Implement missing array types as per elastic/ecs#727

src/Elastic.CommonSchema/Serialization/BaseJsonFormatter.Generated.cs

@@ -5,7 +5,7 @@
 /*
 IMPORTANT NOTE
 ==============
-This file has been generated.
+This file has been generated. 
 If you wish to submit a PR please modify the original csharp file and submit the PR with that change. Thanks!
 */
 
@@ -19,9 +19,9 @@ internal partial class BaseJsonConverter<TBase> : EcsJsonConverterBase<TBase>
 		where TBase : Base, new()
 	{
 		private static bool ReadProperties(
-			ref Utf8JsonReader reader,
-			TBase ecsEvent,
-			ref DateTimeOffset? timestamp,
+			ref Utf8JsonReader reader, 
+			TBase ecsEvent, 
+			ref DateTimeOffset? timestamp, 
 			ref string loglevel
 		)
 		{
@@ -139,4 +139,4 @@ public override void Write(Utf8JsonWriter writer, TBase value, JsonSerializerOpt
 			writer.WriteEndObject();
 		}
 	}
-}
+}

src/Elastic.CommonSchema/Types.Generated.cs

@@ -661,7 +661,7 @@ public class ContainerImage
 		/// </summary>
 		/// <remarks>Extended</remarks>
 		[DataMember(Name = "tag")]
-		public string Tag { get; set; }
+		public string[] Tag { get; set; }
 
 	}
 
@@ -1262,7 +1262,7 @@ public class Event
 		/// <remarks>Core</remarks>
 		/// <example>authentication</example>
 		[DataMember(Name = "category")]
-		public string Category { get; set; }
+		public string[] Category { get; set; }
 
 		/// <summary>
 		/// The action captured by the event.<para/>This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.
@@ -1285,7 +1285,7 @@ public class Event
 		/// </summary>
 		/// <remarks>Core</remarks>
 		[DataMember(Name = "type")]
-		public string Type { get; set; }
+		public string[] Type { get; set; }
 
 		/// <summary>
 		/// Name of the module this data is coming from.<para/>If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.
@@ -1761,14 +1761,14 @@ public class Host
 		/// </summary>
 		/// <remarks>Core</remarks>
 		[DataMember(Name = "ip")]
-		public string Ip { get; set; }
+		public string[] Ip { get; set; }
 
 		/// <summary>
 		/// Host mac address.
 		/// </summary>
 		/// <remarks>Core</remarks>
 		[DataMember(Name = "mac")]
-		public string Mac { get; set; }
+		public string[] Mac { get; set; }
 
 		/// <summary>
 		/// Type of host.<para/>For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.
@@ -2223,14 +2223,14 @@ public class Observer
 		/// </summary>
 		/// <remarks>Core</remarks>
 		[DataMember(Name = "mac")]
-		public string Mac { get; set; }
+		public string[] Mac { get; set; }
 
 		/// <summary>
 		/// IP address of the observer.
 		/// </summary>
 		/// <remarks>Core</remarks>
 		[DataMember(Name = "ip")]
-		public string Ip { get; set; }
+		public string[] Ip { get; set; }
 
 		/// <summary>
 		/// Hostname of the observer.
@@ -2849,14 +2849,14 @@ public class Related
 		/// </summary>
 		/// <remarks>Extended</remarks>
 		[DataMember(Name = "ip")]
-		public string Ip { get; set; }
+		public string[] Ip { get; set; }
 
 		/// <summary>
 		/// All the user names seen on your event.
 		/// </summary>
 		/// <remarks>Extended</remarks>
 		[DataMember(Name = "user")]
-		public string User { get; set; }
+		public string[] User { get; set; }
 
 	}
 
@@ -3267,23 +3267,23 @@ public class ThreatTactic
 		/// <remarks>Extended</remarks>
 		/// <example>impact</example>
 		[DataMember(Name = "name")]
-		public string Name { get; set; }
+		public string[] Name { get; set; }
 
 		/// <summary>
 		/// The id of tactic used by this threat. You can use the Mitre ATT&CK Matrix Tactic categorization, for example. (ex. https://attack.mitre.org/tactics/TA0040/ )
 		/// </summary>
 		/// <remarks>Extended</remarks>
 		/// <example>TA0040</example>
 		[DataMember(Name = "id")]
-		public string Id { get; set; }
+		public string[] Id { get; set; }
 
 		/// <summary>
 		/// The reference url of tactic used by this threat. You can use the Mitre ATT&CK Matrix Tactic categorization, for example. (ex. https://attack.mitre.org/tactics/TA0040/ )
 		/// </summary>
 		/// <remarks>Extended</remarks>
 		/// <example>https://attack.mitre.org/tactics/TA0040/</example>
 		[DataMember(Name = "reference")]
-		public string Reference { get; set; }
+		public string[] Reference { get; set; }
 
 	}
 
@@ -3298,23 +3298,23 @@ public class ThreatTechnique
 		/// <remarks>Extended</remarks>
 		/// <example>endpoint denial of service</example>
 		[DataMember(Name = "name")]
-		public string Name { get; set; }
+		public string[] Name { get; set; }
 
 		/// <summary>
 		/// The id of technique used by this tactic. You can use the Mitre ATT&CK Matrix Tactic categorization, for example. (ex. https://attack.mitre.org/techniques/T1499/ )
 		/// </summary>
 		/// <remarks>Extended</remarks>
 		/// <example>T1499</example>
 		[DataMember(Name = "id")]
-		public string Id { get; set; }
+		public string[] Id { get; set; }
 
 		/// <summary>
 		/// The reference url of technique used by this tactic. You can use the Mitre ATT&CK Matrix Tactic categorization, for example. (ex. https://attack.mitre.org/techniques/T1499/ )
 		/// </summary>
 		/// <remarks>Extended</remarks>
 		/// <example>https://attack.mitre.org/techniques/T1499/</example>
 		[DataMember(Name = "reference")]
-		public string Reference { get; set; }
+		public string[] Reference { get; set; }
 
 	}
 

src/Generator/Schema/Field.cs

@@ -31,6 +31,22 @@ public string ClrType
 			get
 			{
 				// Special cases.
+				if (FlatName == "container.image.tag") return "string[]";
+				if (FlatName == "host.ip") return "string[]";
+				if (FlatName == "host.mac") return "string[]";
+				if (FlatName == "observer.ip") return "string[]";
+				if (FlatName == "observer.mac") return "string[]";
+				if (FlatName == "related.ip") return "string[]";
+				if (FlatName == "related.user") return "string[]";
+				if (FlatName == "threat.tactic.name") return "string[]";
+				if (FlatName == "threat.tactic.id") return "string[]";
+				if (FlatName == "threat.tactic.reference") return "string[]";
+				if (FlatName == "threat.technique.name") return "string[]";
+				if (FlatName == "threat.technique.id") return "string[]";
+				if (FlatName == "threat.technique.reference") return "string[]";
+				if (FlatName == "event.category") return "string[]";
+				if (FlatName == "event.type") return "string[]";
+
 				if (Name == "args") return "string[]";
 				if (Name == "data.strings") return "string[]";
 				if (Name == "parent.args") return "string[]";

src/Generator/Views/BaseJsonFormatter.Generated.cshtml

@@ -67,7 +67,7 @@ namespace Elastic.CommonSchema.Serialization
 			};
 		}
 
-		public override void Write(Utf8JsonWriter writer, Base value, JsonSerializerOptions options)
+		public override void Write(Utf8JsonWriter writer, TBase value, JsonSerializerOptions options)
 		{
 			if (value == null)
 			{