9096,19 +9014,18 @@ tls: short: List of country (C) codes type: keyword tls.server.x509.issuer.distinguished_name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: tls-server-x509-issuer-distinguished-name description: Distinguished name (DN) of issuing certificate authority. example: C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA flat_name: tls.server.x509.issuer.distinguished_name + ignore_above: 1024 level: extended name: issuer.distinguished_name normalize: [] original_fieldset: x509 short: Distinguished name (DN) of issuing certificate authority. - type: wildcard + type: keyword tls.server.x509.issuer.locality: dashed_name: tls-server-x509-issuer-locality description: List of locality names (L) @@ -9287,18 +9204,17 @@ tls: short: List of country (C) code type: keyword tls.server.x509.subject.distinguished_name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: tls-server-x509-subject-distinguished-name description: Distinguished name (DN) of the certificate subject entity. example: C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net flat_name: tls.server.x509.subject.distinguished_name + ignore_above: 1024 level: extended name: subject.distinguished_name normalize: [] original_fieldset: x509 short: Distinguished name (DN) of the certificate subject entity. - type: wildcard + type: keyword tls.server.x509.subject.locality: dashed_name: tls-server-x509-subject-locality description: List of locality names (L) @@ -9464,8 +9380,6 @@ url: the breaking down into scheme, domain, path, and so on. fields: url.domain: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: url-domain description: 'Domain of the url, such as "www.elastic.co". @@ -9477,11 +9391,12 @@ url: field.' example: www.elastic.co flat_name: url.domain + ignore_above: 1024 level: extended name: domain normalize: [] short: Domain of the url. - type: wildcard + type: keyword url.extension: dashed_name: url-extension description: 'The field contains the file extension from the original request @@ -9515,14 +9430,13 @@ url: short: Portion of the url after the `#`. type: keyword url.full: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: url-full description: If full URLs are important to your use case, they should be stored in `url.full`, whether this field is reconstructed or present in the event source. example: https://www.elastic.co:443/search?q=elasticsearch#top flat_name: url.full + ignore_above: 1024 level: extended multi_fields: - flat_name: url.full.text @@ -9532,10 +9446,8 @@ url: name: full normalize: [] short: Full unparsed URL. - type: wildcard + type: keyword url.original: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: url-original description: 'Unmodified original url as seen in the event source. @@ -9545,6 +9457,7 @@ url: This field is meant to represent the URL as it was observed, complete or not.' example: https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch flat_name: url.original + ignore_above: 1024 level: extended multi_fields: - flat_name: url.original.text @@ -9554,7 +9467,7 @@ url: name: original normalize: [] short: Unmodified original url as seen in the event source. - type: wildcard + type: keyword url.password: dashed_name: url-password description: Password of the request. @@ -9566,16 +9479,15 @@ url: short: Password of the request. type: keyword url.path: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: url-path description: Path of the request, such as "/search". flat_name: url.path + ignore_above: 1024 level: extended name: path normalize: [] short: Path of the request, such as "/search". - type: wildcard + type: keyword url.port: dashed_name: url-port description: Port of the request, such as 443. @@ -9604,8 +9516,6 @@ url: short: Query string of the request. type: keyword url.registered_domain: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: url-registered-domain description: 'The highest registered url domain, stripped of the subdomain. @@ -9616,11 +9526,12 @@ url: the last two labels will not work well for TLDs such as "co.uk".' example: example.com flat_name: url.registered_domain + ignore_above: 1024 level: extended name: registered_domain normalize: [] short: The highest registered url domain, stripped of the subdomain. - type: wildcard + type: keyword url.scheme: dashed_name: url-scheme description: 'Scheme of the request, such as "https". @@ -9706,24 +9617,22 @@ user: short: Name of the directory the user is a member of. type: keyword user.changes.email: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: user-changes-email description: User email address. flat_name: user.changes.email + ignore_above: 1024 level: extended name: email normalize: [] original_fieldset: user short: User email address. - type: wildcard + type: keyword user.changes.full_name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: user-changes-full-name description: User's full name, if available. example: Albert Einstein flat_name: user.changes.full_name + ignore_above: 1024 level: extended multi_fields: - flat_name: user.changes.full_name.text @@ -9734,7 +9643,7 @@ user: normalize: [] original_fieldset: user short: User's full name, if available. - type: wildcard + type: keyword user.changes.group.domain: dashed_name: user-changes-group-domain description: 'Name of the directory the group is a member of. @@ -9797,12 +9706,11 @@ user: short: Unique identifier of the user. type: keyword user.changes.name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: user-changes-name description: Short name or login of the user. example: albert flat_name: user.changes.name + ignore_above: 1024 level: core multi_fields: - flat_name: user.changes.name.text @@ -9813,7 +9721,7 @@ user: normalize: [] original_fieldset: user short: Short name or login of the user. - type: wildcard + type: keyword user.changes.roles: dashed_name: user-changes-roles description: Array of user roles at the time of the event. @@ -9853,24 +9761,22 @@ user: short: Name of the directory the user is a member of. type: keyword user.effective.email: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: user-effective-email description: User email address. flat_name: user.effective.email + ignore_above: 1024 level: extended name: email normalize: [] original_fieldset: user short: User email address. - type: wildcard + type: keyword user.effective.full_name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: user-effective-full-name description: User's full name, if available. example: Albert Einstein flat_name: user.effective.full_name + ignore_above: 1024 level: extended multi_fields: - flat_name: user.effective.full_name.text @@ -9881,7 +9787,7 @@ user: normalize: [] original_fieldset: user short: User's full name, if available. - type: wildcard + type: keyword user.effective.group.domain: dashed_name: user-effective-group-domain description: 'Name of the directory the group is a member of. @@ -9944,12 +9850,11 @@ user: short: Unique identifier of the user. type: keyword user.effective.name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: user-effective-name description: Short name or login of the user. example: albert flat_name: user.effective.name + ignore_above: 1024 level: core multi_fields: - flat_name: user.effective.name.text @@ -9960,7 +9865,7 @@ user: normalize: [] original_fieldset: user short: Short name or login of the user. - type: wildcard + type: keyword user.effective.roles: dashed_name: user-effective-roles description: Array of user roles at the time of the event. @@ -9975,23 +9880,21 @@ user: short: Array of user roles at the time of the event. type: keyword user.email: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: user-email description: User email address. flat_name: user.email + ignore_above: 1024 level: extended name: email normalize: [] short: User email address. - type: wildcard + type: keyword user.full_name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: user-full-name description: User's full name, if available. example: Albert Einstein flat_name: user.full_name + ignore_above: 1024 level: extended multi_fields: - flat_name: user.full_name.text @@ -10001,7 +9904,7 @@ user: name: full_name normalize: [] short: User's full name, if available. - type: wildcard + type: keyword user.group.domain: dashed_name: user-group-domain description: 'Name of the directory the group is a member of. @@ -10062,12 +9965,11 @@ user: short: Unique identifier of the user. type: