Move name_map/ids fields to root of user

[vjsamuel]

This PR moves user. name_map to user.name and top level ids to user.id for the auditd module

[elasticmachine]

Since this is a community submitted pull request, a Jenkins build has not been kicked off automatically. Can an Elastic organization member please verify the contents of this patch and then kick off a build manually?

[ruflin]

Seems like this would conflict with ECS: https://github.com/elastic/ecs#user

[ruflin]

Can you share a bit more background on the reasons behind this change?

[vjsamuel]

@ruflin, the idea is to restructure it for better clarity. The feeling was:
ids in the root level and name mapping as a child isnt as clear as:
user.ids and user.names. thoughts?

[ruflin]

Let's see what @andrewkroh thinks.

[andrewkroh]

Like I said on Slack:

One thing we have to resolve is how this fits in with ECS. See user.id and user.name in https://github.com/elastic/ecs#-user-fields.

Not wanting to conflict with ECS is the reason for the current field naming. I like how you have changed the fields in this PR, but it does conflict.

One option would be to switch back to plurals like user.ids.* and user.names.* to avoid conflicting with the ECS fieldsuser.id: []string and user.name: []string. But the downside is that this could be confusing if/when Auditbeat is updated to also populate the user.id field with all the UID values contained in the event (same for user.name).

[ruflin]

Completely different suggestion. It's kind of odd that for example the field suid exists twice, once it is described as sent user id, the other one as sent user name (because it has a name prefix). What if we turn it around to:

su.id
su.name

The advantage of this would be that id and name would be close together. Disadvantage is that suid is probably well know.

[ruflin]

@vjsamuel I think the part I'm missing here is if the current data model causes some issues when querying / aggregating the data or this is mainly about making the data model nicer?

[vjsamuel]

@ruflin the intent is to simplify the data model.

[cwurm]

@vjsamuel With #10456 the Auditd module is no longer using name_map. Does this address your concern?

[vjsamuel]

i was looking for something in similar lines. I can close this one out. Thanks!