Discover: Rollup index pattern doesn't work with source fetching

[flash1293]

Kibana version: 7.12

Describe the bug: When trying to view a rollup index pattern in Discover, the request fails if the fields API is not enabled (_source fetching)

Steps to reproduce:

1. Configure rollup job
2. Create rollup index pattern for it
3. Turn on "fetch fields from source" flag in settings
4. Go to Discover
5. Request fails

Expected behavior:
Request works and shows the technical rollup documents

Screenshots (if relevant):

[elasticmachine]

Pinging @elastic/kibana-app (Team:KibanaApp)

[kertal]

Had the same error using 2 beats provided indices, source fetching, no rollupdata UPDATE: there was one rollup index involved, so this was the reason for this error

[kertal]

This was the Request:

Click to expand, it's very, very long

{
  "size": 500,
  "sort": [
    {
      "_doc": {
        "order": "desc",
        "unmapped_type": "boolean"
      }
    }
  ],
  "version": true,
  "aggs": {
    "2": {
      "date_histogram": {
        "field": "@timestamp",
        "fixed_interval": "30s",
        "time_zone": "Europe/Vienna",
        "min_doc_count": 1
      }
    }
  },
  "fields": [
    {
      "field": "@timestamp",
      "format": "date_time"
    },
    {
      "field": "ceph.monitor_health.last_updated",
      "format": "date_time"
    },
    {
      "field": "docker.container.created",
      "format": "date_time"
    },
    {
      "field": "docker.healthcheck.event.end_date",
      "format": "date_time"
    },
    {
      "field": "docker.healthcheck.event.start_date",
      "format": "date_time"
    },
    {
      "field": "docker.image.created",
      "format": "date_time"
    },
    {
      "field": "event.created",
      "format": "date_time"
    },
    {
      "field": "event.end",
      "format": "date_time"
    },
    {
      "field": "event.ingested",
      "format": "date_time"
    },
    {
      "field": "event.start",
      "format": "date_time"
    },
    {
      "field": "file.accessed",
      "format": "date_time"
    },
    {
      "field": "file.created",
      "format": "date_time"
    },
    {
      "field": "file.ctime",
      "format": "date_time"
    },
    {
      "field": "file.mtime",
      "format": "date_time"
    },
    {
      "field": "file.x509.not_after",
      "format": "date_time"
    },
    {
      "field": "file.x509.not_before",
      "format": "date_time"
    },
    {
      "field": "kubernetes.container.start_time",
      "format": "date_time"
    },
    {
      "field": "kubernetes.event.metadata.timestamp.created",
      "format": "date_time"
    },
    {
      "field": "kubernetes.event.timestamp.first_occurrence",
      "format": "date_time"
    },
    {
      "field": "kubernetes.event.timestamp.last_occurrence",
      "format": "date_time"
    },
    {
      "field": "kubernetes.node.start_time",
      "format": "date_time"
    },
    {
      "field": "kubernetes.pod.start_time",
      "format": "date_time"
    },
    {
      "field": "kubernetes.service.created",
      "format": "date_time"
    },
    {
      "field": "kubernetes.storageclass.created",
      "format": "date_time"
    },
    {
      "field": "kubernetes.system.start_time",
      "format": "date_time"
    },
    {
      "field": "mongodb.replstatus.server_date",
      "format": "date_time"
    },
    {
      "field": "mongodb.status.background_flushing.last_finished",
      "format": "date_time"
    },
    {
      "field": "mongodb.status.local_time",
      "format": "date_time"
    },
    {
      "field": "mysql.performance.events_statements.last.seen",
      "format": "date_time"
    },
    {
      "field": "nats.server.time",
      "format": "date_time"
    },
    {
      "field": "package.installed",
      "format": "date_time"
    },
    {
      "field": "php_fpm.pool.start_time",
      "format": "date_time"
    },
    {
      "field": "php_fpm.process.start_time",
      "format": "date_time"
    },
    {
      "field": "postgresql.activity.backend_start",
      "format": "date_time"
    },
    {
      "field": "postgresql.activity.query_start",
      "format": "date_time"
    },
    {
      "field": "postgresql.activity.state_change",
      "format": "date_time"
    },
    {
      "field": "postgresql.activity.transaction_start",
      "format": "date_time"
    },
    {
      "field": "postgresql.bgwriter.stats_reset",
      "format": "date_time"
    },
    {
      "field": "postgresql.database.stats_reset",
      "format": "date_time"
    },
    {
      "field": "process.cpu.start_time",
      "format": "date_time"
    },
    {
      "field": "process.parent.start",
      "format": "date_time"
    },
    {
      "field": "process.start",
      "format": "date_time"
    },
    {
      "field": "system.process.cpu.start_time",
      "format": "date_time"
    },
    {
      "field": "system.service.state_since",
      "format": "date_time"
    },
    {
      "field": "tls.client.not_after",
      "format": "date_time"
    },
    {
      "field": "tls.client.not_before",
      "format": "date_time"
    },
    {
      "field": "tls.client.x509.not_after",
      "format": "date_time"
    },
    {
      "field": "tls.client.x509.not_before",
      "format": "date_time"
    },
    {
      "field": "tls.client_certificate.not_after",
      "format": "date_time"
    },
    {
      "field": "tls.client_certificate.not_before",
      "format": "date_time"
    },
    {
      "field": "tls.detailed.client_certificate.not_after",
      "format": "date_time"
    },
    {
      "field": "tls.detailed.client_certificate.not_before",
      "format": "date_time"
    },
    {
      "field": "tls.detailed.server_certificate.not_after",
      "format": "date_time"
    },
    {
      "field": "tls.detailed.server_certificate.not_before",
      "format": "date_time"
    },
    {
      "field": "tls.server.not_after",
      "format": "date_time"
    },
    {
      "field": "tls.server.not_before",
      "format": "date_time"
    },
    {
      "field": "tls.server.x509.not_after",
      "format": "date_time"
    },
    {
      "field": "tls.server.x509.not_before",
      "format": "date_time"
    },
    {
      "field": "tls.server_certificate.not_after",
      "format": "date_time"
    },
    {
      "field": "tls.server_certificate.not_before",
      "format": "date_time"
    },
    {
      "field": "x509.not_after",
      "format": "date_time"
    },
    {
      "field": "x509.not_before",
      "format": "date_time"
    },
    {
      "field": "zookeeper.server.version_date",
      "format": "date_time"
    }
  ],
  "script_fields": {},
  "stored_fields": [
    "@timestamp",
    "_id",
    "_index",
    "_score",
    "_source",
    "_type",
    "agent.build.original",
    "agent.ephemeral_id",
    "agent.hostname",
    "agent.id",
    "agent.name",
    "agent.type",
    "agent.version",
    "amqp.app-id",
    "amqp.auto-delete",
    "amqp.class-id",
    "amqp.consumer-count",
    "amqp.consumer-tag",
    "amqp.content-encoding",
    "amqp.content-type",
    "amqp.correlation-id",
    "amqp.delivery-mode",
    "amqp.delivery-tag",
    "amqp.durable",
    "amqp.exchange",
    "amqp.exchange-type",
    "amqp.exclusive",
    "amqp.expiration",
    "amqp.if-empty",
    "amqp.if-unused",
    "amqp.immediate",
    "amqp.mandatory",
    "amqp.message-count",
    "amqp.message-id",
    "amqp.method-id",
    "amqp.multiple",
    "amqp.no-ack",
    "amqp.no-local",
    "amqp.no-wait",
    "amqp.passive",
    "amqp.priority",
    "amqp.queue",
    "amqp.redelivered",
    "amqp.reply-code",
    "amqp.reply-text",
    "amqp.reply-to",
    "amqp.routing-key",
    "amqp.timestamp",
    "amqp.type",
    "amqp.user-id",
    "apache.status.bytes_per_request",
    "apache.status.bytes_per_sec",
    "apache.status.connections.async.closing",
    "apache.status.connections.async.keep_alive",
    "apache.status.connections.async.writing",
    "apache.status.connections.total",
    "apache.status.cpu.children_system",
    "apache.status.cpu.children_user",
    "apache.status.cpu.load",
    "apache.status.cpu.system",
    "apache.status.cpu.user",
    "apache.status.hostname",
    "apache.status.load.1",
    "apache.status.load.15",
    "apache.status.load.5",
    "apache.status.requests_per_sec",
    "apache.status.scoreboard.closing_connection",
    "apache.status.scoreboard.dns_lookup",
    "apache.status.scoreboard.gracefully_finishing",
    "apache.status.scoreboard.idle_cleanup",
    "apache.status.scoreboard.keepalive",
    "apache.status.scoreboard.logging",
    "apache.status.scoreboard.open_slot",
    "apache.status.scoreboard.reading_request",
    "apache.status.scoreboard.sending_reply",
    "apache.status.scoreboard.starting_up",
    "apache.status.scoreboard.total",
    "apache.status.scoreboard.waiting_for_connection",
    "apache.status.total_accesses",
    "apache.status.total_kbytes",
    "apache.status.uptime.server_uptime",
    "apache.status.uptime.uptime",
    "apache.status.workers.busy",
    "apache.status.workers.idle",
    "as.number",
    "as.organization.name",
    "as.organization.name.text",
    "beat.id",
    "beat.state.management.enabled",
    "beat.state.module.count",
    "beat.state.output.name",
    "beat.state.queue.name",
    "beat.stats.libbeat.output.events.acked",
    "beat.stats.libbeat.output.events.active",
    "beat.stats.libbeat.output.events.batches",
    "beat.stats.libbeat.output.events.dropped",
    "beat.stats.libbeat.output.events.duplicates",
    "beat.stats.libbeat.output.events.failed",
    "beat.stats.libbeat.output.events.toomany",
    "beat.stats.libbeat.output.events.total",
    "beat.stats.libbeat.output.read.bytes",
    "beat.stats.libbeat.output.read.errors",
    "beat.stats.libbeat.output.type",
    "beat.stats.libbeat.output.write.bytes",
    "beat.stats.libbeat.output.write.errors",
    "beat.stats.runtime.goroutines",
    "beat.stats.uptime.ms",
    "beat.type",
    "bytes_in",
    "bytes_out",
    "cassandra.no_request",
    "cassandra.request.headers.flags",
    "cassandra.request.headers.length",
    "cassandra.request.headers.op",
    "cassandra.request.headers.stream",
    "cassandra.request.headers.version",
    "cassandra.request.query",
    "cassandra.response.authentication.class",
    "cassandra.response.error.code",
    "cassandra.response.error.details.alive",
    "cassandra.response.error.details.arg_types",
    "cassandra.response.error.details.blockfor",
    "cassandra.response.error.details.data_present",
    "cassandra.response.error.details.function",
    "cassandra.response.error.details.keyspace",
    "cassandra.response.error.details.num_failures",
    "cassandra.response.error.details.read_consistency",
    "cassandra.response.error.details.received",
    "cassandra.response.error.details.required",
    "cassandra.response.error.details.stmt_id",
    "cassandra.response.error.details.table",
    "cassandra.response.error.details.write_type",
    "cassandra.response.error.msg",
    "cassandra.response.error.type",
    "cassandra.response.event.change",
    "cassandra.response.event.host",
    "cassandra.response.event.port",
    "cassandra.response.event.schema_change.args",
    "cassandra.response.event.schema_change.change",
    "cassandra.response.event.schema_change.keyspace",
    "cassandra.response.event.schema_change.name",
    "cassandra.response.event.schema_change.object",
    "cassandra.response.event.schema_change.table",
    "cassandra.response.event.schema_change.target",
    "cassandra.response.event.type",
    "cassandra.response.headers.flags",
    "cassandra.response.headers.length",
    "cassandra.response.headers.op",
    "cassandra.response.headers.stream",
    "cassandra.response.headers.version",
    "cassandra.response.result.keyspace",
    "cassandra.response.result.prepared.prepared_id",
    "cassandra.response.result.prepared.req_meta.col_count",
    "cassandra.response.result.prepared.req_meta.flags",
    "cassandra.response.result.prepared.req_meta.keyspace",
    "cassandra.response.result.prepared.req_meta.paging_state",
    "cassandra.response.result.prepared.req_meta.pkey_columns",
    "cassandra.response.result.prepared.req_meta.table",
    "cassandra.response.result.prepared.resp_meta.col_count",
    "cassandra.response.result.prepared.resp_meta.flags",
    "cassandra.response.result.prepared.resp_meta.keyspace",
    "cassandra.response.result.prepared.resp_meta.paging_state",
    "cassandra.response.result.prepared.resp_meta.pkey_columns",
    "cassandra.response.result.prepared.resp_meta.table",
    "cassandra.response.result.rows.meta.col_count",
    "cassandra.response.result.rows.meta.flags",
    "cassandra.response.result.rows.meta.keyspace",
    "cassandra.response.result.rows.meta.paging_state",
    "cassandra.response.result.rows.meta.pkey_columns",
    "cassandra.response.result.rows.meta.table",
    "cassandra.response.result.rows.num_rows",
    "cassandra.response.result.schema_change.args",
    "cassandra.response.result.schema_change.change",
    "cassandra.response.result.schema_change.keyspace",
    "cassandra.response.result.schema_change.name",
    "cassandra.response.result.schema_change.object",
    "cassandra.response.result.schema_change.table",