keyword user.name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: user-name description: Short name or login of the user. example: albert flat_name: user.name + ignore_above: 1024 level: core multi_fields: - flat_name: user.name.text @@ -10077,7 +9979,7 @@ user: name: name normalize: [] short: Short name or login of the user. - type: wildcard + type: keyword user.roles: dashed_name: user-roles description: Array of user roles at the time of the event. @@ -10104,24 +10006,22 @@ user: short: Name of the directory the user is a member of. type: keyword user.target.email: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: user-target-email description: User email address. flat_name: user.target.email + ignore_above: 1024 level: extended name: email normalize: [] original_fieldset: user short: User email address. - type: wildcard + type: keyword user.target.full_name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: user-target-full-name description: User's full name, if available. example: Albert Einstein flat_name: user.target.full_name + ignore_above: 1024 level: extended multi_fields: - flat_name: user.target.full_name.text @@ -10132,7 +10032,7 @@ user: normalize: [] original_fieldset: user short: User's full name, if available. - type: wildcard + type: keyword user.target.group.domain: dashed_name: user-target-group-domain description: 'Name of the directory the group is a member of. @@ -10195,12 +10095,11 @@ user: short: Unique identifier of the user. type: keyword user.target.name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: user-target-name description: Short name or login of the user. example: albert flat_name: user.target.name + ignore_above: 1024 level: core multi_fields: - flat_name: user.target.name.text @@ -10211,7 +10110,7 @@ user: normalize: [] original_fieldset: user short: Short name or login of the user. - type: wildcard + type: keyword user.target.roles: dashed_name: user-target-roles description: Array of user roles at the time of the event. @@ -10310,13 +10209,12 @@ user_agent: short: Name of the user agent. type: keyword user_agent.original: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: user-agent-original description: Unparsed user_agent string. example: Mozilla/5.0 (iPhone; CPU iPhone OS 12_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1 flat_name: user_agent.original + ignore_above: 1024 level: extended multi_fields: - flat_name: user_agent.original.text @@ -10326,7 +10224,7 @@ user_agent: name: original normalize: [] short: Unparsed user_agent string. - type: wildcard + type: keyword user_agent.os.family: dashed_name: user-agent-os-family description: OS family (such as redhat, debian, freebsd, windows). @@ -10340,12 +10238,11 @@ user_agent: short: OS family (such as redhat, debian, freebsd, windows). type: keyword user_agent.os.full: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: user-agent-os-full description: Operating system name, including the version or code name. example: Mac OS Mojave flat_name: user_agent.os.full + ignore_above: 1024 level: extended multi_fields: - flat_name: user_agent.os.full.text @@ -10356,7 +10253,7 @@ user_agent: normalize: [] original_fieldset: os short: Operating system name, including the version or code name. - type: wildcard + type: keyword user_agent.os.kernel: dashed_name: user-agent-os-kernel description: Operating system kernel version as a raw string. @@ -10370,12 +10267,11 @@ user_agent: short: Operating system kernel version as a raw string. type: keyword user_agent.os.name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: user-agent-os-name description: Operating system name, without the version. example: Mac OS X flat_name: user_agent.os.name + ignore_above: 1024 level: extended multi_fields: - flat_name: user_agent.os.name.text @@ -10386,7 +10282,7 @@ user_agent: normalize: [] original_fieldset: os short: Operating system name, without the version. - type: wildcard + type: keyword user_agent.os.platform: dashed_name: user-agent-os-platform description: Operating system platform (such centos, ubuntu, windows). @@ -10752,18 +10648,17 @@ x509: short: List of country (C) codes type: keyword x509.issuer.distinguished_name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: x509-issuer-distinguished-name description: Distinguished name (DN) of issuing certificate authority. example: C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA flat_name: x509.issuer.distinguished_name + ignore_above: 1024 level: extended name: issuer.distinguished_name normalize: [] short: Distinguished name (DN) of issuing certificate authority. - type: wildcard + type: keyword x509.issuer.locality: dashed_name: x509-issuer-locality description: List of locality names (L) @@ -10928,17 +10823,16 @@ x509: short: List of country (C) code type: keyword x509.subject.distinguished_name: - beta: Note the usage of `wildcard` type is considered beta. This field used - to be type `keyword`. dashed_name: x509-subject-distinguished-name description: Distinguished name (DN) of the certificate subject entity. example: C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net flat_name: x509.subject.distinguished_name + ignore_above: 1024 level: extended name: subject.distinguished_name normalize: [] short: Distinguished name (DN) of the certificate subject entity. - type: wildcard + type: keyword x509.subject.locality: dashed_name: x509-subject-locality description: List of locality names (L) diff --git a/generated/elasticsearch/7/template.json b/generated/elasticsearch/7/template.json index 98bf95f301..4b94205762 100644 --- a/generated/elasticsearch/7/template.json +++ b/generated/elasticsearch/7/template.json @@ -27,7 +27,8 @@ "build": { "properties": { "original": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" } } }, @@ -73,7 +74,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" } } } @@ -83,7 +85,8 @@ "type": "long" }, "domain": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "geo": { "properties": { @@ -107,7 +110,8 @@ "type": "geo_point" }, "name": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "region_iso_code": { "ignore_above": 1024, @@ -143,7 +147,8 @@ "type": "long" }, "registered_domain": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "subdomain": { "ignore_above": 1024, @@ -160,7 +165,8 @@ "type": "keyword" }, "email": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "full_name": { "fields": { @@ -169,7 +175,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "group": { "properties": { @@ -202,7 +209,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "roles": { "ignore_above": 1024, @@ -323,7 +331,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" } } } @@ -333,7 +342,8 @@ "type": "long" }, "domain": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "geo": { "properties": { @@ -357,7 +367,8 @@ "type": "geo_point" }, "name": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "region_iso_code": { "ignore_above": 1024, @@ -393,7 +404,8 @@ "type": "long" }, "registered_domain": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "subdomain": { "ignore_above": 1024, @@ -410,7 +422,8 @@ "type": "keyword" }, "email": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "full_name": { "fields": { @@ -419,7 +432,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "group": { "properties": { @@ -452,7 +466,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "roles": { "ignore_above": 1024, @@ -536,7 +551,8 @@ "type": "keyword" }, "original_file_name": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "product": { "ignore_above": 1024, @@ -555,7 +571,8 @@ "type": "keyword" }, "data": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "name": { "ignore_above": 1024, @@ -590,7 +607,8 @@ "type": "keyword" }, "name": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "registered_domain": { "ignore_above": 1024, @@ -646,16 +664,20 @@ "type": "text" }, "stack_trace": { + "doc_values": false, "fields": { "text": { "norms": false, "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "index": false, + "type": "keyword" }, "type": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" } } }, @@ -797,7 +819,8 @@ "type": "keyword" }, "directory": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "drive_letter": { "ignore_above": 1, @@ -865,7 +888,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "pe": { "properties": { @@ -890,7 +914,8 @@ "type": "keyword" }, "original_file_name": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "product": { "ignore_above": 1024, @@ -908,7 +933,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "type": { "ignore_above": 1024, @@ -935,7 +961,8 @@ "type": "keyword" }, "distinguished_name": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "locality": { "ignore_above": 1024, @@ -996,7 +1023,8 @@ "type": "keyword" }, "distinguished_name": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "locality": { "ignore_above": 1024, @@ -1072,7 +1100,8 @@ "type": "geo_point" }, "name": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "region_iso_code": { "ignore_above": 1024, @@ -1085,7 +1114,8 @@ } }, "hostname": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "id": { "ignore_above": 1024, @@ -1115,7 +1145,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "kernel": { "ignore_above": 1024, @@ -1128,7 +1159,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "platform": { "ignore_above": 1024, @@ -1158,7 +1190,8 @@ "type": "keyword" }, "email": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "full_name": { "fields": { @@ -1167,7 +1200,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "group": { "properties": { @@ -1200,7 +1234,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "roles": { "ignore_above": 1024, @@ -1226,7 +1261,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" } } }, @@ -1242,7 +1278,8 @@ "type": "keyword" }, "referrer": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" } } }, @@ -1260,7 +1297,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" } } }, @@ -1290,7 +1328,8 @@ "file": { "properties": { "path": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" } } }, @@ -1299,7 +1338,8 @@ "type": "keyword" }, "logger": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "origin": { "properties": { @@ -1497,7 +1537,8 @@ "type": "geo_point" }, "name": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "region_iso_code": { "ignore_above": 1024, @@ -1574,7 +1615,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "kernel": { "ignore_above": 1024, @@ -1587,7 +1629,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "platform": { "ignore_above": 1024, @@ -1638,7 +1681,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" } } }, @@ -1733,7 +1777,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "entity_id": { "ignore_above": 1024, @@ -1746,7 +1791,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "exit_code": { "type": "long" @@ -1778,7 +1824,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "parent": { "properties": { @@ -1817,7 +1864,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "entity_id": { "ignore_above": 1024, @@ -1830,7 +1878,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "exit_code": { "type": "long" @@ -1862,7 +1911,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "pe": { "properties": { @@ -1887,7 +1937,8 @@ "type": "keyword" }, "original_file_name": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "product": { "ignore_above": 1024, @@ -1913,7 +1964,8 @@ "type": "long" }, "name": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" } } }, @@ -1924,7 +1976,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "uptime": { "type": "long" @@ -1936,7 +1989,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" } } }, @@ -1963,7 +2017,8 @@ "type": "keyword" }, "original_file_name": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "product": { "ignore_above": 1024, @@ -1989,7 +2044,8 @@ "type": "long" }, "name": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" } } }, @@ -2000,7 +2056,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "uptime": { "type": "long" @@ -2012,7 +2069,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" } } }, @@ -2025,7 +2083,8 @@ "type": "keyword" }, "strings": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "type": { "ignore_above": 1024, @@ -2038,10 +2097,12 @@ "type": "keyword" }, "key": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "path": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "value": { "ignore_above": 1024, @@ -2132,7 +2193,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" } } } @@ -2142,7 +2204,8 @@ "type": "long" }, "domain": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "geo": { "properties": { @@ -2166,7 +2229,8 @@ "type": "geo_point" }, "name": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "region_iso_code": { "ignore_above": 1024, @@ -2202,7 +2266,8 @@ "type": "long" }, "registered_domain": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "subdomain": { "ignore_above": 1024, @@ -2219,7 +2284,8 @@ "type": "keyword" }, "email": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "full_name": { "fields": { @@ -2228,7 +2294,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "group": { "properties": { @@ -2261,7 +2328,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "roles": { "ignore_above": 1024, @@ -2327,7 +2395,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" } } } @@ -2337,7 +2406,8 @@ "type": "long" }, "domain": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "geo": { "properties": { @@ -2361,7 +2431,8 @@ "type": "geo_point" }, "name": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "region_iso_code": { "ignore_above": 1024, @@ -2397,7 +2468,8 @@ "type": "long" }, "registered_domain": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "subdomain": { "ignore_above": 1024, @@ -2414,7 +2486,8 @@ "type": "keyword" }, "email": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "full_name": { "fields": { @@ -2423,7 +2496,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "group": { "properties": { @@ -2456,7 +2530,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "roles": { "ignore_above": 1024, @@ -2579,7 +2654,8 @@ } }, "issuer": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "ja3": { "ignore_above": 1024, @@ -2596,7 +2672,8 @@ "type": "keyword" }, "subject": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "supported_ciphers": { "ignore_above": 1024, @@ -2619,7 +2696,8 @@ "type": "keyword" }, "distinguished_name": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "locality": { "ignore_above": 1024, @@ -2680,7 +2758,8 @@ "type": "keyword" }, "distinguished_name": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "locality": { "ignore_above": 1024, @@ -2749,7 +2828,8 @@ } }, "issuer": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "ja3s": { "ignore_above": 1024, @@ -2762,7 +2842,8 @@ "type": "date" }, "subject": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "x509": { "properties": { @@ -2781,7 +2862,8 @@ "type": "keyword" }, "distinguished_name": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "locality": { "ignore_above": 1024, @@ -2842,7 +2924,8 @@ "type": "keyword" }, "distinguished_name": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "locality": { "ignore_above": 1024, @@ -2899,7 +2982,8 @@ "url": { "properties": { "domain": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "extension": { "ignore_above": 1024, @@ -2916,7 +3000,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "original": { "fields": { @@ -2925,14 +3010,16 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "password": { "ignore_above": 1024, "type": "keyword" }, "path": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "port": { "type": "long" @@ -2942,7 +3029,8 @@ "type": "keyword" }, "registered_domain": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "scheme": { "ignore_above": 1024, @@ -2971,7 +3059,8 @@ "type": "keyword" }, "email": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "full_name": { "fields": { @@ -2980,7 +3069,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "group": { "properties": { @@ -3013,7 +3103,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "roles": { "ignore_above": 1024, @@ -3032,7 +3123,8 @@ "type": "keyword" }, "email": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "full_name": { "fields": { @@ -3041,7 +3133,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "group": { "properties": { @@ -3074,7 +3167,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "roles": { "ignore_above": 1024, @@ -3083,7 +3177,8 @@ } }, "email": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "full_name": { "fields": { @@ -3092,7 +3187,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "group": { "properties": { @@ -3125,7 +3221,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "roles": { "ignore_above": 