Add network.name

[webmat]

Some operators take care to identify their networks in their monitoring pipelines. I think network.name should be the right place to put this.

I'd like to submit my first PR to ECS for this. I've already identified a few places where I should add the field:

• README.md
• schemas/network.yml
• schema.csv

Questions

• Do you agree we should add network.name?
• Where else do I need to add the field? Any gotchas?
• In schema.csv, what's the meaning of the "Phase" column? What value would you suggest be put there. I suspect network.name will not be the most used field.

[ruflin]

+1 on having network.name.

You only have to update network.yml with the details and then run make. All the other files will be generated then. For the phase just ignore it. It's there for historical reason but we probably can remove it now.

Looking forward to the PR.

[webmat]

Running make, I got Python whining about a missing YAML lib. Not being a Pythonista, I'm guessing and going with pyyaml. It's still failing with

python scripts/schemas.py
Traceback (most recent call last):
  File "scripts/schemas.py", line 85, in <module>
    fields = fields + read_schema_file("schemas/" + file)
  File "/Users/mat/work/elastic/ecs/scripts/helper.py", line 9, in read_schema_file
    fields = yaml.load(f.read())
  File "/usr/local/lib/python2.7/site-packages/yaml/__init__.py", line 69, in load
    loader = Loader(stream)
  File "/usr/local/lib/python2.7/site-packages/yaml/loader.py", line 34, in __init__
    Reader.__init__(self, stream)
  File "/usr/local/lib/python2.7/site-packages/yaml/reader.py", line 79, in __init__
    self.determine_encoding()
  File "/usr/local/lib/python2.7/site-packages/yaml/reader.py", line 135, in determine_encoding
    self.update(1)
  File "/usr/local/lib/python2.7/site-packages/yaml/reader.py", line 165, in update
    exc.encoding, exc.reason)
yaml.reader.ReaderError: 'utf8' codec can't decode byte #xd2: invalid continuation byte
  in "<string>", position 17
make: *** [generate] Error 1

So backtracking:

• What version of Python should I even be using? (I'm pretty sure I only have MacOS system Python) :-)
• What YAML lib should I be using?
• Are there any other dependencies I should be installing as well?

[ruflin]

Python 2.7 and 3.x should work. Can you try to run make setup: https://github.com/elastic/ecs/blob/master/Makefile#L23 The one dependency you could be potentially missing is Golang: https://github.com/elastic/ecs/blob/master/CONTRIBUTING.md#requirements