    "cassandra.response.result.schema_change.target",
    "cassandra.response.result.type",
    "cassandra.response.warnings",
    "ceph.cluster_disk.available.bytes",
    "ceph.cluster_disk.total.bytes",
    "ceph.cluster_disk.used.bytes",
    "ceph.cluster_health.overall_status",
    "ceph.cluster_health.timechecks.epoch",
    "ceph.cluster_health.timechecks.round.status",
    "ceph.cluster_health.timechecks.round.value",
    "ceph.cluster_status.degraded.objects",
    "ceph.cluster_status.degraded.ratio",
    "ceph.cluster_status.degraded.total",
    "ceph.cluster_status.misplace.objects",
    "ceph.cluster_status.misplace.ratio",
    "ceph.cluster_status.misplace.total",
    "ceph.cluster_status.osd.epoch",
    "ceph.cluster_status.osd.full",
    "ceph.cluster_status.osd.nearfull",
    "ceph.cluster_status.osd.num_in_osds",
    "ceph.cluster_status.osd.num_osds",
    "ceph.cluster_status.osd.num_remapped_pgs",
    "ceph.cluster_status.osd.num_up_osds",
    "ceph.cluster_status.pg.avail_bytes",
    "ceph.cluster_status.pg.data_bytes",
    "ceph.cluster_status.pg.total_bytes",
    "ceph.cluster_status.pg.used_bytes",
    "ceph.cluster_status.pg_state.count",
    "ceph.cluster_status.pg_state.state_name",
    "ceph.cluster_status.pg_state.version",
    "ceph.cluster_status.traffic.read_bytes",
    "ceph.cluster_status.traffic.read_op_per_sec",
    "ceph.cluster_status.traffic.write_bytes",
    "ceph.cluster_status.traffic.write_op_per_sec",
    "ceph.cluster_status.version",
    "ceph.mgr_osd_perf.id",
    "ceph.mgr_osd_perf.stats.apply_latency_ms",
    "ceph.mgr_osd_perf.stats.apply_latency_ns",
    "ceph.mgr_osd_perf.stats.commit_latency_ms",
    "ceph.mgr_osd_perf.stats.commit_latency_ns",
    "ceph.mgr_osd_pool_stats.pool_id",
    "ceph.mgr_osd_pool_stats.pool_name",
    "ceph.monitor_health.available.kb",
    "ceph.monitor_health.available.pct",
    "ceph.monitor_health.health",
    "ceph.monitor_health.last_updated",
    "ceph.monitor_health.name",
    "ceph.monitor_health.store_stats.last_updated",
    "ceph.monitor_health.store_stats.log.bytes",
    "ceph.monitor_health.store_stats.misc.bytes",
    "ceph.monitor_health.store_stats.sst.bytes",
    "ceph.monitor_health.store_stats.total.bytes",
    "ceph.monitor_health.total.kb",
    "ceph.monitor_health.used.kb",
    "ceph.osd_df.available.bytes",
    "ceph.osd_df.device_class",
    "ceph.osd_df.id",
    "ceph.osd_df.name",
    "ceph.osd_df.pg_num",
    "ceph.osd_df.total.byte",
    "ceph.osd_df.used.byte",
    "ceph.osd_df.used.pct",
    "ceph.osd_tree.children",
    "ceph.osd_tree.crush_weight",
    "ceph.osd_tree.depth",
    "ceph.osd_tree.device_class",
    "ceph.osd_tree.exists",
    "ceph.osd_tree.father",
    "ceph.osd_tree.id",
    "ceph.osd_tree.name",
    "ceph.osd_tree.primary_affinity",
    "ceph.osd_tree.reweight",
    "ceph.osd_tree.status",
    "ceph.osd_tree.type",
    "ceph.osd_tree.type_id",
    "ceph.pool_disk.id",
    "ceph.pool_disk.name",
    "ceph.pool_disk.stats.available.bytes",
    "ceph.pool_disk.stats.objects",
    "ceph.pool_disk.stats.used.bytes",
    "ceph.pool_disk.stats.used.kb",
    "client.address",
    "client.as.number",
    "client.as.organization.name",
    "client.as.organization.name.text",
    "client.bytes",
    "client.domain",
    "client.geo.city_name",
    "client.geo.continent_name",
    "client.geo.country_iso_code",
    "client.geo.country_name",
    "client.geo.location",
    "client.geo.name",
    "client.geo.region_iso_code",
    "client.geo.region_name",
    "client.ip",
    "client.mac",
    "client.nat.ip",
    "client.nat.port",
    "client.packets",
    "client.port",
    "client.process.args",
    "client.process.executable",
    "client.process.name",
    "client.process.start",
    "client.process.working_directory",
    "client.registered_domain",
    "client.subdomain",
    "client.top_level_domain",
    "client.user.domain",
    "client.user.email",
    "client.user.full_name",
    "client.user.full_name.text",
    "client.user.group.domain",
    "client.user.group.id",
    "client.user.group.name",
    "client.user.hash",
    "client.user.id",
    "client.user.name",
    "client.user.name.text",
    "client.user.roles",
    "cloud.account.id",
    "cloud.account.name",
    "cloud.availability_zone",
    "cloud.image.id",
    "cloud.instance.id",
    "cloud.instance.name",
    "cloud.machine.type",
    "cloud.project.id",
    "cloud.project.name",
    "cloud.provider",
    "cloud.region",
    "code_signature.exists",
    "code_signature.status",
    "code_signature.subject_name",
    "code_signature.trusted",
    "code_signature.valid",
    "consul.agent.autopilot.healthy",
    "consul.agent.runtime.alloc.bytes",
    "consul.agent.runtime.garbage_collector.pause.current.ns",
    "consul.agent.runtime.garbage_collector.pause.total.ns",
    "consul.agent.runtime.garbage_collector.runs",
    "consul.agent.runtime.goroutines",
    "consul.agent.runtime.heap_objects",
    "consul.agent.runtime.malloc_count",
    "consul.agent.runtime.sys.bytes",
    "container.id",
    "container.image.name",
    "container.image.tag",
    "container.name",
    "container.runtime",
    "couchbase.bucket.data.used.bytes",
    "couchbase.bucket.disk.fetches",
    "couchbase.bucket.disk.used.bytes",
    "couchbase.bucket.item_count",
    "couchbase.bucket.memory.used.bytes",
    "couchbase.bucket.name",
    "couchbase.bucket.ops_per_sec",
    "couchbase.bucket.quota.ram.bytes",
    "couchbase.bucket.quota.use.pct",
    "couchbase.bucket.type",
    "couchbase.cluster.hdd.free.bytes",
    "couchbase.cluster.hdd.quota.total.bytes",
    "couchbase.cluster.hdd.total.bytes",
    "couchbase.cluster.hdd.used.by_data.bytes",
    "couchbase.cluster.hdd.used.value.bytes",
    "couchbase.cluster.max_bucket_count",
    "couchbase.cluster.quota.index_memory.mb",
    "couchbase.cluster.quota.memory.mb",
    "couchbase.cluster.ram.quota.total.per_node.bytes",
    "couchbase.cluster.ram.quota.total.value.bytes",
    "couchbase.cluster.ram.quota.used.per_node.bytes",
    "couchbase.cluster.ram.quota.used.value.bytes",
    "couchbase.cluster.ram.total.bytes",
    "couchbase.cluster.ram.used.by_data.bytes",
    "couchbase.cluster.ram.used.value.bytes",
    "couchbase.node.cmd_get",
    "couchbase.node.couch.docs.data_size.bytes",
    "couchbase.node.couch.docs.disk_size.bytes",
    "couchbase.node.couch.spatial.data_size.bytes",
    "couchbase.node.couch.spatial.disk_size.bytes",
    "couchbase.node.couch.views.data_size.bytes",
    "couchbase.node.couch.views.disk_size.bytes",
    "couchbase.node.cpu_utilization_rate.pct",
    "couchbase.node.current_items.total",
    "couchbase.node.current_items.value",
    "couchbase.node.ep_bg_fetched",
    "couchbase.node.get_hits",
    "couchbase.node.hostname",
    "couchbase.node.mcd_memory.allocated.bytes",
    "couchbase.node.mcd_memory.reserved.bytes",
    "couchbase.node.memory.free.bytes",
    "couchbase.node.memory.total.bytes",
    "couchbase.node.memory.used.bytes",
    "couchbase.node.ops",
    "couchbase.node.swap.total.bytes",
    "couchbase.node.swap.used.bytes",
    "couchbase.node.uptime.sec",
    "couchbase.node.vb_replica_curr_items",
    "couchdb.server.couchdb.auth_cache_hits",
    "couchdb.server.couchdb.auth_cache_misses",
    "couchdb.server.couchdb.database_reads",
    "couchdb.server.couchdb.database_writes",
    "couchdb.server.couchdb.open_databases",
    "couchdb.server.couchdb.open_os_files",
    "couchdb.server.couchdb.request_time",
    "couchdb.server.httpd.bulk_requests",
    "couchdb.server.httpd.clients_requesting_changes",
    "couchdb.server.httpd.requests",
    "couchdb.server.httpd.temporary_view_reads",
    "couchdb.server.httpd.view_reads",
    "couchdb.server.httpd_request_methods.COPY",
    "couchdb.server.httpd_request_methods.DELETE",
    "couchdb.server.httpd_request_methods.GET",
    "couchdb.server.httpd_request_methods.HEAD",
    "couchdb.server.httpd_request_methods.POST",
    "couchdb.server.httpd_request_methods.PUT",
    "couchdb.server.httpd_status_codes.200",
    "couchdb.server.httpd_status_codes.201",
    "couchdb.server.httpd_status_codes.202",
    "couchdb.server.httpd_status_codes.301",
    "couchdb.server.httpd_status_codes.304",
    "couchdb.server.httpd_status_codes.400",
    "couchdb.server.httpd_status_codes.401",
    "couchdb.server.httpd_status_codes.403",
    "couchdb.server.httpd_status_codes.404",
    "couchdb.server.httpd_status_codes.405",
    "couchdb.server.httpd_status_codes.409",
    "couchdb.server.httpd_status_codes.412",
    "couchdb.server.httpd_status_codes.500",
    "destination.address",
    "destination.as.number",
    "destination.as.organization.name",
    "destination.as.organization.name.text",
    "destination.bytes",
    "destination.domain",
    "destination.geo.city_name",
    "destination.geo.continent_name",
    "destination.geo.country_iso_code",
    "destination.geo.country_name",
    "destination.geo.location",
    "destination.geo.name",
    "destination.geo.region_iso_code",
    "destination.geo.region_name",
    "destination.ip",
    "destination.mac",
    "destination.nat.ip",
    "destination.nat.port",
    "destination.packets",
    "destination.port",
    "destination.registered_domain",
    "destination.subdomain",
    "destination.top_level_domain",
    "destination.user.domain",
    "destination.user.email",
    "destination.user.full_name",
    "destination.user.full_name.text",
    "destination.user.group.domain",
    "destination.user.group.id",
    "destination.user.group.name",
    "destination.user.hash",
    "destination.user.id",
    "destination.user.name",
    "destination.user.name.text",
    "destination.user.roles",
    "dhcpv4.assigned_ip",
    "dhcpv4.client_ip",
    "dhcpv4.client_mac",
    "dhcpv4.flags",
    "dhcpv4.hardware_type",
    "dhcpv4.hops",
    "dhcpv4.op_code",
    "dhcpv4.option.boot_file_name",
    "dhcpv4.option.broadcast_address",
    "dhcpv4.option.class_identifier",
    "dhcpv4.option.dns_servers",
    "dhcpv4.option.domain_name",
    "dhcpv4.option.hostname",
    "dhcpv4.option.ip_address_lease_time_sec",
    "dhcpv4.option.max_dhcp_message_size",
    "dhcpv4.option.message",
    "dhcpv4.option.message_type",
    "dhcpv4.option.ntp_servers",
    "dhcpv4.option.parameter_request_list",
    "dhcpv4.option.rebinding_time_sec",
    "dhcpv4.option.renewal_time_sec",
    "dhcpv4.option.requested_ip_address",
    "dhcpv4.option.router",
    "dhcpv4.option.server_identifier",
    "dhcpv4.option.subnet_mask",
    "dhcpv4.option.time_servers",
    "dhcpv4.option.utc_time_offset_sec",
    "dhcpv4.relay_ip",
    "dhcpv4.seconds",
    "dhcpv4.server_ip",
    "dhcpv4.server_name",
    "dhcpv4.transaction_id",
    "dll.code_signature.exists",
    "dll.code_signature.status",
    "dll.code_signature.subject_name",
    "dll.code_signature.trusted",
    "dll.code_signature.valid",
    "dll.hash.md5",
    "dll.hash.sha1",
    "dll.hash.sha256",
    "dll.hash.sha512",
    "dll.name",
    "dll.path",
    "dll.pe.architecture",
    "dll.pe.company",
    "dll.pe.description",
    "dll.pe.file_version",
    "dll.pe.imphash",
    "dll.pe.original_file_name",
    "dll.pe.product",
    "dns.additionals.class",
    "dns.additionals.data",
    "dns.additionals.name",
    "dns.additionals.ttl",
    "dns.additionals.type",
    "dns.additionals_count",
    "dns.answers.class",
    "dns.answers.data",
    "dns.answers.name",
    "dns.answers.ttl",
    "dns.answers.type",
    "dns.answers_count",
    "dns.authorities.class",
    "dns.authorities.name",
    "dns.authorities.type",
    "dns.authorities_count",
    "dns.flags.authentic_data",
    "dns.flags.authoritative",
    "dns.flags.checking_disabled",
    "dns.flags.recursion_available",
    "dns.flags.recursion_desired",
    "dns.flags.truncated_response",
    "dns.header_flags",
    "dns.id",
    "dns.op_code",
    "dns.opt.do",
    "dns.opt.ext_rcode",
    "dns.opt.udp_size",
    "dns.opt.version",
    "dns.question.class",
    "dns.question.etld_plus_one",
    "dns.question.name",
    "dns.question.registered_domain",
    "dns.question.subdomain",
    "dns.question.top_level_domain",
    "dns.question.type",
    "dns.resolved_ip",
    "dns.response_code",
    "dns.type",
    "docker.container.command",
    "docker.container.created",
    "docker.container.ip_addresses",
    "docker.container.size.root_fs",
    "docker.container.size.rw",
    "docker.container.status",
    "docker.container.tags",
    "docker.cpu.kernel.norm.pct",
    "docker.cpu.kernel.pct",
    "docker.cpu.kernel.ticks",
    "docker.cpu.system.norm.pct",
    "docker.cpu.system.pct",
    "docker.cpu.system.ticks",
    "docker.cpu.total.norm.pct",
    "docker.cpu.total.pct",
    "docker.cpu.user.norm.pct",
    "docker.cpu.user.pct",
    "docker.cpu.user.ticks",
    "docker.diskio.read.bytes",
    "docker.diskio.read.ops",
    "docker.diskio.read.queued",
    "docker.diskio.read.rate",
    "docker.diskio.read.service_time",
    "docker.diskio.read.wait_time",
    "docker.diskio.reads",
    "docker.diskio.summary.bytes",
    "docker.diskio.summary.ops",
    "docker.diskio.summary.queued",
    "docker.diskio.summary.rate",
    "docker.diskio.summary.service_time",
    "docker.diskio.summary.wait_time",
    "docker.diskio.total",
    "docker.diskio.write.bytes",