1024, @@ -3138,7 +3235,8 @@ "type": "keyword" }, "email": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "full_name": { "fields": { @@ -3147,7 +3245,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "group": { "properties": { @@ -3180,7 +3279,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "roles": { "ignore_above": 1024, @@ -3211,7 +3311,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "os": { "properties": { @@ -3226,7 +3327,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "kernel": { "ignore_above": 1024, @@ -3239,7 +3341,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "platform": { "ignore_above": 1024, diff --git a/generated/elasticsearch/component/agent.json b/generated/elasticsearch/component/agent.json index 353ba82a15..c130016bbd 100644 --- a/generated/elasticsearch/component/agent.json +++ b/generated/elasticsearch/component/agent.json @@ -11,7 +11,8 @@ "build": { "properties": { "original": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" } } }, diff --git a/generated/elasticsearch/component/client.json b/generated/elasticsearch/component/client.json index 31e691aed1..5dde7cdb39 100644 --- a/generated/elasticsearch/component/client.json +++ b/generated/elasticsearch/component/client.json @@ -26,7 +26,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" } } } @@ -36,7 +37,8 @@ "type": "long" }, "domain": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "geo": { "properties": { @@ -60,7 +62,8 @@ "type": "geo_point" }, "name": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "region_iso_code": { "ignore_above": 1024, @@ -96,7 +99,8 @@ "type": "long" }, "registered_domain": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "subdomain": { "ignore_above": 1024, @@ -113,7 +117,8 @@ "type": "keyword" }, "email": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "full_name": { "fields": { @@ -122,7 +127,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "group": { "properties": { @@ -155,7 +161,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "roles": { "ignore_above": 1024, diff --git a/generated/elasticsearch/component/destination.json b/generated/elasticsearch/component/destination.json index d9e445f419..1a24a18e99 100644 --- a/generated/elasticsearch/component/destination.json +++ b/generated/elasticsearch/component/destination.json @@ -26,7 +26,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" } } } @@ -36,7 +37,8 @@ "type": "long" }, "domain": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "geo": { "properties": { @@ -60,7 +62,8 @@ "type": "geo_point" }, "name": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "region_iso_code": { "ignore_above": 1024, @@ -96,7 +99,8 @@ "type": "long" }, "registered_domain": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "subdomain": { "ignore_above": 1024, @@ -113,7 +117,8 @@ "type": "keyword" }, "email": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "full_name": { "fields": { @@ -122,7 +127,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "group": { "properties": { @@ -155,7 +161,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "roles": { "ignore_above": 1024, diff --git a/generated/elasticsearch/component/dll.json b/generated/elasticsearch/component/dll.json index d1654a2995..e630a76c71 100644 --- a/generated/elasticsearch/component/dll.json +++ b/generated/elasticsearch/component/dll.json @@ -80,7 +80,8 @@ "type": "keyword" }, "original_file_name": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "product": { "ignore_above": 1024, diff --git a/generated/elasticsearch/component/dns.json b/generated/elasticsearch/component/dns.json index 15a736a4cf..42d21fc551 100644 --- a/generated/elasticsearch/component/dns.json +++ b/generated/elasticsearch/component/dns.json @@ -15,7 +15,8 @@ "type": "keyword" }, "data": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "name": { "ignore_above": 1024, @@ -50,7 +51,8 @@ "type": "keyword" }, "name": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "registered_domain": { "ignore_above": 1024, diff --git a/generated/elasticsearch/component/error.json b/generated/elasticsearch/component/error.json index 6ed08970ef..d22a07231f 100644 --- a/generated/elasticsearch/component/error.json +++ b/generated/elasticsearch/component/error.json @@ -21,16 +21,20 @@ "type": "text" }, "stack_trace": { + "doc_values": false, "fields": { "text": { "norms": false, "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "index": false, + "type": "keyword" }, "type": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" } } } diff --git a/generated/elasticsearch/component/file.json b/generated/elasticsearch/component/file.json index 073dc7959e..cf1324a4f2 100644 --- a/generated/elasticsearch/component/file.json +++ b/generated/elasticsearch/component/file.json @@ -47,7 +47,8 @@ "type": "keyword" }, "directory": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "drive_letter": { "ignore_above": 1, @@ -115,7 +116,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "pe": { "properties": { @@ -140,7 +142,8 @@ "type": "keyword" }, "original_file_name": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "product": { "ignore_above": 1024, @@ -158,7 +161,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "type": { "ignore_above": 1024, @@ -185,7 +189,8 @@ "type": "keyword" }, "distinguished_name": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "locality": { "ignore_above": 1024, @@ -246,7 +251,8 @@ "type": "keyword" }, "distinguished_name": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "locality": { "ignore_above": 1024, diff --git a/generated/elasticsearch/component/host.json b/generated/elasticsearch/component/host.json index de2b9925b0..3dbbb8e51a 100644 --- a/generated/elasticsearch/component/host.json +++ b/generated/elasticsearch/component/host.json @@ -38,7 +38,8 @@ "type": "geo_point" }, "name": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "region_iso_code": { "ignore_above": 1024, @@ -51,7 +52,8 @@ } }, "hostname": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "id": { "ignore_above": 1024, @@ -81,7 +83,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "kernel": { "ignore_above": 1024, @@ -94,7 +97,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "platform": { "ignore_above": 1024, @@ -124,7 +128,8 @@ "type": "keyword" }, "email": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "full_name": { "fields": { @@ -133,7 +138,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "group": { "properties": { @@ -166,7 +172,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "roles": { "ignore_above": 1024, diff --git a/generated/elasticsearch/component/http.json b/generated/elasticsearch/component/http.json index ee434bc3d3..26b934b372 100644 --- a/generated/elasticsearch/component/http.json +++ b/generated/elasticsearch/component/http.json @@ -22,7 +22,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" } } }, @@ -38,7 +39,8 @@ "type": "keyword" }, "referrer": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" } } }, @@ -56,7 +58,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" } } }, diff --git a/generated/elasticsearch/component/log.json b/generated/elasticsearch/component/log.json index 79ac511fe0..b73467cc7b 100644 --- a/generated/elasticsearch/component/log.json +++ b/generated/elasticsearch/component/log.json @@ -11,7 +11,8 @@ "file": { "properties": { "path": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" } } }, @@ -20,7 +21,8 @@ "type": "keyword" }, "logger": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "origin": { "properties": { diff --git a/generated/elasticsearch/component/observer.json b/generated/elasticsearch/component/observer.json index f7b5f2fd65..a4678c7862 100644 --- a/generated/elasticsearch/component/observer.json +++ b/generated/elasticsearch/component/observer.json @@ -67,7 +67,8 @@ "type": "geo_point" }, "name": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "region_iso_code": { "ignore_above": 1024, @@ -144,7 +145,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "kernel": { "ignore_above": 1024, @@ -157,7 +159,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "platform": { "ignore_above": 1024, diff --git a/generated/elasticsearch/component/organization.json b/generated/elasticsearch/component/organization.json index c00ed11538..8f912778be 100644 --- a/generated/elasticsearch/component/organization.json +++ b/generated/elasticsearch/component/organization.json @@ -19,7 +19,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" } } } diff --git a/generated/elasticsearch/component/process.json b/generated/elasticsearch/component/process.json index 472f0029fb..51f03ac672 100644 --- a/generated/elasticsearch/component/process.json +++ b/generated/elasticsearch/component/process.json @@ -43,7 +43,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "entity_id": { "ignore_above": 1024, @@ -56,7 +57,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "exit_code": { "type": "long" @@ -88,7 +90,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "parent": { "properties": { @@ -127,7 +130,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "entity_id": { "ignore_above": 1024, @@ -140,7 +144,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "exit_code": { "type": "long" @@ -172,7 +177,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "pe": { "properties": { @@ -197,7 +203,8 @@ "type": "keyword" }, "original_file_name": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "product": { "ignore_above": 1024, @@ -223,7 +230,8 @@ "type": "long" }, "name": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" } } }, @@ -234,7 +242,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "uptime": { "type": "long" @@ -246,7 +255,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" } } }, @@ -273,7 +283,8 @@ "type": "keyword" }, "original_file_name": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "product": { "ignore_above": 1024, @@ -299,7 +310,8 @@ "type": "long" }, "name": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" } } }, @@ -310,7 +322,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "uptime": { "type": "long" @@ -322,7 +335,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" } } } diff --git a/generated/elasticsearch/component/registry.json b/generated/elasticsearch/component/registry.json index db6a8c5ba2..f6dea3211e 100644 --- a/generated/elasticsearch/component/registry.json +++ b/generated/elasticsearch/component/registry.json @@ -15,7 +15,8 @@ "type": "keyword" }, "strings": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "type": { "ignore_above": 1024, @@ -28,10 +29,12 @@ "type": "keyword" }, "key": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "path": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "value": { "ignore_above": 1024, diff --git a/generated/elasticsearch/component/server.json b/generated/elasticsearch/component/server.json index 7a5940efb4..0d7e1a95ec 100644 --- a/generated/elasticsearch/component/server.json +++ b/generated/elasticsearch/component/server.json @@ -26,7 +26,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" } } } @@ -36,7 +37,8 @@ "type": "long" }, "domain": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "geo": { "properties": { @@ -60,7 +62,8 @@ "type": "geo_point" }, "name": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "region_iso_code": { "ignore_above": 1024, @@ -96,7 +99,8 @@ "type": "long" }, "registered_domain": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "subdomain": { "ignore_above": 1024, @@ -113,7 +117,8 @@ "type": "keyword" }, "email": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "full_name": { "fields": { @@ -122,7 +127,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "group": { "properties": { @@ -155,7 +161,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "roles": { "ignore_above": 1024, diff --git a/generated/elasticsearch/component/source.json b/generated/elasticsearch/component/source.json index ae2b85b106..ae6db3d20f 100644 --- a/generated/elasticsearch/component/source.json +++ b/generated/elasticsearch/component/source.json @@ -26,7 +26,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" } } } @@ -36,7 +37,8 @@ "type": "long" }, "domain": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "geo": { "properties": { @@ -60,7 +62,8 @@ "type": "geo_point" }, "name": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "region_iso_code": { "ignore_above": 1024, @@ -96,7 +99,8 @@ "type": "long" }, "registered_domain": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "subdomain": { "ignore_above": 1024, @@ -113,7 +117,8 @@ "type": "keyword" }, "email": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "full_name": { "fields": { @@ -122,7 +127,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "group": { "properties": { @@ -155,7 +161,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "roles": { "ignore_above": 1024, diff --git a/generated/elasticsearch/component/tls.json b/generated/elasticsearch/component/tls.json index be3dd91253..8eec703977 100644 --- a/generated/elasticsearch/component/tls.json +++ b/generated/elasticsearch/component/tls.json @@ -39,7 +39,8 @@ } }, "issuer": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "ja3": { "ignore_above": 1024, @@ -56,7 +57,8 @@ "type": "keyword" }, "subject": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "supported_ciphers": { "ignore_above": 1024, @@ -79,7 +81,8 @@ "type": "keyword" }, "distinguished_name": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "locality": { "ignore_above": 1024, @@ -140,7 +143,8 @@ "type": "keyword" }, "distinguished_name": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "locality": { "ignore_above": 1024, @@ -209,7 +213,8 @@ } }, "issuer": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "ja3s": { "ignore_above": 1024, @@ -222,7 +227,8 @@ "type": "date" }, "subject": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "x509": { "properties": { @@ -241,7 +247,8 @@ "type": "keyword" }, "distinguished_name": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "locality": { "ignore_above": 1024, @@ -302,7 +309,8 @@ "type": "keyword" }, "distinguished_name": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "locality": { "ignore_above": 1024, diff --git a/generated/elasticsearch/component/url.json b/generated/elasticsearch/component/url.json index c50ced4a7d..89cd68c6bd 100644 --- a/generated/elasticsearch/component/url.json +++ b/generated/elasticsearch/component/url.json @@ -9,7 +9,8 @@ "url": { "properties": { "domain": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "extension": { "ignore_above": 1024, @@ -26,7 +27,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "original": { "fields": { @@ -35,14 +37,16 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "password": { "ignore_above": 1024, "type": "keyword" }, "path": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "port": { "type": "long" @@ -52,7 +56,8 @@ "type": "keyword" }, "registered_domain": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "scheme": { "ignore_above": 1024, diff --git a/generated/elasticsearch/component/user.json b/generated/elasticsearch/component/user.json index 8a1a714414..b9c0ca72c3 100644 --- a/generated/elasticsearch/component/user.json +++ b/generated/elasticsearch/component/user.json @@ -15,7 +15,8 @@ "type": "keyword" }, "email": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "full_name": { "fields": { @@ -24,7 +25,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "group": { "properties": { @@ -57,7 +59,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "roles": { "ignore_above": 1024, @@ -76,7 +79,8 @@ "type": "keyword" }, "email": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "full_name": { "fields": { @@ -85,7 +89,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "group": { "properties": { @@ -118,7 +123,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "roles": { "ignore_above": 1024, @@ -127,7 +133,8 @@ } }, "email": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "full_name": { "fields": { @@ -136,7 +143,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "group": { "properties": { @@ -169,7 +177,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "roles": { "ignore_above": 1024, @@ -182,7 +191,8 @@ "type": "keyword" }, "email": { - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "full_name": { "fields": { @@ -191,7 +201,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "group": { "properties": { @@ -224,7 +235,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "roles": { "ignore_above": 1024, diff --git a/generated/elasticsearch/component/user_agent.json b/generated/elasticsearch/component/user_agent.json index c45d126c48..1dfe0dc08e 100644 --- a/generated/elasticsearch/component/user_agent.json +++ b/generated/elasticsearch/component/user_agent.json @@ -27,7 +27,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "os": { "properties": { @@ -42,7 +43,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "kernel": { "ignore_above": 1024, @@ -55,7 +57,8 @@ "type": "text" } }, - "type": "wildcard" + "ignore_above": 1024, + "type": "keyword" }, "platform": { "ignore_above": 1024, diff --git a/schemas/agent.yml b/schemas/agent.yml index ada014aecb..a7758e90ce 100644 --- a/schemas/agent.yml +++ b/schemas/agent.yml @@ -24,9 +24,8 @@ - name: build.original level: core - type: wildcard + type: keyword short: Extended build information for the agent. - beta: Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. description: > Extended build information for the agent. diff --git a/schemas/as.yml b/schemas/as.yml index 0094a46a9a..952d7febeb 100644 --- a/schemas/as.yml +++ b/schemas/as.yml @@ -29,8 +29,7 @@ - name: organization.name level: extended - type: wildcard - beta: Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. + type: keyword description: > Organization name. example: Google LLC diff --git a/schemas/client.yml b/schemas/client.yml index b61329316e..e63ab70276 100644 --- a/schemas/client.yml +++ b/schemas/client.yml @@ -53,16 +53,14 @@ - name: domain level: core - type: wildcard - beta: Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. + type: keyword description: > Client domain. - name: registered_domain level: extended - type: wildcard + type: keyword short: The highest registered client domain, stripped of the subdomain. - beta: Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. description: > The highest registered client domain, stripped of the subdomain. diff --git a/schemas/destination.yml b/schemas/destination.yml index ab6979e346..a1e91958f7 100644 --- a/schemas/destination.yml +++ b/schemas/destination.yml @@ -48,15 +48,13 @@ - name: domain level: core - type: wildcard - beta: Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. + type: keyword description: > Destination domain. - name: registered_domain level: extended - type: wildcard - beta: Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. + type: keyword short: The highest registered destination domain, stripped of the subdomain. description: > The highest registered destination domain, stripped of the subdomain. diff --git a/schemas/dns.yml b/schemas/dns.yml index 220a723967..afe11a190a 100644 --- a/schemas/dns.yml +++ b/schemas/dns.yml @@ -66,9 +66,8 @@ - name: question.name level: extended - type: wildcard + type: keyword short: The name being queried. - beta: Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. description: > The name being queried. @@ -186,9 +185,8 @@ - name: answers.data level: extended - type: wildcard + type: keyword short: The data describing the resource. - beta: Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. description: > The data describing the resource. diff --git a/schemas/error.yml b/schemas/error.yml index b1ae66f588..7d96f09a4b 100644 --- a/schemas/error.yml +++ b/schemas/error.yml @@ -31,16 +31,15 @@ - name: type level: extended - type: wildcard - beta: Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. + type: keyword example: java.lang.NullPointerException description: > The type of the error, for example the class name of the exception. - name: stack_trace level: extended - type: wildcard - beta: Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. + type: keyword + index: false description: > The stack trace of this error in plain text. multi_fields: diff --git a/schemas/file.yml b/schemas/file.yml index 419116c8da..545b4661fa 100644 --- a/schemas/file.yml +++ b/schemas/file.yml @@ -33,9 +33,8 @@ - name: directory level: extended - type: wildcard + type: keyword short: Directory where the file is located. - beta: Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. description: > Directory where the file is located. It should include the drive letter, when appropriate. @@ -54,9 +53,8 @@ - name: path level: extended - type: wildcard + type: keyword short: Full path to the file, including the file name. - beta: Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. description: > Full path to the file, including the file name. It should include the drive letter, when appropriate. @@ -67,8 +65,7 @@ - name: target_path level: extended - type: wildcard - beta: Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. + type: keyword description: Target path for symlinks. multi_fields: - type: text diff --git a/schemas/geo.yml b/schemas/geo.yml index a6654d982f..347d60829e 100644 --- a/schemas/geo.yml +++ b/schemas/geo.yml @@ -71,9 +71,8 @@ - name: name level: extended - type: wildcard + type: keyword short: User-defined description of a location. - beta: Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. description: > User-defined description of a location, at the level of granularity they care about. diff --git a/schemas/host.yml b/schemas/host.yml index f751d9b3ff..2fdbd9e4f7 100644 --- a/schemas/host.yml +++ b/schemas/host.yml @@ -14,9 +14,8 @@ - name: hostname level: core - type: wildcard + type: keyword short: Hostname of the host. - beta: Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. description: > Hostname of the host. diff --git a/schemas/http.yml b/schemas/http.yml index f0ee23c53a..9002408cab 100644 --- a/schemas/http.yml +++ b/schemas/http.yml @@ -42,8 +42,7 @@ - name: request.body.content level: extended - type: wildcard - beta: Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. + type: keyword description: > The full HTTP request body. example: Hello world @@ -53,8 +52,7 @@ - name: request.referrer level: extended - type: wildcard - beta: Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. + type: keyword description: > Referrer for this HTTP request. example: https://blog.example.com/ @@ -83,8 +81,7 @@ - name: response.body.content level: extended - type: wildcard - beta: Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. + type: keyword description: > The full HTTP response body. example: Hello world diff --git a/schemas/log.yml b/schemas/log.yml index 991b9235a0..fed4c063dd 100644 --- a/schemas/log.yml +++ b/schemas/log.yml @@ -31,9 +31,8 @@ - name: file.path level: extended - type: wildcard + type: keyword short: Full path to the log file this event came from. - beta: Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. description: > Full path to the log file this event came from, including the file name. It should include the drive letter, when appropriate. @@ -64,10 +63,9 @@ - name: logger level: core - type: wildcard + type: keyword example: org.elasticsearch.bootstrap.Bootstrap short: Name of the logger. - beta: Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. description: > The name of the logger inside an application. This is usually the name of the class which initialized the logger, or can be a custom name. diff --git a/schemas/organization.yml b/schemas/organization.yml index 4eee9ce663..dcd2358927 100644 --- a/schemas/organization.yml +++ b/schemas/organization.yml @@ -14,8 +14,7 @@ - name: name level: extended - type: wildcard - beta: Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. + type: keyword description: > Organization name. multi_fields: diff --git a/schemas/os.yml b/schemas/os.yml index 9a93fd933b..8b8cfcdad7 100644 --- a/schemas/os.yml +++ b/schemas/os.yml @@ -36,9 +36,8 @@ - name: name level: extended - type: wildcard + type: keyword example: "Mac OS X" - beta: Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. description: > Operating system name, without the version. multi_fields: @@ -47,9 +46,8 @@ - name: full level: extended - type: wildcard + type: keyword example: "Mac OS Mojave" - beta: Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. description: > Operating system name, including the version or code name. multi_fields: diff --git a/schemas/pe.yml b/schemas/pe.yml index 8a7e2ddaf8..126fb16136 100644 --- a/schemas/pe.yml +++ b/schemas/pe.yml @@ -13,8 +13,7 @@ fields: - name: original_file_name level: extended - type: wildcard - beta: Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. + type: keyword description: Internal name of the file, provided at compile-time. example: MSPAINT.EXE diff --git a/schemas/process.yml b/schemas/process.yml index 8c9661cebd..13ec63c07f 100644 --- a/schemas/process.yml +++ b/schemas/process.yml @@ -44,9 +44,8 @@ - name: name level: extended - type: wildcard + type: keyword short: Process name. - beta: Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. description: > Process name. @@ -73,9 +72,8 @@ - name: command_line level: extended - type: wildcard + type: keyword short: Full command line that started the process. - beta: Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. description: > Full command line that started the process, including the absolute path to the executable, and all arguments. @@ -112,8 +110,7 @@ - name: executable level: extended - type: wildcard - beta: Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. + type: keyword description: > Absolute path to the process executable. example: /usr/bin/ssh @@ -123,9 +120,8 @@ - name: title level: extended - type: wildcard + type: keyword short: Process title. - beta: Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. description: > Process title. @@ -145,8 +141,7 @@ - name: thread.name level: extended - type: wildcard - beta: Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. + type: keyword example: 'thread-0' description: > Thread name. @@ -167,9 +162,8 @@ - name: working_directory level: extended - type: wildcard + type: keyword example: /home/alice - beta: Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. description: > The working directory of the process. multi_fields: diff --git a/schemas/registry.yml b/schemas/registry.yml index 576727087e..bf8670d84e 100644 --- a/schemas/registry.yml +++ b/schemas/registry.yml @@ -14,8 +14,7 @@ - name: key level: core - type: wildcard - beta: Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. + type: keyword description: Hive-relative path of keys. example: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe @@ -27,8 +26,7 @@ - name: path level: core - type: wildcard - beta: Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. + type: keyword description: Full path, including hive, key and value example: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe\Debugger @@ -40,9 +38,8 @@ - name: data.strings level: core - type: wildcard + type: keyword short: List of strings representing what was written to the registry. - beta: Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. example: '["C:\rta\red_ttp\bin\myapp.exe"]' description: > Content when writing string types. diff --git a/schemas/server.yml b/schemas/server.yml index b8d6924696..867b3bd03c 100644 --- a/schemas/server.yml +++ b/schemas/server.yml @@ -53,15 +53,13 @@ - name: domain level: core - type: wildcard - beta: Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. + type: keyword description: > Server domain. - name: registered_domain level: extended - type: wildcard - beta: Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. + type: keyword short: The highest registered server domain, stripped of the subdomain. description: > The highest registered server domain, stripped of the subdomain. diff --git a/schemas/source.yml b/schemas/source.yml index 581d5c062b..268b975312 100644 --- a/schemas/source.yml +++ b/schemas/source.yml @@ -48,16 +48,14 @@ - name: domain level: core - type: wildcard - beta: Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. + type: keyword description: > Source domain. - name: registered_domain level: extended - type: wildcard + type: keyword short: The highest registered source domain, stripped of the subdomain. - beta: Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. description: > The highest registered source domain, stripped of the subdomain. diff --git a/schemas/tls.yml b/schemas/tls.yml index 781aafb66e..3ecacb041a 100644 --- a/schemas/tls.yml +++ b/schemas/tls.yml @@ -78,16 +78,14 @@ - array - name: client.subject - type: wildcard + type: keyword level: extended - beta: Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. description: Distinguished name of subject of the x.509 certificate presented by the client. example: "CN=myclient, OU=Documentation Team, DC=example, DC=com" - name: client.issuer - type: wildcard + type: keyword level: extended - beta: Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. description: Distinguished name of subject of the issuer of the x.509 certificate presented by the client. example: "CN=Example Root CA, OU=Infrastructure Team, DC=example, DC=com" @@ -159,16 +157,14 @@ example: 394441ab65754e2207b1e1b457b3641d - name: server.subject - type: wildcard + type: keyword level: extended - beta: Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. description: Subject of the x.509 certificate presented by the server. example: "CN=www.example.com, OU=Infrastructure Team, DC=example, DC=com" - name: server.issuer - type: wildcard + type: keyword level: extended - beta: Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. description: Subject of the issuer of the x.509 certificate presented by the server. example: "CN=Example Root CA, OU=Infrastructure Team, DC=example, DC=com" diff --git a/schemas/url.yml b/schemas/url.yml index a264e59395..88a0278891 100644 --- a/schemas/url.yml +++ b/schemas/url.yml @@ -10,8 +10,7 @@ - name: original level: extended - type: wildcard - beta: Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. + type: keyword short: Unmodified original url as seen in the event source. description: > Unmodified original url as seen in the event source. @@ -29,9 +28,8 @@ - name: full level: extended - type: wildcard + type: keyword short: Full unparsed URL. - beta: Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. description: > If full URLs are important to your use case, they should be stored in `url.full`, whether this field is reconstructed or present in the @@ -53,9 +51,8 @@ - name: domain level: extended - type: wildcard + type: keyword short: Domain of the url. - beta: Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. description: > Domain of the url, such as "www.elastic.co". @@ -68,9 +65,8 @@ - name: registered_domain level: extended - type: wildcard + type: keyword short: The highest registered url domain, stripped of the subdomain. - beta: Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. description: > The highest registered url domain, stripped of the subdomain. @@ -120,8 +116,7 @@ - name: path level: extended - type: wildcard - beta: Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. + type: keyword description: > Path of the request, such as "/search". diff --git a/schemas/user.yml b/schemas/user.yml index 6e010627cf..0fe7a32411 100644 --- a/schemas/user.yml +++ b/schemas/user.yml @@ -48,9 +48,8 @@ - name: name level: core - type: wildcard + type: keyword example: albert - beta: Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. description: > Short name or login of the user. multi_fields: @@ -59,8 +58,7 @@ - name: full_name level: extended - type: wildcard - beta: Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. + type: keyword example: Albert Einstein description: > User's full name, if available. @@ -70,8 +68,7 @@ - name: email level: extended - type: wildcard - beta: Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. + type: keyword description: > User email address. diff --git a/schemas/user_agent.yml b/schemas/user_agent.yml index 84388859cf..9c18c20827 100644 --- a/schemas/user_agent.yml +++ b/schemas/user_agent.yml @@ -12,8 +12,7 @@ - name: original level: extended - type: wildcard - beta: Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. + type: keyword multi_fields: - type: text name: text diff --git a/schemas/x509.yml b/schemas/x509.yml index a36e8a91a1..124551c96c 100644 --- a/schemas/x509.yml +++ b/schemas/x509.yml @@ -37,8 +37,7 @@ - name: issuer.distinguished_name level: extended - type: wildcard - beta: Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. + type: keyword description: Distinguished name (DN) of issuing certificate authority. example: C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA @@ -114,8 +113,7 @@ - name: subject.distinguished_name level: extended - type: wildcard - beta: Note the usage of `wildcard` type is considered beta. This field used to be type `keyword`. + type: keyword description: Distinguished name (DN) of the certificate subject entity. example: C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net diff --git a/use-cases/auditbeat.md b/use-cases/auditbeat.md index 15e2935a61..dff825a597 100644 --- a/use-cases/auditbeat.md +++ b/use-cases/auditbeat.md @@ -9,8 +9,8 @@ ECS usage in Auditbeat. |---|---|---|---|---| | [event.module](../README.md#event.module) | Auditbeat module name. | core | keyword | `apache` | | *file.** | *File attributes.
