64-bit unsigned integer field type usage

[ebeahan]

Summary

Starting a discussion of the upcoming uint64 data type and its possible application in ECS once released. Looking to collect high-level thoughts and feedback, with the outcomes consolidated into a RFC stage 0 proposal if the concept has interest.

Identified potential uses:

• in the registry.* field set Add registry fieldset #673
• the Windows FILETIME struct
• Windows USN Journal
• additional fields from endpoint.

References

Elasticsearch issue for adding uint64 integers: elastic/elasticsearch#32434
in-progress PR: elastic/elasticsearch#60050

[dainperkins]

would be useful for 64bit counters (e.g. ifxmibs bytes_in,etc)

[ebeahan]

I investigated this a bit more recently as a possible upcoming change to ECS.

With 64-bit integers not supported in Javascript, Kibana has several known issues with 64-bit integer support: elastic/kibana#40183.

May still guide those ECS users who require the additional precision and understand the possible side-effects and degraded experience in exchange for it.

[ebeahan]

Not pursuing in the near future.