    "docker.diskio.write.ops",
    "docker.diskio.write.queued",
    "docker.diskio.write.rate",
    "docker.diskio.write.service_time",
    "docker.diskio.write.wait_time",
    "docker.diskio.writes",
    "docker.event.action",
    "docker.event.actor.id",
    "docker.event.from",
    "docker.event.id",
    "docker.event.status",
    "docker.event.type",
    "docker.healthcheck.event.end_date",
    "docker.healthcheck.event.exit_code",
    "docker.healthcheck.event.output",
    "docker.healthcheck.event.start_date",
    "docker.healthcheck.failingstreak",
    "docker.healthcheck.status",
    "docker.image.created",
    "docker.image.id.current",
    "docker.image.id.parent",
    "docker.image.size.regular",
    "docker.image.size.virtual",
    "docker.image.tags",
    "docker.info.containers.paused",
    "docker.info.containers.running",
    "docker.info.containers.stopped",
    "docker.info.containers.total",
    "docker.info.id",
    "docker.info.images",
    "docker.memory.commit.peak",
    "docker.memory.commit.total",
    "docker.memory.fail.count",
    "docker.memory.limit",
    "docker.memory.private_working_set.total",
    "docker.memory.rss.pct",
    "docker.memory.rss.total",
    "docker.memory.usage.max",
    "docker.memory.usage.pct",
    "docker.memory.usage.total",
    "docker.network.in.bytes",
    "docker.network.in.dropped",
    "docker.network.in.errors",
    "docker.network.in.packets",
    "docker.network.inbound.bytes",
    "docker.network.inbound.dropped",
    "docker.network.inbound.errors",
    "docker.network.inbound.packets",
    "docker.network.interface",
    "docker.network.out.bytes",
    "docker.network.out.dropped",
    "docker.network.out.errors",
    "docker.network.out.packets",
    "docker.network.outbound.bytes",
    "docker.network.outbound.dropped",
    "docker.network.outbound.errors",
    "docker.network.outbound.packets",
    "ecs.version",
    "elasticsearch.ccr.follower.global_checkpoint",
    "elasticsearch.ccr.follower.index",
    "elasticsearch.ccr.follower.operations_written",
    "elasticsearch.ccr.follower.shard.number",
    "elasticsearch.ccr.follower.time_since_last_read.ms",
    "elasticsearch.ccr.leader.index",
    "elasticsearch.ccr.leader.max_seq_no",
    "elasticsearch.cluster.id",
    "elasticsearch.cluster.name",
    "elasticsearch.cluster.pending_task.insert_order",
    "elasticsearch.cluster.pending_task.priority",
    "elasticsearch.cluster.pending_task.source",
    "elasticsearch.cluster.pending_task.time_in_queue.ms",
    "elasticsearch.cluster.state.id",
    "elasticsearch.cluster.stats.indices.count",
    "elasticsearch.cluster.stats.indices.fielddata.memory.bytes",
    "elasticsearch.cluster.stats.indices.shards.count",
    "elasticsearch.cluster.stats.indices.shards.primaries",
    "elasticsearch.cluster.stats.nodes.count",
    "elasticsearch.cluster.stats.nodes.data",
    "elasticsearch.cluster.stats.nodes.master",
    "elasticsearch.cluster.stats.status",
    "elasticsearch.enrich.executed_searches.total",
    "elasticsearch.enrich.queue.size",
    "elasticsearch.enrich.remote_requests.current",
    "elasticsearch.enrich.remote_requests.total",
    "elasticsearch.index.name",
    "elasticsearch.index.recovery.id",
    "elasticsearch.index.recovery.primary",
    "elasticsearch.index.recovery.source.host",
    "elasticsearch.index.recovery.source.id",
    "elasticsearch.index.recovery.source.name",
    "elasticsearch.index.recovery.stage",
    "elasticsearch.index.recovery.target.host",
    "elasticsearch.index.recovery.target.id",
    "elasticsearch.index.recovery.target.name",
    "elasticsearch.index.recovery.type",
    "elasticsearch.index.summary.primaries.docs.count",
    "elasticsearch.index.summary.primaries.docs.deleted",
    "elasticsearch.index.summary.primaries.segments.count",
    "elasticsearch.index.summary.primaries.segments.memory.bytes",
    "elasticsearch.index.summary.primaries.store.size.bytes",
    "elasticsearch.index.summary.total.docs.count",
    "elasticsearch.index.summary.total.docs.deleted",
    "elasticsearch.index.summary.total.segments.count",
    "elasticsearch.index.summary.total.segments.memory.bytes",
    "elasticsearch.index.summary.total.store.size.bytes",
    "elasticsearch.index.total.docs.count",
    "elasticsearch.index.total.docs.deleted",
    "elasticsearch.index.total.segments.count",
    "elasticsearch.index.total.segments.memory.bytes",
    "elasticsearch.index.total.store.size.bytes",
    "elasticsearch.ml.job.data_counts.invalid_date_count",
    "elasticsearch.ml.job.data_counts.processed_record_count",
    "elasticsearch.ml.job.id",
    "elasticsearch.ml.job.state",
    "elasticsearch.node.id",
    "elasticsearch.node.jvm.memory.heap.init.bytes",
    "elasticsearch.node.jvm.memory.heap.max.bytes",
    "elasticsearch.node.jvm.memory.nonheap.init.bytes",
    "elasticsearch.node.jvm.memory.nonheap.max.bytes",
    "elasticsearch.node.jvm.version",
    "elasticsearch.node.name",
    "elasticsearch.node.process.mlockall",
    "elasticsearch.node.stats.fs.summary.available.bytes",
    "elasticsearch.node.stats.fs.summary.free.bytes",
    "elasticsearch.node.stats.fs.summary.total.bytes",
    "elasticsearch.node.stats.indices.docs.count",
    "elasticsearch.node.stats.indices.docs.deleted",
    "elasticsearch.node.stats.indices.segments.count",
    "elasticsearch.node.stats.indices.segments.memory.bytes",
    "elasticsearch.node.stats.indices.store.size.bytes",
    "elasticsearch.node.stats.jvm.gc.collectors.old.collection.count",
    "elasticsearch.node.stats.jvm.gc.collectors.old.collection.ms",
    "elasticsearch.node.stats.jvm.gc.collectors.young.collection.count",
    "elasticsearch.node.stats.jvm.gc.collectors.young.collection.ms",
    "elasticsearch.node.stats.jvm.mem.pools.old.max.bytes",
    "elasticsearch.node.stats.jvm.mem.pools.old.peak.bytes",
    "elasticsearch.node.stats.jvm.mem.pools.old.peak_max.bytes",
    "elasticsearch.node.stats.jvm.mem.pools.old.used.bytes",
    "elasticsearch.node.stats.jvm.mem.pools.survivor.max.bytes",
    "elasticsearch.node.stats.jvm.mem.pools.survivor.peak.bytes",
    "elasticsearch.node.stats.jvm.mem.pools.survivor.peak_max.bytes",
    "elasticsearch.node.stats.jvm.mem.pools.survivor.used.bytes",
    "elasticsearch.node.stats.jvm.mem.pools.young.max.bytes",
    "elasticsearch.node.stats.jvm.mem.pools.young.peak.bytes",
    "elasticsearch.node.stats.jvm.mem.pools.young.peak_max.bytes",
    "elasticsearch.node.stats.jvm.mem.pools.young.used.bytes",
    "elasticsearch.node.version",
    "elasticsearch.shard.number",
    "elasticsearch.shard.primary",
    "elasticsearch.shard.relocating_node.name",
    "elasticsearch.shard.state",
    "envoyproxy.server.cluster_manager.active_clusters",
    "envoyproxy.server.cluster_manager.cluster_added",
    "envoyproxy.server.cluster_manager.cluster_modified",
    "envoyproxy.server.cluster_manager.cluster_removed",
    "envoyproxy.server.cluster_manager.cluster_updated",
    "envoyproxy.server.cluster_manager.cluster_updated_via_merge",
    "envoyproxy.server.cluster_manager.update_merge_cancelled",
    "envoyproxy.server.cluster_manager.update_out_of_merge_window",
    "envoyproxy.server.cluster_manager.warming_clusters",
    "envoyproxy.server.filesystem.flushed_by_timer",
    "envoyproxy.server.filesystem.reopen_failed",
    "envoyproxy.server.filesystem.write_buffered",
    "envoyproxy.server.filesystem.write_completed",
    "envoyproxy.server.filesystem.write_failed",
    "envoyproxy.server.filesystem.write_total_buffered",
    "envoyproxy.server.http2.header_overflow",
    "envoyproxy.server.http2.headers_cb_no_stream",
    "envoyproxy.server.http2.rx_messaging_error",
    "envoyproxy.server.http2.rx_reset",
    "envoyproxy.server.http2.too_many_header_frames",
    "envoyproxy.server.http2.trailers",
    "envoyproxy.server.http2.tx_reset",
    "envoyproxy.server.listener_manager.listener_added",
    "envoyproxy.server.listener_manager.listener_create_failure",
    "envoyproxy.server.listener_manager.listener_create_success",
    "envoyproxy.server.listener_manager.listener_modified",
    "envoyproxy.server.listener_manager.listener_removed",
    "envoyproxy.server.listener_manager.listener_stopped",
    "envoyproxy.server.listener_manager.total_listeners_active",
    "envoyproxy.server.listener_manager.total_listeners_draining",
    "envoyproxy.server.listener_manager.total_listeners_warming",
    "envoyproxy.server.runtime.admin_overrides_active",
    "envoyproxy.server.runtime.deprecated_feature_use",
    "envoyproxy.server.runtime.load_error",
    "envoyproxy.server.runtime.load_success",
    "envoyproxy.server.runtime.num_keys",
    "envoyproxy.server.runtime.num_layers",
    "envoyproxy.server.runtime.override_dir_exists",
    "envoyproxy.server.runtime.override_dir_not_exists",
    "envoyproxy.server.server.concurrency",
    "envoyproxy.server.server.days_until_first_cert_expiring",
    "envoyproxy.server.server.debug_assertion_failures",
    "envoyproxy.server.server.dynamic_unknown_fields",
    "envoyproxy.server.server.hot_restart_epoch",
    "envoyproxy.server.server.live",
    "envoyproxy.server.server.memory_allocated",
    "envoyproxy.server.server.memory_heap_size",
    "envoyproxy.server.server.parent_connections",
    "envoyproxy.server.server.state",
    "envoyproxy.server.server.static_unknown_fields",
    "envoyproxy.server.server.stats_recent_lookups",
    "envoyproxy.server.server.total_connections",
    "envoyproxy.server.server.uptime",
    "envoyproxy.server.server.version",
    "envoyproxy.server.server.watchdog_mega_miss",
    "envoyproxy.server.server.watchdog_miss",
    "envoyproxy.server.stats.overflow",
    "error.code",
    "error.id",
    "error.message",
    "error.stack_trace",
    "error.stack_trace.text",
    "error.type",
    "etcd.api_version",
    "etcd.disk.backend_commit_duration.ns.count",
    "etcd.disk.backend_commit_duration.ns.sum",
    "etcd.disk.mvcc_db_total_size.bytes",
    "etcd.disk.wal_fsync_duration.ns.count",
    "etcd.disk.wal_fsync_duration.ns.sum",
    "etcd.leader.followers.counts.followers.counts.fail",
    "etcd.leader.followers.counts.followers.counts.success",
    "etcd.leader.followers.latency.follower.latency.standardDeviation",
    "etcd.leader.followers.latency.followers.latency.average",
    "etcd.leader.followers.latency.followers.latency.current",
    "etcd.leader.followers.latency.followers.latency.maximum",
    "etcd.leader.followers.latency.followers.latency.minimum",
    "etcd.leader.leader",
    "etcd.memory.go_memstats_alloc.bytes",
    "etcd.network.client_grpc_received.bytes",
    "etcd.network.client_grpc_sent.bytes",
    "etcd.self.id",
    "etcd.self.leaderinfo.leader",
    "etcd.self.leaderinfo.starttime",
    "etcd.self.leaderinfo.uptime",
    "etcd.self.name",
    "etcd.self.recv.appendrequest.count",
    "etcd.self.recv.bandwidthrate",
    "etcd.self.recv.pkgrate",
    "etcd.self.send.appendrequest.count",
    "etcd.self.send.bandwidthrate",
    "etcd.self.send.pkgrate",
    "etcd.self.starttime",
    "etcd.self.state",
    "etcd.server.grpc_handled.count",
    "etcd.server.grpc_started.count",
    "etcd.server.has_leader",
    "etcd.server.leader_changes.count",
    "etcd.server.proposals_committed.count",
    "etcd.server.proposals_failed.count",
    "etcd.server.proposals_pending.count",
    "etcd.store.compareanddelete.fail",
    "etcd.store.compareanddelete.success",
    "etcd.store.compareandswap.fail",
    "etcd.store.compareandswap.success",
    "etcd.store.create.fail",
    "etcd.store.create.success",
    "etcd.store.delete.fail",
    "etcd.store.delete.success",
    "etcd.store.expire.count",
    "etcd.store.gets.fail",
    "etcd.store.gets.success",
    "etcd.store.sets.fail",
    "etcd.store.sets.success",
    "etcd.store.update.fail",
    "etcd.store.update.success",
    "etcd.store.watchers",
    "event.action",
    "event.category",
    "event.code",
    "event.created",
    "event.dataset",
    "event.duration",
    "event.end",
    "event.hash",
    "event.id",
    "event.ingested",
    "event.kind",
    "event.module",
    "event.original",
    "event.outcome",
    "event.provider",
    "event.reason",
    "event.reference",
    "event.risk_score",
    "event.risk_score_norm",
    "event.sequence",
    "event.severity",
    "event.start",
    "event.timezone",
    "event.type",
    "event.url",
    "file.accessed",
    "file.attributes",
    "file.code_signature.exists",
    "file.code_signature.status",
    "file.code_signature.subject_name",
    "file.code_signature.trusted",
    "file.code_signature.valid",
    "file.created",
    "file.ctime",
    "file.device",
    "file.directory",
    "file.drive_letter",
    "file.extension",
    "file.gid",
    "file.group",
    "file.hash.md5",
    "file.hash.sha1",
    "file.hash.sha256",
    "file.hash.sha512",
    "file.inode",
    "file.mime_type",
    "file.mode",
    "file.mtime",
    "file.name",
    "file.owner",
    "file.path",
    "file.path.text",
    "file.pe.architecture",
    "file.pe.company",
    "file.pe.description",
    "file.pe.file_version",
    "file.pe.imphash",
    "file.pe.original_file_name",
    "file.pe.product",
    "file.size",
    "file.target_path",
    "file.target_path.text",
    "file.type",