* | | | | -| [file.path](../README.md#file.path) | The path to the file. | extended | wildcard | `/home/alice/example.png` | -| [file.target_path](../README.md#file.target_path) | The target path for symlinks. | extended | wildcard | | +| [file.path](../README.md#file.path) | The path to the file. | extended | keyword | `/home/alice/example.png` | +| [file.target_path](../README.md#file.target_path) | The target path for symlinks. | extended | keyword | | | [file.type](../README.md#file.type) | The file type (file, dir, or symlink). | extended | keyword | `file` | | [file.device](../README.md#file.device) | The device. | extended | keyword | `sda` | | [file.inode](../README.md#file.inode) | The inode representing the file in the filesystem. | extended | keyword | `256383` | diff --git a/use-cases/filebeat-apache-access.md b/use-cases/filebeat-apache-access.md index 293c2fb190..a9ef41840f 100644 --- a/use-cases/filebeat-apache-access.md +++ b/use-cases/filebeat-apache-access.md @@ -13,7 +13,7 @@ ECS fields used in Filebeat for the apache module. | [event.module](../README.md#event.module) | Currently fileset.module | core | keyword | `apache` | | [event.dataset](../README.md#event.dataset) | Currenly fileset.name | core | keyword | `access` | | [source.ip](../README.md#source.ip) | Source ip of the request. Currently apache.access.remote_ip | core | ip | `192.168.1.1` | -| [user.name](../README.md#user.name) | User name in the request. Currently apache.access.user_name | core | wildcard | `ruflin` | +| [user.name](../README.md#user.name) | User name in the request. Currently apache.access.user_name | core | keyword | `ruflin` | | *http.method* | *Http method, currently apache.access.method* | (use case) | keyword | `GET` | | *http.url* | *Http url, currently apache.access.url* | (use case) | keyword | `http://elastic.co/` | | [http.version](../README.md#http.version) | Http version, currently apache.access.http_version | extended | keyword | `1.1` | @@ -21,7 +21,7 @@ ECS fields used in Filebeat for the apache module. | *http.response.body_sent.bytes* | *Http response body bytes sent, currently apache.access.body_sent.bytes* | (use case) | long | `117` | | *http.referer* | *Http referrer code, currently apache.access.referrer
NOTE: In the RFC its misspell as referer and has become accepted standard* | (use case) | keyword | `http://elastic.co/` | | *user_agent.** | *User agent fields as in schema. Currently under apache.access.user_agent.*
* | | | | -| [user_agent.original](../README.md#user_agent.original) | Original user agent. Currently apache.access.agent | extended | wildcard | `http://elastic.co/` | +| [user_agent.original](../README.md#user_agent.original) | Original user agent. Currently apache.access.agent | extended | keyword | `http://elastic.co/` | | *geoip.** | *User agent fields as in schema. Currently under apache.access.geoip.*
These are extracted from source.ip
Should they be under source.geoip?
* | | | | | *geoip....* | *All geoip fields.* | (use case) | keyword | | diff --git a/use-cases/kubernetes.md b/use-cases/kubernetes.md index 057ed289cb..5588da6060 100644 --- a/use-cases/kubernetes.md +++ b/use-cases/kubernetes.md @@ -10,7 +10,7 @@ You can monitor containers running in a Kubernetes cluster by adding Kubernetes- |---|---|---|---|---| | [container.id](../README.md#container.id) | Unique container id. | core | keyword | `fdbef803fa2b` | | [container.name](../README.md#container.name) | Container name. | extended | keyword | | -| [host.hostname](../README.md#host.hostname) | Hostname of the host.
It normally contains what the `hostname` command returns on the host machine. | core | wildcard | `kube-high-cpu-42` | +| [host.hostname](../README.md#host.hostname) | Hostname of the host.
It normally contains what the `hostname` command returns on the host machine. | core | keyword | `kube-high-cpu-42` | | *kubernetes.pod.name* | *Kubernetes pod name* | (use case) | keyword | `foo-webserver` | | *kubernetes.namespace* | *Kubernetes namespace* | (use case) | keyword | `foo-team` | | *kubernetes.labels* | *Kubernetes labels map* | (use case) | object | | diff --git a/use-cases/metricbeat.md b/use-cases/metricbeat.md index 79b3369efd..c573a7897e 100644 --- a/use-cases/metricbeat.md +++ b/use-cases/metricbeat.md @@ -21,7 +21,7 @@ ECS fields used Metricbeat. | *error.** | *Error namespace
Use for errors which can happen during fetching information for a service.
* | | | | | [error.message](../README.md#error.message) | Error message returned by the service during fetching metrics. | core | text | | | [error.code](../README.md#error.code) | Error code returned by the service during fetching metrics. | core | keyword | | -| [host.hostname](../README.md#host.hostname) | Hostname of the system metricbeat is running on or user defined name. | core | wildcard | | +| [host.hostname](../README.md#host.hostname) | Hostname of the system metricbeat is running on or user defined name. | core | keyword | | | *host.timezone.offset.sec* | *Timezone offset of the host in seconds.* | (use case) | long | | | [host.id](../README.md#host.id) | Unique host id. | core | keyword | | | [event.module](../README.md#event.module) | Name of the module this data is coming from. | core | keyword | `mysql` | diff --git a/use-cases/web-logs.md b/use-cases/web-logs.md index d70944b48c..57f9a96062 100644 --- a/use-cases/web-logs.md +++ b/use-cases/web-logs.md @@ -12,12 +12,12 @@ Using the fields as represented here is not expected to conflict with ECS, but m | [@timestamp](../README.md#@timestamp) | Time at which the response was sent, and the web server log created. | core | date | `2016-05-23T08:05:34.853Z` | | *http.** | *Fields related to HTTP requests and responses.
* | | | | | [http.request.method](../README.md#http.request.method) | Http request method. | extended | keyword | `GET, POST, PUT` | -| [http.request.referrer](../README.md#http.request.referrer) | Referrer for this HTTP request. | extended | wildcard | `https://blog.example.com/` | +| [http.request.referrer](../README.md#http.request.referrer) | Referrer for this HTTP request. | extended | keyword | `https://blog.example.com/` | | [http.response.status_code](../README.md#http.response.status_code) | Http response status code. | extended | long | `404` | -| [http.response.body.content](../README.md#http.response.body.content) | The full http response body. | extended | wildcard | `Hello world` | +| [http.response.body.content](../README.md#http.response.body.content) | The full http response body. | extended | keyword | `Hello world` | | [http.version](../README.md#http.version) | Http version. | extended | keyword | `1.1` | | *user_agent.** | *The user_agent fields normally come from a browser request. They often show up in web service logs coming from the parsed user agent string.
* | | | | -| [user_agent.original](../README.md#user_agent.original) | Unparsed version of the user_agent. | extended | wildcard | `Mozilla/5.0 (iPhone; CPU iPhone OS 12_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1` | +| [user_agent.original](../README.md#user_agent.original) | Unparsed version of the user_agent. | extended | keyword | `Mozilla/5.0 (iPhone; CPU iPhone OS 12_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1` | | *user_agent.device* | *Name of the physical device.* | (use case) | keyword | | | [user_agent.version](../README.md#user_agent.version) | Version of the physical device. | extended | keyword | `12.0` | | *user_agent.major* | *Major version of the user agent.* | (use case) | long | |