    "file.uid",
    "file.x509.alternative_names",
    "file.x509.issuer.common_name",
    "file.x509.issuer.country",
    "file.x509.issuer.distinguished_name",
    "file.x509.issuer.locality",
    "file.x509.issuer.organization",
    "file.x509.issuer.organizational_unit",
    "file.x509.issuer.state_or_province",
    "file.x509.not_after",
    "file.x509.not_before",
    "file.x509.public_key_algorithm",
    "file.x509.public_key_curve",
    "file.x509.public_key_exponent",
    "file.x509.public_key_size",
    "file.x509.serial_number",
    "file.x509.signature_algorithm",
    "file.x509.subject.common_name",
    "file.x509.subject.country",
    "file.x509.subject.distinguished_name",
    "file.x509.subject.locality",
    "file.x509.subject.organization",
    "file.x509.subject.organizational_unit",
    "file.x509.subject.state_or_province",
    "file.x509.version_number",
    "flow.final",
    "flow.id",
    "flow.vlan",
    "geo.city_name",
    "geo.continent_name",
    "geo.country_iso_code",
    "geo.country_name",
    "geo.location",
    "geo.name",
    "geo.region_iso_code",
    "geo.region_name",
    "golang.expvar.cmdline",
    "golang.heap.allocations.active",
    "golang.heap.allocations.allocated",
    "golang.heap.allocations.frees",
    "golang.heap.allocations.idle",
    "golang.heap.allocations.mallocs",
    "golang.heap.allocations.objects",
    "golang.heap.allocations.total",
    "golang.heap.cmdline",
    "golang.heap.gc.cpu_fraction",
    "golang.heap.gc.next_gc_limit",
    "golang.heap.gc.pause.avg.ns",
    "golang.heap.gc.pause.count",
    "golang.heap.gc.pause.max.ns",
    "golang.heap.gc.pause.sum.ns",
    "golang.heap.gc.total_count",
    "golang.heap.gc.total_pause.ns",
    "golang.heap.system.obtained",
    "golang.heap.system.released",
    "golang.heap.system.stack",
    "golang.heap.system.total",
    "graphite.server.example",
    "group.domain",
    "group.id",
    "group.name",
    "haproxy.info.busy_polling",
    "haproxy.info.bytes.out.rate",
    "haproxy.info.bytes.out.total",
    "haproxy.info.compress.bps.in",
    "haproxy.info.compress.bps.out",
    "haproxy.info.compress.bps.rate_limit",
    "haproxy.info.connection.current",
    "haproxy.info.connection.hard_max",
    "haproxy.info.connection.max",
    "haproxy.info.connection.rate.limit",
    "haproxy.info.connection.rate.max",
    "haproxy.info.connection.rate.value",
    "haproxy.info.connection.ssl.current",
    "haproxy.info.connection.ssl.max",
    "haproxy.info.connection.ssl.total",
    "haproxy.info.connection.total",
    "haproxy.info.dropped_logs",
    "haproxy.info.failed_resolutions",
    "haproxy.info.idle.pct",
    "haproxy.info.jobs",
    "haproxy.info.listeners",
    "haproxy.info.memory.max.bytes",
    "haproxy.info.peers.active",
    "haproxy.info.peers.connected",
    "haproxy.info.pipes.free",
    "haproxy.info.pipes.max",
    "haproxy.info.pipes.used",
    "haproxy.info.pool.allocated",
    "haproxy.info.pool.failed",
    "haproxy.info.pool.used",
    "haproxy.info.process_num",
    "haproxy.info.processes",
    "haproxy.info.requests.max",
    "haproxy.info.requests.total",
    "haproxy.info.run_queue",
    "haproxy.info.session.rate.limit",
    "haproxy.info.session.rate.max",
    "haproxy.info.session.rate.value",
    "haproxy.info.sockets.max",
    "haproxy.info.ssl.backend.key_rate.max",
    "haproxy.info.ssl.backend.key_rate.value",
    "haproxy.info.ssl.cache_misses",
    "haproxy.info.ssl.cached_lookups",
    "haproxy.info.ssl.frontend.key_rate.max",
    "haproxy.info.ssl.frontend.key_rate.value",
    "haproxy.info.ssl.frontend.session_reuse.pct",
    "haproxy.info.ssl.rate.limit",
    "haproxy.info.ssl.rate.max",
    "haproxy.info.ssl.rate.value",
    "haproxy.info.stopping",
    "haproxy.info.tasks",
    "haproxy.info.threads",
    "haproxy.info.ulimit_n",
    "haproxy.info.unstoppable_jobs",
    "haproxy.info.uptime.sec",
    "haproxy.info.zlib_mem_usage.max",
    "haproxy.info.zlib_mem_usage.value",
    "haproxy.stat.agent.check.description",
    "haproxy.stat.agent.check.fall",
    "haproxy.stat.agent.check.health",
    "haproxy.stat.agent.check.rise",
    "haproxy.stat.agent.code",
    "haproxy.stat.agent.description",
    "haproxy.stat.agent.duration",
    "haproxy.stat.agent.fall",
    "haproxy.stat.agent.health",
    "haproxy.stat.agent.rise",
    "haproxy.stat.agent.status",
    "haproxy.stat.check.agent.last",
    "haproxy.stat.check.code",
    "haproxy.stat.check.down",
    "haproxy.stat.check.duration",
    "haproxy.stat.check.failed",
    "haproxy.stat.check.health.fail",
    "haproxy.stat.check.health.last",
    "haproxy.stat.check.status",
    "haproxy.stat.client.aborted",
    "haproxy.stat.component_type",
    "haproxy.stat.compressor.bypassed.bytes",
    "haproxy.stat.compressor.in.bytes",
    "haproxy.stat.compressor.out.bytes",
    "haproxy.stat.compressor.response.bytes",
    "haproxy.stat.connection.attempt.total",
    "haproxy.stat.connection.cache.hits",
    "haproxy.stat.connection.cache.lookup.total",
    "haproxy.stat.connection.idle.limit",
    "haproxy.stat.connection.idle.total",
    "haproxy.stat.connection.rate",
    "haproxy.stat.connection.rate_max",
    "haproxy.stat.connection.retried",
    "haproxy.stat.connection.reuse.total",
    "haproxy.stat.connection.time.avg",
    "haproxy.stat.connection.total",
    "haproxy.stat.cookie",
    "haproxy.stat.downtime",
    "haproxy.stat.header.rewrite.failed.total",
    "haproxy.stat.in.bytes",
    "haproxy.stat.last_change",
    "haproxy.stat.load_balancing_algorithm",
    "haproxy.stat.out.bytes",
    "haproxy.stat.proxy.id",
    "haproxy.stat.proxy.mode",
    "haproxy.stat.proxy.name",
    "haproxy.stat.queue.limit",
    "haproxy.stat.queue.time.avg",
    "haproxy.stat.request.connection.errors",
    "haproxy.stat.request.denied",
    "haproxy.stat.request.denied_by_connection_rules",
    "haproxy.stat.request.denied_by_session_rules",
    "haproxy.stat.request.errors",
    "haproxy.stat.request.intercepted",
    "haproxy.stat.request.queued.current",
    "haproxy.stat.request.queued.max",
    "haproxy.stat.request.rate.max",
    "haproxy.stat.request.rate.value",
    "haproxy.stat.request.redispatched",
    "haproxy.stat.request.total",
    "haproxy.stat.response.denied",
    "haproxy.stat.response.errors",
    "haproxy.stat.response.http.1xx",
    "haproxy.stat.response.http.2xx",
    "haproxy.stat.response.http.3xx",
    "haproxy.stat.response.http.4xx",
    "haproxy.stat.response.http.5xx",
    "haproxy.stat.response.http.other",
    "haproxy.stat.response.time.avg",
    "haproxy.stat.selected.total",
    "haproxy.stat.server.aborted",
    "haproxy.stat.server.active",
    "haproxy.stat.server.backup",
    "haproxy.stat.server.id",
    "haproxy.stat.service_name",
    "haproxy.stat.session.current",
    "haproxy.stat.session.limit",
    "haproxy.stat.session.max",
    "haproxy.stat.session.rate.limit",
    "haproxy.stat.session.rate.max",
    "haproxy.stat.session.rate.value",
    "haproxy.stat.session.total",
    "haproxy.stat.source.address",
    "haproxy.stat.status",
    "haproxy.stat.throttle.pct",
    "haproxy.stat.tracked.id",
    "haproxy.stat.weight",
    "hash.md5",
    "hash.sha1",
    "hash.sha256",
    "hash.sha512",
    "host.architecture",
    "host.containerized",
    "host.cpu.pct",
    "host.domain",
    "host.geo.city_name",
    "host.geo.continent_name",
    "host.geo.country_iso_code",
    "host.geo.country_name",
    "host.geo.location",
    "host.geo.name",
    "host.geo.region_iso_code",
    "host.geo.region_name",
    "host.hostname",
    "host.id",
    "host.ip",
    "host.mac",
    "host.name",
    "host.network.in.bytes",
    "host.network.in.packets",
    "host.network.out.bytes",
    "host.network.out.packets",
    "host.os.build",
    "host.os.codename",
    "host.os.family",
    "host.os.full",
    "host.os.full.text",
    "host.os.kernel",
    "host.os.name",
    "host.os.name.text",
    "host.os.platform",
    "host.os.version",
    "host.type",
    "host.uptime",
    "host.user.domain",
    "host.user.email",
    "host.user.full_name",
    "host.user.full_name.text",
    "host.user.group.domain",
    "host.user.group.id",
    "host.user.group.name",
    "host.user.hash",
    "host.user.id",
    "host.user.name",
    "host.user.name.text",
    "host.user.roles",
    "http.request.body.bytes",
    "http.request.body.content",
    "http.request.body.content.text",
    "http.request.bytes",
    "http.request.headers.content-length",
    "http.request.method",
    "http.request.mime_type",
    "http.request.referrer",
    "http.response.body.bytes",
    "http.response.body.content",
    "http.response.body.content.text",
    "http.response.bytes",
    "http.response.code",
    "http.response.headers.content-length",
    "http.response.headers.content-type",
    "http.response.mime_type",
    "http.response.phrase",
    "http.response.status_code",
    "http.response.status_phrase",
    "http.version",
    "icmp.request.code",
    "icmp.request.message",
    "icmp.request.type",
    "icmp.response.code",
    "icmp.response.message",
    "icmp.response.type",
    "icmp.version",
    "interface.alias",
    "interface.id",
    "interface.name",
    "jolokia.agent.id",
    "jolokia.agent.version",
    "jolokia.secured",
    "jolokia.server.product",
    "jolokia.server.vendor",
    "jolokia.server.version",
    "jolokia.url",
    "kafka.broker.address",
    "kafka.broker.id",
    "kafka.broker.log.flush_rate",
    "kafka.broker.mbean",
    "kafka.broker.messages_in",
    "kafka.broker.net.in.bytes_per_sec",
    "kafka.broker.net.out.bytes_per_sec",
    "kafka.broker.net.rejected.bytes_per_sec",
    "kafka.broker.replication.leader_elections",
    "kafka.broker.replication.unclean_leader_elections",
    "kafka.broker.request.channel.queue.size",
    "kafka.broker.request.fetch.failed",
    "kafka.broker.request.fetch.failed_per_second",
    "kafka.broker.request.produce.failed",
    "kafka.broker.request.produce.failed_per_second",
    "kafka.broker.session.zookeeper.disconnect",
    "kafka.broker.session.zookeeper.expire",
    "kafka.broker.session.zookeeper.readonly",
    "kafka.broker.session.zookeeper.sync",
    "kafka.broker.topic.messages_in",
    "kafka.broker.topic.net.in.bytes_per_sec",
    "kafka.broker.topic.net.out.bytes_per_sec",
    "kafka.broker.topic.net.rejected.bytes_per_sec",
    "kafka.consumer.bytes_consumed",
    "kafka.consumer.fetch_rate",
    "kafka.consumer.in.bytes_per_sec",
    "kafka.consumer.kafka_commits",
    "kafka.consumer.max_lag",
    "kafka.consumer.mbean",
    "kafka.consumer.messages_in",
    "kafka.consumer.records_consumed",
    "kafka.consumer.zookeeper_commits",
    "kafka.consumergroup.broker.address",
    "kafka.consumergroup.broker.id",
    "kafka.consumergroup.client.host",
    "kafka.consumergroup.client.id",
    "kafka.consumergroup.client.member_id",
    "kafka.consumergroup.consumer_lag",
    "kafka.consumergroup.error.code",
    "kafka.consumergroup.id",
    "kafka.consumergroup.meta",
    "kafka.consumergroup.offset",
    "kafka.consumergroup.partition",
    "kafka.consumergroup.topic",
    "kafka.partition.broker.address",
    "kafka.partition.broker.id",
    "kafka.partition.id",
    "kafka.partition.offset.newest",
    "kafka.partition.offset.oldest",
    "kafka.partition.partition.error.code",
    "kafka.partition.partition.id",
    "kafka.partition.partition.insync_replica",
    "kafka.partition.partition.is_leader",
    "kafka.partition.partition.leader",
    "kafka.partition.partition.replica",
    "kafka.partition.topic.error.code",
    "kafka.partition.topic.name",
    "kafka.partition.topic_broker_id",
    "kafka.partition.topic_id",
    "kafka.producer.available_buffer_bytes",
    "kafka.producer.batch_size_avg",
    "kafka.producer.batch_size_max",
    "kafka.producer.io_wait",
    "kafka.producer.mbean",
    "kafka.producer.message_rate",
    "kafka.producer.out.bytes_per_sec",
    "kafka.producer.record_error_rate",
    "kafka.producer.record_retry_rate",
    "kafka.producer.record_send_rate",
    "kafka.producer.record_size_avg",
    "kafka.producer.record_size_max",
    "kafka.producer.records_per_request",
    "kafka.producer.request_rate",
    "kafka.producer.response_rate",
    "kafka.topic.error.code",
    "kafka.topic.name",
    "kibana.stats.concurrent_connections",
    "kibana.stats.host.name",
    "kibana.stats.index",
    "kibana.stats.name",
    "kibana.stats.process.event_loop_delay.ms",
    "kibana.stats.process.memory.heap.size_limit.bytes",
    "kibana.stats.process.memory.heap.total.bytes",
    "kibana.stats.process.memory.heap.uptime.ms",
    "kibana.stats.process.memory.heap.used.bytes",
    "kibana.stats.request.disconnects",
    "kibana.stats.request.total",
    "kibana.stats.response_time.avg.ms",
    "kibana.stats.response_time.max.ms",
    "kibana.stats.snapshot",
    "kibana.stats.status",
    "kibana.status.metrics.concurrent_connections",
    "kibana.status.metrics.requests.disconnects",
    "kibana.status.metrics.requests.total",
    "kibana.status.name",
    "kibana.status.status.overall.state",
    "kubernetes.apiserver.audit.event.count",
    "kubernetes.apiserver.audit.rejected.count",
    "kubernetes.apiserver.client.request.count",
    "kubernetes.apiserver.etcd.object.count",
    "kubernetes.apiserver.http.request.count",
    "kubernetes.apiserver.http.request.duration.us.count",
    "kubernetes.apiserver.http.request.duration.us.sum",
    "kubernetes.apiserver.http.request.size.bytes.count",
    "kubernetes.apiserver.http.request.size.bytes.sum",
    "kubernetes.apiserver.http.response.size.bytes.count",
    "kubernetes.apiserver.http.response.size.bytes.sum",
    "kubernetes.apiserver.process.cpu.sec",
    "kubernetes.apiserver.process.fds.open.count",
    "kubernetes.apiserver.process.memory.resident.bytes",
    "kubernetes.apiserver.process.memory.virtual.bytes",
    "kubernetes.apiserver.process.started.sec",
    "kubernetes.apiserver.request.client",
    "kubernetes.apiserver.request.code",
    "kubernetes.apiserver.request.component",
    "kubernetes.apiserver.request.content_type",
    "kubernetes.apiserver.request.count",
    "kubernetes.apiserver.request.current.count",
    "kubernetes.apiserver.request.dry_run",
    "kubernetes.apiserver.request.duration.us.count",
    "kubernetes.apiserver.request.duration.us.sum",
    "kubernetes.apiserver.request.group",
    "kubernetes.apiserver.request.handler",
    "kubernetes.apiserver.request.host",
    "kubernetes.apiserver.request.kind",
    "kubernetes.apiserver.request.latency.count",
    "kubernetes.apiserver.request.latency.sum",
    "kubernetes.apiserver.request.longrunning.count",
    "kubernetes.apiserver.request.method",
    "kubernetes.apiserver.request.resource",
    "kubernetes.apiserver.request.scope",
    "kubernetes.apiserver.request.subresource",
    "kubernetes.apiserver.request.verb",
    "kubernetes.apiserver.request.version",
    "kubernetes.container.cpu.limit.cores",
    "kubernetes.container.cpu.limit.nanocores",
    "kubernetes.container.cpu.request.cores",
    "kubernetes.container.cpu.request.nanocores",
    "kubernetes.container.cpu.usage.core.ns",
    "kubernetes.container.cpu.usage.limit.pct",
    "kubernetes.container.cpu.usage.nanocores",
    "kubernetes.container.cpu.usage.node.pct",
    "kubernetes.container.id",
    "kubernetes.container.image",
    "kubernetes.container.logs.available.bytes",
    "kubernetes.container.logs.capacity.bytes",
    "kubernetes.container.logs.inodes.count",
    "kubernetes.container.logs.inodes.free",
    "kubernetes.container.logs.inodes.used",
    "kubernetes.container.logs.used.bytes",
    "kubernetes.container.memory.available.bytes",
    "kubernetes.container.memory.limit.bytes",
    "kubernetes.container.memory.majorpagefaults",
    "kubernetes.container.memory.pagefaults",
    "kubernetes.container.memory.request.bytes",
    "kubernetes.container.memory.rss.bytes",
    "kubernetes.container.memory.usage.bytes",
    "kubernetes.container.memory.usage.limit.pct",
    "kubernetes.container.memory.usage.node.pct",
    "kubernetes.container.memory.workingset.bytes",
    "kubernetes.container.name",
    "kubernetes.container.rootfs.available.bytes",
    "kubernetes.container.rootfs.capacity.bytes",
    "kubernetes.container.rootfs.inodes.used",
    "kubernetes.container.rootfs.used.bytes",
    "kubernetes.container.start_time",
    "kubernetes.container.status.phase",
    "kubernetes.container.status.ready",
    "kubernetes.container.status.reason",
    "kubernetes.container.status.restarts",
    "kubernetes.controllermanager.client.request.count",
    "kubernetes.controllermanager.code",
    "kubernetes.controllermanager.handler",
    "kubernetes.controllermanager.host",
    "kubernetes.controllermanager.http.request.count",
    "kubernetes.controllermanager.http.request.duration.us.count",
    "kubernetes.controllermanager.http.request.duration.us.sum",
    "kubernetes.controllermanager.http.request.size.bytes.count",
    "kubernetes.controllermanager.http.request.size.bytes.sum",
    "kubernetes.controllermanager.http.response.size.bytes.count",
    "kubernetes.controllermanager.http.response.size.bytes.sum",
    "kubernetes.controllermanager.leader.is_master",
    "kubernetes.controllermanager.method",
    "kubernetes.controllermanager.name",
    "kubernetes.controllermanager.node.collector.count",
    "kubernetes.controllermanager.node.collector.eviction.count",
    "kubernetes.controllermanager.node.collector.health.pct",
    "kubernetes.controllermanager.node.collector.unhealthy.count",
    "kubernetes.controllermanager.process.cpu.sec",
    "kubernetes.controllermanager.process.fds.open.count",
    "kubernetes.controllermanager.process.memory.resident.bytes",
    "kubernetes.controllermanager.process.memory.virtual.bytes",
    "kubernetes.controllermanager.process.started.sec",
    "kubernetes.controllermanager.workqueue.adds.count",
    "kubernetes.controllermanager.workqueue.depth.count",
    "kubernetes.controllermanager.workqueue.longestrunning.sec",
    "kubernetes.controllermanager.workqueue.retries.count",
    "kubernetes.controllermanager.workqueue.unfinished.sec",
    "kubernetes.controllermanager.zone",
    "kubernetes.cronjob.active.count",
    "kubernetes.cronjob.concurrency",
    "kubernetes.cronjob.created.sec",
    "kubernetes.cronjob.deadline.sec",
    "kubernetes.cronjob.is_suspended",
    "kubernetes.cronjob.last_schedule.sec",
    "kubernetes.cronjob.name",
    "kubernetes.cronjob.next_schedule.sec",
    "kubernetes.cronjob.schedule",
    "kubernetes.daemonset.name",
    "kubernetes.daemonset.replicas.available",
    "kubernetes.daemonset.replicas.desired",
    "kubernetes.daemonset.replicas.ready",
    "kubernetes.daemonset.replicas.unavailable",
    "kubernetes.deployment.name",
    "kubernetes.deployment.paused",
    "kubernetes.deployment.replicas.available",
    "kubernetes.deployment.replicas.desired",
    "kubernetes.deployment.replicas.unavailable",
    "kubernetes.deployment.replicas.updated",
    "kubernetes.event.count",
    "kubernetes.event.involved_object.api_version",
    "kubernetes.event.involved_object.kind",
    "kubernetes.event.involved_object.name",
    "kubernetes.event.involved_object.resource_version",
    "kubernetes.event.involved_object.uid",
    "kubernetes.event.message",
    "kubernetes.event.metadata.generate_name",
    "kubernetes.event.metadata.name",
    "kubernetes.event.metadata.namespace",
    "kubernetes.event.metadata.resource_version",
    "kubernetes.event.metadata.self_link",
    "kubernetes.event.metadata.timestamp.created",
    "kubernetes.event.metadata.uid",
    "kubernetes.event.reason",
    "kubernetes.event.source.component",
    "kubernetes.event.source.host",
    "kubernetes.event.timestamp.first_occurrence",
    "kubernetes.event.timestamp.last_occurrence",
    "kubernetes.event.type",
    "kubernetes.namespace",
    "kubernetes.node.cpu.allocatable.cores",
    "kubernetes.node.cpu.capacity.cores",
    "kubernetes.node.cpu.usage.core.ns",
    "kubernetes.node.cpu.usage.nanocores",
    "kubernetes.node.fs.available.bytes",
    "kubernetes.node.fs.capacity.bytes",
    "kubernetes.node.fs.inodes.count",
    "kubernetes.node.fs.inodes.free",
    "kubernetes.node.fs.inodes.used",
    "kubernetes.node.fs.used.bytes",
    "kubernetes.node.hostname",
    "kubernetes.node.memory.allocatable.bytes",
    "kubernetes.node.memory.available.bytes",
    "kubernetes.node.memory.capacity.bytes",
    "kubernetes.node.memory.majorpagefaults",
    "kubernetes.node.memory.pagefaults",
    "kubernetes.node.memory.rss.bytes",
    "kubernetes.node.memory.usage.bytes",
    "kubernetes.node.memory.workingset.bytes",
    "kubernetes.node.name",
    "kubernetes.node.network.rx.bytes",
    "kubernetes.node.network.rx.errors",
    "kubernetes.node.network.tx.bytes",
    "kubernetes.node.network.tx.errors",
    "kubernetes.node.pod.allocatable.total",
    "kubernetes.node.pod.capacity.total",
    "kubernetes.node.runtime.imagefs.available.bytes",
    "kubernetes.node.runtime.imagefs.capacity.bytes",
    "kubernetes.node.runtime.imagefs.used.bytes",
    "kubernetes.node.start_time",
    "kubernetes.node.status.ready",
    "kubernetes.node.status.unschedulable",
    "kubernetes.persistentvolume.capacity.bytes",
    "kubernetes.persistentvolume.name",
    "kubernetes.persistentvolume.phase",
    "kubernetes.persistentvolume.storage_class",
    "kubernetes.persistentvolumeclaim.access_mode",
    "kubernetes.persistentvolumeclaim.name",
    "kubernetes.persistentvolumeclaim.phase",
    "kubernetes.persistentvolumeclaim.request_storage.bytes",
    "kubernetes.persistentvolumeclaim.storage_class",
    "kubernetes.persistentvolumeclaim.volume_name",
    "kubernetes.pod.cpu.usage.limit.pct",
    "kubernetes.pod.cpu.usage.nanocores",
    "kubernetes.pod.cpu.usage.node.pct",
    "kubernetes.pod.host_ip",
    "kubernetes.pod.ip",
    "kubernetes.pod.memory.available.bytes",
    "kubernetes.pod.memory.major_page_faults",
    "kubernetes.pod.memory.page_faults",
    "kubernetes.pod.memory.rss.bytes",
    "kubernetes.pod.memory.usage.bytes",
    "kubernetes.pod.memory.usage.limit.pct",
    "kubernetes.pod.memory.usage.node.pct",
    "kubernetes.pod.memory.working_set.bytes",
    "kubernetes.pod.name",
    "kubernetes.pod.network.rx.bytes",
    "kubernetes.pod.network.rx.errors",
    "kubernetes.pod.network.tx.bytes",
    "kubernetes.pod.network.tx.errors",
    "kubernetes.pod.start_time",
    "kubernetes.pod.status.phase",
    "kubernetes.pod.status.ready",
    "kubernetes.pod.status.scheduled",
    "kubernetes.pod.uid",
    "kubernetes.proxy.client.request.count",
    "kubernetes.proxy.code",
    "kubernetes.proxy.handler",
    "kubernetes.proxy.host",
    "kubernetes.proxy.http.request.count",
    "kubernetes.proxy.http.request.duration.us.count",
    "kubernetes.proxy.http.request.duration.us.sum",
    "kubernetes.proxy.http.request.size.bytes.count",
    "kubernetes.proxy.http.request.size.bytes.sum",
    "kubernetes.proxy.http.response.size.bytes.count",
    "kubernetes.proxy.http.response.size.bytes.sum",
    "kubernetes.proxy.method",
    "kubernetes.proxy.process.cpu.sec",
    "kubernetes.proxy.process.fds.open.count",
    "kubernetes.proxy.process.memory.resident.bytes",
    "kubernetes.proxy.process.memory.virtual.bytes",
    "kubernetes.proxy.process.started.sec",
    "kubernetes.proxy.sync.networkprogramming.duration.us.count",
    "kubernetes.proxy.sync.networkprogramming.duration.us.sum",
    "kubernetes.proxy.sync.rules.duration.us.count",
    "kubernetes.proxy.sync.rules.duration.us.sum",
    "kubernetes.replicaset.name",
    "kubernetes.replicaset.replicas.available",
    "kubernetes.replicaset.replicas.desired",
    "kubernetes.replicaset.replicas.labeled",
    "kubernetes.replicaset.replicas.observed",
    "kubernetes.replicaset.replicas.ready",
    "kubernetes.resourcequota.created.sec",
    "kubernetes.resourcequota.name",
    "kubernetes.resourcequota.quota",
    "kubernetes.resourcequota.resource",
    "kubernetes.resourcequota.type",
    "kubernetes.scheduler.client.request.count",
    "kubernetes.scheduler.code",
    "kubernetes.scheduler.handler",
    "kubernetes.scheduler.host",
    "kubernetes.scheduler.http.request.count",
    "kubernetes.scheduler.http.request.duration.us.count",
    "kubernetes.scheduler.http.request.duration.us.sum",
    "kubernetes.scheduler.http.request.size.bytes.count",
    "kubernetes.scheduler.http.request.size.bytes.sum",
    "kubernetes.scheduler.http.response.size.bytes.count",
    "kubernetes.scheduler.http.response.size.bytes.sum",
    "kubernetes.scheduler.leader.is_master",
    "kubernetes.scheduler.method",
    "kubernetes.scheduler.name",
    "kubernetes.scheduler.operation",
    "kubernetes.scheduler.process.cpu.sec",
    "kubernetes.scheduler.process.fds.open.count",
    "kubernetes.scheduler.process.memory.resident.bytes",
    "kubernetes.scheduler.process.memory.virtual.bytes",
    "kubernetes.scheduler.process.started.sec",
    "kubernetes.scheduler.result",
    "kubernetes.scheduler.scheduling.duration.seconds.count",
    "kubernetes.scheduler.scheduling.duration.seconds.sum",
    "kubernetes.scheduler.scheduling.e2e.duration.us.count",
    "kubernetes.scheduler.scheduling.e2e.duration.us.sum",
    "kubernetes.scheduler.scheduling.pod.attempts.count",
    "kubernetes.scheduler.scheduling.pod.preemption.victims.bucket.*",
    "kubernetes.scheduler.scheduling.pod.preemption.victims.count",
    "kubernetes.scheduler.scheduling.pod.preemption.victims.sum",
    "kubernetes.service.cluster_ip",
    "kubernetes.service.created",
    "kubernetes.service.external_ip",
    "kubernetes.service.external_name",
    "kubernetes.service.ingress_hostname",
    "kubernetes.service.ingress_ip",
    "kubernetes.service.load_balancer_ip",
    "kubernetes.service.name",
    "kubernetes.service.type",
    "kubernetes.statefulset.created",
    "kubernetes.statefulset.generation.desired",
    "kubernetes.statefulset.generation.observed",
    "kubernetes.statefulset.name",
    "kubernetes.statefulset.replicas.desired",
    "kubernetes.statefulset.replicas.observed",
    "kubernetes.storageclass.created",
    "kubernetes.storageclass.name",
    "kubernetes.storageclass.provisioner",
    "kubernetes.storageclass.reclaim_policy",
    "kubernetes.storageclass.volume_binding_mode",
    "kubernetes.system.container",
    "kubernetes.system.cpu.usage.core.ns",
    "kubernetes.system.cpu.usage.nanocores",
    "kubernetes.system.memory.majorpagefaults",
    "kubernetes.system.memory.pagefaults",
    "kubernetes.system.memory.rss.bytes",
    "kubernetes.system.memory.usage.bytes",
    "kubernetes.system.memory.workingset.bytes",
    "kubernetes.system.start_time",
    "kubernetes.volume.fs.available.bytes",
    "kubernetes.volume.fs.capacity.bytes",
    "kubernetes.volume.fs.inodes.count",
    "kubernetes.volume.fs.inodes.free",
    "kubernetes.volume.fs.inodes.used",
    "kubernetes.volume.fs.used.bytes",
    "kubernetes.volume.name",
    "kvm.dommemstat.id",
    "kvm.dommemstat.name",
    "kvm.dommemstat.stat.name",
    "kvm.dommemstat.stat.value",
    "kvm.id",
    "kvm.name",
    "kvm.status.state",
    "linux.conntrack.summary.drop",
    "linux.conntrack.summary.early_drop",
    "linux.conntrack.summary.entries",
    "linux.conntrack.summary.found",
    "linux.conntrack.summary.ignore",
    "linux.conntrack.summary.insert_failed",
    "linux.conntrack.summary.invalid",
    "linux.conntrack.summary.search_restart",
    "linux.iostat.await",
    "linux.iostat.busy",
    "linux.iostat.queue.avg_size",
    "linux.iostat.read.await",
    "linux.iostat.read.per_sec.bytes",
    "linux.iostat.read.request.merges_per_sec",
    "linux.iostat.read.request.per_sec",
    "linux.iostat.request.avg_size",
    "linux.iostat.service_time",
    "linux.iostat.write.await",
    "linux.iostat.write.per_sec.bytes",
    "linux.iostat.write.request.merges_per_sec",
    "linux.iostat.write.request.per_sec",
    "linux.ksm.stats.full_scans",
    "linux.ksm.stats.pages_shared",
    "linux.ksm.stats.pages_sharing",
    "linux.ksm.stats.pages_unshared",
    "linux.ksm.stats.stable_node_chains",
    "linux.ksm.stats.stable_node_dups",
    "linux.memory.hugepages.default_size",
    "linux.memory.hugepages.free",
    "linux.memory.hugepages.reserved",
    "linux.memory.hugepages.surplus",
    "linux.memory.hugepages.total",
    "linux.memory.hugepages.used.bytes",
    "linux.memory.hugepages.used.pct",
    "linux.memory.page_stats.direct_efficiency.pct",
    "linux.memory.page_stats.kswapd_efficiency.pct",
    "linux.memory.page_stats.pgfree.pages",
    "linux.memory.page_stats.pgscan_direct.pages",
    "linux.memory.page_stats.pgscan_kswapd.pages",
    "linux.memory.page_stats.pgsteal_direct.pages",
    "linux.memory.page_stats.pgsteal_kswapd.pages",
    "linux.pageinfo.buddy_info.DMA.0",
    "linux.pageinfo.buddy_info.DMA.1",
    "linux.pageinfo.buddy_info.DMA.10",
    "linux.pageinfo.buddy_info.DMA.2",
    "linux.pageinfo.buddy_info.DMA.3",
    "linux.pageinfo.buddy_info.DMA.4",
    "linux.pageinfo.buddy_info.DMA.5",
    "linux.pageinfo.buddy_info.DMA.6",
    "linux.pageinfo.buddy_info.DMA.7",
    "linux.pageinfo.buddy_info.DMA.8",
    "linux.pageinfo.buddy_info.DMA.9",
    "log.file.path",
    "log.level",
    "log.logger",
    "log.origin.file.line",
    "log.origin.file.name",
    "log.origin.function",
    "log.original",
    "log.syslog.facility.code",
    "log.syslog.facility.name",
    "log.syslog.priority",
    "log.syslog.severity.code",
    "log.syslog.severity.name",
    "logstash.node.jvm.version",
    "logstash.node.stats.events.filtered",
    "logstash.node.stats.events.in",
    "logstash.node.stats.events.out",
    "memcache.protocol_type",
    "memcache.request.automove",
    "memcache.request.bytes",
    "memcache.request.cas_unique",
    "memcache.request.command",
    "memcache.request.count_values",
    "memcache.request.delta",
    "memcache.request.dest_class",
    "memcache.request.exptime",
    "memcache.request.flags",
    "memcache.request.initial",
    "memcache.request.line",
    "memcache.request.noreply",
    "memcache.request.opaque",
    "memcache.request.opcode",
    "memcache.request.opcode_value",
    "memcache.request.quiet",
    "memcache.request.raw_args",
    "memcache.request.sleep_us",
    "memcache.request.source_class",
    "memcache.request.type",
    "memcache.request.vbucket",
    "memcache.request.verbosity",
    "memcache.response.bytes",
    "memcache.response.cas_unique",
    "memcache.response.command",
    "memcache.response.count_values",
    "memcache.response.error_msg",
    "memcache.response.flags",
    "memcache.response.opaque",
    "memcache.response.opcode",
    "memcache.response.opcode_value",
    "memcache.response.status",
    "memcache.response.status_code",
    "memcache.response.type",
    "memcache.response.value",
    "memcache.response.version",
    "memcached.stats.bytes.current",
    "memcached.stats.bytes.limit",
    "memcached.stats.cmd.get",
    "memcached.stats.cmd.set",
    "memcached.stats.connections.current",
    "memcached.stats.connections.total",
    "memcached.stats.evictions",
    "memcached.stats.get.hits",
    "memcached.stats.get.misses",
    "memcached.stats.items.current",
    "memcached.stats.items.total",
    "memcached.stats.pid",
    "memcached.stats.read.bytes",
    "memcached.stats.threads",
    "memcached.stats.uptime.sec",
    "memcached.stats.written.bytes",
    "message",
    "method",
    "metricset.name",
    "metricset.period",
    "mongodb.collstats.collection",
    "mongodb.collstats.commands.count",
    "mongodb.collstats.commands.time.us",
    "mongodb.collstats.db",
    "mongodb.collstats.getmore.count",
    "mongodb.collstats.getmore.time.us",
    "mongodb.collstats.insert.count",
    "mongodb.collstats.insert.time.us",
    "mongodb.collstats.lock.read.count",
    "mongodb.collstats.lock.read.time.us",
    "mongodb.collstats.lock.write.count",
    "mongodb.collstats.lock.write.time.us",
    "mongodb.collstats.name",
    "mongodb.collstats.queries.count",
    "mongodb.collstats.queries.time.us",
    "mongodb.collstats.remove.count",
    "mongodb.collstats.remove.time.us",
    "mongodb.collstats.total.count",
    "mongodb.collstats.total.time.us",
    "mongodb.collstats.update.count",
    "mongodb.collstats.update.time.us",
    "mongodb.cursorId",
    "mongodb.dbstats.avg_obj_size.bytes",
    "mongodb.dbstats.collections",
    "mongodb.dbstats.data_file_version.major",
    "mongodb.dbstats.data_file_version.minor",
    "mongodb.dbstats.data_size.bytes",
    "mongodb.dbstats.db",
    "mongodb.dbstats.extent_free_list.num",
    "mongodb.dbstats.extent_free_list.size.bytes",
    "mongodb.dbstats.file_size.bytes",
    "mongodb.dbstats.index_size.bytes",
    "mongodb.dbstats.indexes",
    "mongodb.dbstats.ns_size_mb.mb",
    "mongodb.dbstats.num_extents",
    "mongodb.dbstats.objects",
    "mongodb.dbstats.storage_size.bytes",
    "mongodb.error",
    "mongodb.fullCollectionName",
    "mongodb.metrics.commands.aggregate.failed",
    "mongodb.metrics.commands.aggregate.total",
    "mongodb.metrics.commands.build_info.failed",
    "mongodb.metrics.commands.build_info.total",
    "mongodb.metrics.commands.coll_stats.failed",
    "mongodb.metrics.commands.coll_stats.total",
    "mongodb.metrics.commands.connection_pool_stats.failed",
    "mongodb.metrics.commands.connection_pool_stats.total",
    "mongodb.metrics.commands.count.failed",
    "mongodb.metrics.commands.count.total",
    "mongodb.metrics.commands.db_stats.failed",
    "mongodb.metrics.commands.db_stats.total",
    "mongodb.metrics.commands.distinct.failed",
    "mongodb.metrics.commands.distinct.total",
    "mongodb.metrics.commands.find.failed",
    "mongodb.metrics.commands.find.total",
    "mongodb.metrics.commands.get_cmd_line_opts.failed",
    "mongodb.metrics.commands.get_cmd_line_opts.total",
    "mongodb.metrics.commands.get_last_error.failed",
    "mongodb.metrics.commands.get_last_error.total",
    "mongodb.metrics.commands.get_log.failed",
    "mongodb.metrics.commands.get_log.total",
    "mongodb.metrics.commands.get_more.failed",
    "mongodb.metrics.commands.get_more.total",
    "mongodb.metrics.commands.get_parameter.failed",
    "mongodb.metrics.commands.get_parameter.total",
    "mongodb.metrics.commands.host_info.failed",
    "mongodb.metrics.commands.host_info.total",
    "mongodb.metrics.commands.insert.failed",
    "mongodb.metrics.commands.insert.total",
    "mongodb.metrics.commands.is_master.failed",
    "mongodb.metrics.commands.is_master.total",
    "mongodb.metrics.commands.is_self.failed",
    "mongodb.metrics.commands.is_self.total",
    "mongodb.metrics.commands.last_collections.failed",
    "mongodb.metrics.commands.last_collections.total",
    "mongodb.metrics.commands.last_commands.failed",
    "mongodb.metrics.commands.last_commands.total",
    "mongodb.metrics.commands.list_databased.failed",
    "mongodb.metrics.commands.list_databased.total",
    "mongodb.metrics.commands.list_indexes.failed",
    "mongodb.metrics.commands.list_indexes.total",
    "mongodb.metrics.commands.ping.failed",
    "mongodb.metrics.commands.ping.total",
    "mongodb.metrics.commands.profile.failed",
    "mongodb.metrics.commands.profile.total",
    "mongodb.metrics.commands.replset_get_rbid.failed",
    "mongodb.metrics.commands.replset_get_rbid.total",
    "mongodb.metrics.commands.replset_get_status.failed",
    "mongodb.metrics.commands.replset_get_status.total",
    "mongodb.metrics.commands.replset_heartbeat.failed",
    "mongodb.metrics.commands.replset_heartbeat.total",
    "mongodb.metrics.commands.replset_update_position.failed",
    "mongodb.metrics.commands.replset_update_position.total",
    "mongodb.metrics.commands.server_status.failed",
    "mongodb.metrics.commands.server_status.total",
    "mongodb.metrics.commands.update.failed",
    "mongodb.metrics.commands.update.total",
    "mongodb.metrics.commands.whatsmyuri.failed",
    "mongodb.metrics.commands.whatsmyuri.total",
    "mongodb.metrics.cursor.open.no_timeout",
    "mongodb.metrics.cursor.open.pinned",
    "mongodb.metrics.cursor.open.total",
    "mongodb.metrics.cursor.timed_out",
    "mongodb.metrics.document.deleted",
    "mongodb.metrics.document.inserted",
    "mongodb.metrics.document.returned",
    "mongodb.metrics.document.updated",
    "mongodb.metrics.get_last_error.write_timeouts",
    "mongodb.metrics.get_last_error.write_wait.count",
    "mongodb.metrics.get_last_error.write_wait.ms",
    "mongodb.metrics.operation.scan_and_order",
    "mongodb.metrics.operation.write_conflicts",
    "mongodb.metrics.query_executor.scanned_documents.count",
    "mongodb.metrics.query_executor.scanned_indexes.count",
    "mongodb.metrics.replication.apply.attempts_to_become_secondary",
    "mongodb.metrics.replication.apply.batches.count",
    "mongodb.metrics.replication.apply.batches.time.ms",
    "mongodb.metrics.replication.apply.ops",
    "mongodb.metrics.replication.buffer.count",
    "mongodb.metrics.replication.buffer.max_size.bytes",
    "mongodb.metrics.replication.buffer.size.bytes",
    "mongodb.metrics.replication.executor.counters.cancels",
    "mongodb.metrics.replication.executor.counters.event_created",
    "mongodb.metrics.replication.executor.counters.event_wait",
    "mongodb.metrics.replication.executor.counters.scheduled.dbwork",
    "mongodb.metrics.replication.executor.counters.scheduled.exclusive",
    "mongodb.metrics.replication.executor.counters.scheduled.failures",
    "mongodb.metrics.replication.executor.counters.scheduled.netcmd",
    "mongodb.metrics.replication.executor.counters.scheduled.work",
    "mongodb.metrics.replication.executor.counters.scheduled.work_at",
    "mongodb.metrics.replication.executor.counters.waits",
    "mongodb.metrics.replication.executor.event_waiters",
    "mongodb.metrics.replication.executor.network_interface",
    "mongodb.metrics.replication.executor.queues.free",
    "mongodb.metrics.replication.executor.queues.in_progress.dbwork",
    "mongodb.metrics.replication.executor.queues.in_progress.exclusive",
    "mongodb.metrics.replication.executor.queues.in_progress.network",
    "mongodb.metrics.replication.executor.queues.ready",
    "mongodb.metrics.replication.executor.queues.sleepers",
    "mongodb.metrics.replication.executor.shutting_down",
    "mongodb.metrics.replication.executor.unsignaled_events",
    "mongodb.metrics.replication.initial_sync.completed",
    "mongodb.metrics.replication.initial_sync.failed_attempts",
    "mongodb.metrics.replication.initial_sync.failures",
    "mongodb.metrics.replication.network.bytes",
    "mongodb.metrics.replication.network.getmores.count",
    "mongodb.metrics.replication.network.getmores.time.ms",
    "mongodb.metrics.replication.network.ops",
    "mongodb.metrics.replication.network.reders_created",
    "mongodb.metrics.replication.preload.docs.count",
    "mongodb.metrics.replication.preload.docs.time.ms",
    "mongodb.metrics.replication.preload.indexes.count",
    "mongodb.metrics.replication.preload.indexes.time.ms",
    "mongodb.metrics.storage.free_list.search.bucket_exhausted",
    "mongodb.metrics.storage.free_list.search.requests",
    "mongodb.metrics.storage.free_list.search.scanned",
    "mongodb.metrics.ttl.deleted_documents.count",
    "mongodb.metrics.ttl.passes.count",
    "mongodb.numberReturned",
    "mongodb.numberToReturn",
    "mongodb.numberToSkip",
    "mongodb.query",
    "mongodb.replstatus.headroom.max",
    "mongodb.replstatus.headroom.min",
    "mongodb.replstatus.lag.max",
    "mongodb.replstatus.lag.min",
    "mongodb.replstatus.members.arbiter.count",
    "mongodb.replstatus.members.arbiter.hosts",
    "mongodb.replstatus.members.down.count",
    "mongodb.replstatus.members.down.hosts",
    "mongodb.replstatus.members.primary.host",
    "mongodb.replstatus.members.primary.optime",
    "mongodb.replstatus.members.recovering.count",
    "mongodb.replstatus.members.recovering.hosts",
    "mongodb.replstatus.members.rollback.count",
    "mongodb.replstatus.members.rollback.hosts",
    "mongodb.replstatus.members.secondary.count",
    "mongodb.replstatus.members.secondary.hosts",
    "mongodb.replstatus.members.secondary.optimes",
    "mongodb.replstatus.members.startup2.count",
    "mongodb.replstatus.members.startup2.hosts",
    "mongodb.replstatus.members.unhealthy.count",
    "mongodb.replstatus.members.unhealthy.hosts",
    "mongodb.replstatus.members.unknown.count",
    "mongodb.replstatus.members.unknown.hosts",
    "mongodb.replstatus.oplog.first.timestamp",
    "mongodb.replstatus.oplog.last.timestamp",
    "mongodb.replstatus.oplog.size.allocated",
    "mongodb.replstatus.oplog.size.used",
    "mongodb.replstatus.oplog.window",
    "mongodb.replstatus.optimes.applied",
    "mongodb.replstatus.optimes.durable",
    "mongodb.replstatus.optimes.last_committed",
    "mongodb.replstatus.server_date",
    "mongodb.replstatus.set_name",
    "mongodb.returnFieldsSelector",
    "mongodb.selector",
    "mongodb.startingFrom",
    "mongodb.status.asserts.msg",
    "mongodb.status.asserts.regular",
    "mongodb.status.asserts.rollovers",
    "mongodb.status.asserts.user",
    "mongodb.status.asserts.warning",
    "mongodb.status.background_flushing.average.ms",
    "mongodb.status.background_flushing.flushes",
    "mongodb.status.background_flushing.last.ms",
    "mongodb.status.background_flushing.last_finished",
    "mongodb.status.background_flushing.total.ms",
    "mongodb.status.connections.available",
    "mongodb.status.connections.current",
    "mongodb.status.connections.total_created",
    "mongodb.status.extra_info.heap_usage.bytes",
    "mongodb.status.extra_info.page_faults",
    "mongodb.status.global_lock.active_clients.readers",
    "mongodb.status.global_lock.active_clients.total",
    "mongodb.status.global_lock.active_clients.writers",
    "mongodb.status.global_lock.current_queue.readers",
    "mongodb.status.global_lock.current_queue.total",
    "mongodb.status.global_lock.current_queue.writers",
    "mongodb.status.global_lock.total_time.us",
    "mongodb.status.journaling.commits",
    "mongodb.status.journaling.commits_in_write_lock",
    "mongodb.status.journaling.compression",
    "mongodb.status.journaling.early_commits",
    "mongodb.status.journaling.journaled.mb",
    "mongodb.status.journaling.times.commits.ms",
    "mongodb.status.journaling.times.commits_in_write_lock.ms",
    "mongodb.status.journaling.times.dt.ms",
    "mongodb.status.journaling.times.prep_log_buffer.ms",
    "mongodb.status.journaling.times.remap_private_view.ms",
    "mongodb.status.journaling.times.write_to_data_files.ms",
    "mongodb.status.journaling.times.write_to_journal.ms",
    "mongodb.status.journaling.write_to_data_files.mb",
    "mongodb.status.local_time",
    "mongodb.status.locks.collection.acquire.count.R",
    "mongodb.status.locks.collection.acquire.count.W",
    "mongodb.status.locks.collection.acquire.count.r",
    "mongodb.status.locks.collection.acquire.count.w",
    "mongodb.status.locks.collection.deadlock.count.R",
    "mongodb.status.locks.collection.deadlock.count.W",
    "mongodb.status.locks.collection.deadlock.count.r",
    "mongodb.status.locks.collection.deadlock.count.w",
    "mongodb.status.locks.collection.wait.count.R",
    "mongodb.status.locks.collection.wait.count.W",
    "mongodb.status.locks.collection.wait.count.r",
    "mongodb.status.locks.collection.wait.count.w",
    "mongodb.status.locks.collection.wait.us.R",
    "mongodb.status.locks.collection.wait.us.W",
    "mongodb.status.locks.collection.wait.us.r",
    "mongodb.status.locks.collection.wait.us.w",
    "mongodb.status.locks.database.acquire.count.R",
    "mongodb.status.locks.database.acquire.count.W",
    "mongodb.status.locks.database.acquire.count.r",
    "mongodb.status.locks.database.acquire.count.w",
    "mongodb.status.locks.database.deadlock.count.R",
    "mongodb.status.locks.database.deadlock.count.W",
    "mongodb.status.locks.database.deadlock.count.r",
    "mongodb.status.locks.database.deadlock.count.w",
    "mongodb.status.locks.database.wait.count.R",
    "mongodb.status.locks.database.wait.count.W",
    "mongodb.status.locks.database.wait.count.r",
    "mongodb.status.locks.database.wait.count.w",
    "mongodb.status.locks.database.wait.us.R",
    "mongodb.status.locks.database.wait.us.W",
    "mongodb.status.locks.database.wait.us.r",
    "mongodb.status.locks.database.wait.us.w",
    "mongodb.status.locks.global.acquire.count.R",
    "mongodb.status.locks.global.acquire.count.W",
    "mongodb.status.locks.global.acquire.count.r",
    "mongodb.status.locks.global.acquire.count.w",
    "mongodb.status.locks.global.deadlock.count.R",
    "mongodb.status.locks.global.deadlock.count.W",
    "mongodb.status.locks.global.deadlock.count.r",
    "mongodb.status.locks.global.deadlock.count.w",
    "mongodb.status.locks.global.wait.count.R",
    "mongodb.status.locks.global.wait.count.W",
    "mongodb.status.locks.global.wait.count.r",
    "mongodb.status.locks.global.wait.count.w",
    "mongodb.status.locks.global.wait.us.R",
    "mongodb.status.locks.global.wait.us.W",
    "mongodb.status.locks.global.wait.us.r",
    "mongodb.status.locks.global.wait.us.w",
    "mongodb.status.locks.meta_data.acquire.count.R",
    "mongodb.status.locks.meta_data.acquire.count.W",
    "mongodb.status.locks.meta_data.acquire.count.r",
    "mongodb.status.locks.meta_data.acquire.count.w",
    "mongodb.status.locks.meta_data.deadlock.count.R",
    "mongodb.status.locks.meta_data.deadlock.count.W",
    "mongodb.status.locks.meta_data.deadlock.count.r",
    "mongodb.status.locks.meta_data.deadlock.count.w",
    "mongodb.status.locks.meta_data.wait.count.R",
    "mongodb.status.locks.meta_data.wait.count.W",
    "mongodb.status.locks.meta_data.wait.count.r",
    "mongodb.status.locks.meta_data.wait.count.w",
    "mongodb.status.locks.meta_data.wait.us.R",
    "mongodb.status.locks.meta_data.wait.us.W",
    "mongodb.status.locks.meta_data.wait.us.r",
    "mongodb.status.locks.meta_data.wait.us.w",
    "mongodb.status.locks.oplog.acquire.count.R",
    "mongodb.status.locks.oplog.acquire.count.W",
    "mongodb.status.locks.oplog.acquire.count.r",
    "mongodb.status.locks.oplog.acquire.count.w",
    "mongodb.status.locks.oplog.deadlock.count.R",
    "mongodb.status.locks.oplog.deadlock.count.W",
    "mongodb.status.locks.oplog.deadlock.count.r",
    "mongodb.status.locks.oplog.deadlock.count.w",
    "mongodb.status.locks.oplog.wait.count.R",
    "mongodb.status.locks.oplog.wait.count.W",
    "mongodb.status.locks.oplog.wait.count.r",
    "mongodb.status.locks.oplog.wait.count.w",
    "mongodb.status.locks.oplog.wait.us.R",
    "mongodb.status.locks.oplog.wait.us.W",
    "mongodb.status.locks.oplog.wait.us.r",
    "mongodb.status.locks.oplog.wait.us.w",
    "mongodb.status.memory.bits",
    "mongodb.status.memory.mapped.mb",
    "mongodb.status.memory.mapped_with_journal.mb",
    "mongodb.status.memory.resident.mb",
    "mongodb.status.memory.virtual.mb",
    "mongodb.status.network.in.bytes",
    "mongodb.status.network.out.bytes",
    "mongodb.status.network.requests",
    "mongodb.status.ops.counters.command",
    "mongodb.status.ops.counters.delete",
    "mongodb.status.ops.counters.getmore",
    "mongodb.status.ops.counters.insert",
    "mongodb.status.ops.counters.query",
    "mongodb.status.ops.counters.update",
    "mongodb.status.ops.latencies.commands.count",
    "mongodb.status.ops.latencies.commands.latency",
    "mongodb.status.ops.latencies.reads.count",
    "mongodb.status.ops.latencies.reads.latency",
    "mongodb.status.ops.latencies.writes.count",
    "mongodb.status.ops.latencies.writes.latency",
    "mongodb.status.ops.replicated.command",
    "mongodb.status.ops.replicated.delete",
    "mongodb.status.ops.replicated.getmore",
    "mongodb.status.ops.replicated.insert",
    "mongodb.status.ops.replicated.query",
    "mongodb.status.ops.replicated.update",
    "mongodb.status.process",
    "mongodb.status.storage_engine.name",
    "mongodb.status.uptime.ms",
    "mongodb.status.version",
    "mongodb.status.wired_tiger.cache.dirty.bytes",
    "mongodb.status.wired_tiger.cache.maximum.bytes",
    "mongodb.status.wired_tiger.cache.pages.evicted",
    "mongodb.status.wired_tiger.cache.pages.read",
    "mongodb.status.wired_tiger.cache.pages.write",
    "mongodb.status.wired_tiger.cache.used.bytes",
    "mongodb.status.wired_tiger.concurrent_transactions.read.available",
    "mongodb.status.wired_tiger.concurrent_transactions.read.out",
    "mongodb.status.wired_tiger.concurrent_transactions.read.total_tickets",
    "mongodb.status.wired_tiger.concurrent_transactions.write.available",
    "mongodb.status.wired_tiger.concurrent_transactions.write.out",
    "mongodb.status.wired_tiger.concurrent_transactions.write.total_tickets",
    "mongodb.status.wired_tiger.log.flushes",
    "mongodb.status.wired_tiger.log.max_file_size.bytes",
    "mongodb.status.wired_tiger.log.scans",
    "mongodb.status.wired_tiger.log.size.bytes",
    "mongodb.status.wired_tiger.log.syncs",
    "mongodb.status.wired_tiger.log.write.bytes",
    "mongodb.status.wired_tiger.log.writes",
    "mongodb.status.write_backs_queued",
    "mongodb.update",
    "munin.plugin.name",
    "mysql.affected_rows",
    "mysql.error_code",
    "mysql.error_message",
    "mysql.galera_status.apply.oooe",
    "mysql.galera_status.apply.oool",
    "mysql.galera_status.apply.window",
    "mysql.galera_status.cert.deps_distance",
    "mysql.galera_status.cert.index_size",
    "mysql.galera_status.cert.interval",
    "mysql.galera_status.cluster.conf_id",
    "mysql.galera_status.cluster.size",
    "mysql.galera_status.cluster.status",
    "mysql.galera_status.commit.oooe",
    "mysql.galera_status.commit.window",
    "mysql.galera_status.connected",
    "mysql.galera_status.evs.evict",
    "mysql.galera_status.evs.state",
    "mysql.galera_status.flow_ctl.paused",
    "mysql.galera_status.flow_ctl.paused_ns",
    "mysql.galera_status.flow_ctl.recv",
    "mysql.galera_status.flow_ctl.sent",
    "mysql.galera_status.last_committed",
    "mysql.galera_status.local.bf_aborts",
    "mysql.galera_status.local.cert_failures",
    "mysql.galera_status.local.commits",
    "mysql.galera_status.local.recv.queue",
    "mysql.galera_status.local.recv.queue_avg",
    "mysql.galera_status.local.recv.queue_max",
    "mysql.galera_status.local.recv.queue_min",
    "mysql.galera_status.local.replays",
    "mysql.galera_status.local.send.queue",
    "mysql.galera_status.local.send.queue_avg",
    "mysql.galera_status.local.send.queue_max",
    "mysql.galera_status.local.send.queue_min",
    "mysql.galera_status.local.state",
    "mysql.galera_status.ready",
    "mysql.galera_status.received.bytes",
    "mysql.galera_status.received.count",
    "mysql.galera_status.repl.bytes",
    "mysql.galera_status.repl.count",
    "mysql.galera_status.repl.data_bytes",
    "mysql.galera_status.repl.keys",
    "mysql.galera_status.repl.keys_bytes",
    "mysql.galera_status.repl.other_bytes",
    "mysql.insert_id",
    "mysql.num_fields",
    "mysql.num_rows",
    "mysql.performance.events_statements.avg.timer.wait",
    "mysql.performance.events_statements.count.star",
    "mysql.performance.events_statements.digest",
    "mysql.performance.events_statements.last.seen",
    "mysql.performance.events_statements.max.timer.wait",
    "mysql.performance.events_statements.quantile.95",
    "mysql.performance.table_io_waits.count.fetch",
    "mysql.performance.table_io_waits.index.name",
    "mysql.performance.table_io_waits.object.name",
    "mysql.performance.table_io_waits.object.schema",
    "mysql.query",
    "mysql.status.aborted.clients",
    "mysql.status.aborted.connects",
    "mysql.status.binlog.cache.disk_use",
    "mysql.status.binlog.cache.use",
    "mysql.status.bytes.received",
    "mysql.status.bytes.sent",
    "mysql.status.cache.ssl.hits",
    "mysql.status.cache.ssl.misses",
    "mysql.status.cache.ssl.size",
    "mysql.status.cache.table.open_cache.hits",
    "mysql.status.cache.table.open_cache.misses",
    "mysql.status.cache.table.open_cache.overflows",
    "mysql.status.command.delete",
    "mysql.status.command.insert",
    "mysql.status.command.select",
    "mysql.status.command.update",
    "mysql.status.connection.errors.accept",
    "mysql.status.connection.errors.internal",
    "mysql.status.connection.errors.max",
    "mysql.status.connection.errors.peer_address",
    "mysql.status.connection.errors.select",
    "mysql.status.connection.errors.tcpwrap",
    "mysql.status.connections",
    "mysql.status.created.tmp.disk_tables",
    "mysql.status.created.tmp.files",
    "mysql.status.created.tmp.tables",
    "mysql.status.delayed.errors",
    "mysql.status.delayed.insert_threads",
    "mysql.status.delayed.writes",
    "mysql.status.flush_commands",
    "mysql.status.handler.commit",
    "mysql.status.handler.delete",
    "mysql.status.handler.external_lock",
    "mysql.status.handler.mrr_init",
    "mysql.status.handler.prepare",
    "mysql.status.handler.read.first",
    "mysql.status.handler.read.key",
    "mysql.status.handler.read.last",
    "mysql.status.handler.read.next",
    "mysql.status.handler.read.prev",
    "mysql.status.handler.read.rnd",
    "mysql.status.handler.read.rnd_next",
    "mysql.status.handler.rollback",
    "mysql.status.handler.savepoint",
    "mysql.status.handler.savepoint_rollback",
    "mysql.status.handler.update",
    "mysql.status.handler.write",
    "mysql.status.innodb.buffer_pool.bytes.data",
    "mysql.status.innodb.buffer_pool.bytes.dirty",
    "mysql.status.innodb.buffer_pool.dump_status",
    "mysql.status.innodb.buffer_pool.load_status",
    "mysql.status.innodb.buffer_pool.pages.data",
    "mysql.status.innodb.buffer_pool.pages.dirty",
    "mysql.status.innodb.buffer_pool.pages.flushed",
    "mysql.status.innodb.buffer_pool.pages.free",
    "mysql.status.innodb.buffer_pool.pages.latched",
    "mysql.status.innodb.buffer_pool.pages.misc",
    "mysql.status.innodb.buffer_pool.pages.total",
    "mysql.status.innodb.buffer_pool.pool.reads",
    "mysql.status.innodb.buffer_pool.pool.resize_status",
    "mysql.status.innodb.buffer_pool.pool.wait_free",
    "mysql.status.innodb.buffer_pool.read.ahead",
    "mysql.status.innodb.buffer_pool.read.ahead_evicted",
    "mysql.status.innodb.buffer_pool.read.ahead_rnd",
    "mysql.status.innodb.buffer_pool.read.requests",
    "mysql.status.innodb.buffer_pool.write_requests",
    "mysql.status.innodb.rows.deleted",
    "mysql.status.innodb.rows.inserted",
    "mysql.status.innodb.rows.reads",
    "mysql.status.innodb.rows.updated",
    "mysql.status.max_used_connections",
    "mysql.status.open.files",
    "mysql.status.open.streams",
    "mysql.status.open.tables",
    "mysql.status.opened_tables",
    "mysql.status.queries",
    "mysql.status.questions",
    "mysql.status.threads.cached",
    "mysql.status.threads.connected",
    "mysql.status.threads.created",
    "mysql.status.threads.running",
    "nats.connection.idle_time",
    "nats.connection.in.bytes",
    "nats.connection.in.messages",
    "nats.connection.name",
    "nats.connection.out.bytes",
    "nats.connection.out.messages",
    "nats.connection.pending_bytes",
    "nats.connection.subscriptions",
    "nats.connection.uptime",
    "nats.connections.total",
    "nats.route.in.bytes",
    "nats.route.in.messages",
    "nats.route.ip",
    "nats.route.out.bytes",
    "nats.route.out.messages",
    "nats.route.pending_size",
    "nats.route.port",
    "nats.route.remote_id",
    "nats.route.subscriptions",
    "nats.routes.total",
    "nats.server.id",
    "nats.server.time",
    "nats.stats.cores",
    "nats.stats.cpu",
    "nats.stats.http.req_stats.uri.connz",
    "nats.stats.http.req_stats.uri.root",
    "nats.stats.http.req_stats.uri.routez",
    "nats.stats.http.req_stats.uri.subsz",
    "nats.stats.http.req_stats.uri.varz",
    "nats.stats.in.bytes",
    "nats.stats.in.messages",
    "nats.stats.mem.bytes",
    "nats.stats.out.bytes",
    "nats.stats.out.messages",
    "nats.stats.remotes",
    "nats.stats.slow_consumers",
    "nats.stats.total_connections",
    "nats.stats.uptime",
    "nats.subscriptions.cache.fanout.avg",
    "nats.subscriptions.cache.fanout.max",
    "nats.subscriptions.cache.hit_rate",
    "nats.subscriptions.cache.size",
    "nats.subscriptions.inserts",
    "nats.subscriptions.matches",
    "nats.subscriptions.removes",
    "nats.subscriptions.total",
    "network.application",
    "network.bytes",
    "network.community_id",
    "network.direction",
    "network.forwarded_ip",
    "network.iana_number",
    "network.inner.vlan.id",
    "network.inner.vlan.name",
    "network.name",
    "network.packets",
    "network.protocol",
    "network.transport",
    "network.type",
    "network.vlan.id",
    "network.vlan.name",
    "nfs.minor_version",
    "nfs.opcode",
    "nfs.status",
    "nfs.tag",
    "nfs.version",
    "nginx.stubstatus.accepts",
    "nginx.stubstatus.active",
    "nginx.stubstatus.current",
    "nginx.stubstatus.dropped",
    "nginx.stubstatus.handled",
    "nginx.stubstatus.hostname",
    "nginx.stubstatus.reading",
    "nginx.stubstatus.requests",
    "nginx.stubstatus.waiting",
    "nginx.stubstatus.writing",
    "notes",
    "observer.egress.interface.alias",
    "observer.egress.interface.id",
    "observer.egress.interface.name",
    "observer.egress.vlan.id",
    "observer.egress.vlan.name",
    "observer.egress.zone",
    "observer.geo.city_name",
    "observer.geo.continent_name",
    "observer.geo.country_iso_code",
    "observer.geo.country_name",
    "observer.geo.location",
    "observer.geo.name",
    "observer.geo.region_iso_code",
    "observer.geo.region_name",
    "observer.hostname",
    "observer.ingress.interface.alias",
    "observer.ingress.interface.id",
    "observer.ingress.interface.name",
    "observer.ingress.vlan.id",
    "observer.ingress.vlan.name",
    "observer.ingress.zone",
    "observer.ip",
    "observer.mac",
    "observer.name",
    "observer.os.family",
    "observer.os.full",
    "observer.os.full.text",
    "observer.os.kernel",
    "observer.os.name",
    "observer.os.name.text",
    "observer.os.platform",
    "observer.os.version",
    "observer.product",
    "observer.serial_number",
    "observer.type",
    "observer.vendor",
    "observer.version",
    "organization.id",
    "organization.name",
    "organization.name.text",
    "os.family",
    "os.full",
    "os.full.text",
    "os.kernel",
    "os.name",
    "os.name.text",
    "os.platform",
    "os.version",
    "package.architecture",
    "package.build_version",
    "package.checksum",
    "package.description",
    "package.install_scope",
    "package.installed",
    "package.license",
    "package.name",
    "package.path",
    "package.reference",
    "package.size",
    "package.type",
    "package.version",
    "params",
    "path",
    "pe.architecture",
    "pe.company",
    "pe.description",
    "pe.file_version",
    "pe.imphash",
    "pe.original_file_name",
    "pe.product",
    "pgsql.error_code",
    "pgsql.error_message",
    "pgsql.error_severity",
    "pgsql.num_fields",
    "pgsql.num_rows",
    "php_fpm.pool.connections.accepted",
    "php_fpm.pool.connections.listen_queue_len",
    "php_fpm.pool.connections.max_listen_queue",
    "php_fpm.pool.connections.queued",
    "php_fpm.pool.name",
    "php_fpm.pool.process_manager",
    "php_fpm.pool.processes.active",
    "php_fpm.pool.processes.idle",
    "php_fpm.pool.processes.max_active",
    "php_fpm.pool.processes.max_children_reached",
    "php_fpm.pool.processes.total",
    "php_fpm.pool.slow_requests",
    "php_fpm.pool.start_since",
    "php_fpm.pool.start_time",
    "php_fpm.process.last_request_cpu",
    "php_fpm.process.last_request_memory",
    "php_fpm.process.request_duration",
    "php_fpm.process.requests",
    "php_fpm.process.script",
    "php_fpm.process.start_since",
    "php_fpm.process.start_time",
    "php_fpm.process.state",
    "postgresql.activity.application_name",
    "postgresql.activity.backend_start",
    "postgresql.activity.client.address",
    "postgresql.activity.client.hostname",
    "postgresql.activity.client.port",
    "postgresql.activity.database.name",
    "postgresql.activity.database.oid",
    "postgresql.activity.pid",
    "postgresql.activity.query",
    "postgresql.activity.query_start",
    "postgresql.activity.state",
    "postgresql.activity.state_change",
    "postgresql.activity.transaction_start",
    "postgresql.activity.user.id",
    "postgresql.activity.user.name",
    "postgresql.activity.waiting",
    "postgresql.bgwriter.buffers.allocated",
    "postgresql.bgwriter.buffers.backend",
    "postgresql.bgwriter.buffers.backend_fsync",
    "postgresql.bgwriter.buffers.checkpoints",
    "postgresql.bgwriter.buffers.clean",
    "postgresql.bgwriter.buffers.clean_full",
    "postgresql.bgwriter.checkpoints.requested",
    "postgresql.bgwriter.checkpoints.scheduled",
    "postgresql.bgwriter.checkpoints.times.sync.ms",
    "postgresql.bgwriter.checkpoints.times.write.ms",
    "postgresql.bgwriter.stats_reset",
    "postgresql.database.blocks.hit",
    "postgresql.database.blocks.read",
    "postgresql.database.blocks.time.read.ms",
    "postgresql.database.blocks.time.write.ms",
    "postgresql.database.conflicts",
    "postgresql.database.deadlocks",
    "postgresql.database.name",
    "postgresql.database.number_of_backends",
    "postgresql.database.oid",
    "postgresql.database.rows.deleted",
    "postgresql.database.rows.fetched",
    "postgresql.database.rows.inserted",
    "postgresql.database.rows.returned",
    "postgresql.database.rows.updated",
    "postgresql.database.stats_reset",
    "postgresql.database.temporary.bytes",
    "postgresql.database.temporary.files",
    "postgresql.database.transactions.commit",
    "postgresql.database.transactions.rollback",
    "postgresql.statement.database.oid",
    "postgresql.statement.query.calls",
    "postgresql.statement.query.id",
    "postgresql.statement.query.memory.local.dirtied",
    "postgresql.statement.query.memory.local.hit",
    "postgresql.statement.query.memory.local.read",
    "postgresql.statement.query.memory.local.written",
    "postgresql.statement.query.memory.shared.dirtied",
    "postgresql.statement.query.memory.shared.hit",
    "postgresql.statement.query.memory.shared.read",
    "postgresql.statement.query.memory.shared.written",
    "postgresql.statement.query.memory.temp.read",
    "postgresql.statement.query.memory.temp.written",
    "postgresql.statement.query.rows",
    "postgresql.statement.query.text",
    "postgresql.statement.query.time.max.ms",
    "postgresql.statement.query.time.mean.ms",
    "postgresql.statement.query.time.min.ms",
    "postgresql.statement.query.time.stddev.ms",
    "postgresql.statement.query.time.total.ms",
    "postgresql.statement.user.id",
    "process.args",
    "process.args_count",
    "process.code_signature.exists",
    "process.code_signature.status",
    "process.code_signature.subject_name",
    "process.code_signature.trusted",
    "process.code_signature.valid",
    "process.command_line",
    "process.command_line.text",
    "process.cpu.pct",
    "process.cpu.start_time",
    "process.entity_id",
    "process.executable",
    "process.executable.text",
    "process.exit_code",
    "process.hash.md5",
    "process.hash.sha1",
    "process.hash.sha256",
    "process.hash.sha512",
    "process.memory.pct",
    "process.name",
    "process.name.text",
    "process.parent.args",
    "process.parent.args_count",
    "process.parent.code_signature.exists",
    "process.parent.code_signature.status",
    "process.parent.code_signature.subject_name",
    "process.parent.code_signature.trusted",
    "process.parent.code_signature.valid",
    "process.parent.command_line",
    "process.parent.command_line.text",
    "process.parent.entity_id",
    "process.parent.executable",
    "process.parent.executable.text",
    "process.parent.exit_code",
    "process.parent.hash.md5",
    "process.parent.hash.sha1",
    "process.parent.hash.sha256",
    "process.parent.hash.sha512",
    "process.parent.name",
    "process.parent.name.text",
    "process.parent.pe.architecture",
    "process.parent.pe.company",
    "process.parent.pe.description",
    "process.parent.pe.file_version",
    "process.parent.pe.imphash",
    "process.parent.pe.original_file_name",
    "process.parent.pe.product",
    "process.parent.pgid",
    "process.parent.pid",
    "process.parent.ppid",
    "process.parent.start",
    "process.parent.thread.id",
    "process.parent.thread.name",
    "process.parent.title",
    "process.parent.title.text",
    "process.parent.uptime",
    "process.parent.working_directory",
    "process.parent.working_directory.text",
    "process.pe.architecture",
    "process.pe.company",
    "process.pe.description",
    "process.pe.file_version",
    "process.pe.imphash",
    "process.pe.original_file_name",
    "process.pe.product",
    "process.pgid",
    "process.pid",
    "process.ppid",
    "process.start",
    "process.state",
    "process.thread.id",
    "process.thread.name",
    "process.title",
    "process.title.text",
    "process.uptime",
    "process.working_directory",
    "process.working_directory.text",
    "query",
    "rabbitmq.connection.channel_max",
    "rabbitmq.connection.channels",
    "rabbitmq.connection.client_provided.name",
    "rabbitmq.connection.frame_max",
    "rabbitmq.connection.host",
    "rabbitmq.connection.name",
    "rabbitmq.connection.octet_count.received",
    "rabbitmq.connection.octet_count.sent",
    "rabbitmq.connection.packet_count.pending",
    "rabbitmq.connection.packet_count.received",
    "rabbitmq.connection.packet_count.sent",
    "rabbitmq.connection.peer.host",
    "rabbitmq.connection.peer.port",
    "rabbitmq.connection.port",
    "rabbitmq.connection.type",
    "rabbitmq.exchange.auto_delete",
    "rabbitmq.exchange.durable",
    "rabbitmq.exchange.internal",
    "rabbitmq.exchange.messages.publish_in.count",
    "rabbitmq.exchange.messages.publish_in.details.rate",
    "rabbitmq.exchange.messages.publish_out.count",
    "rabbitmq.exchange.messages.publish_out.details.rate",
    "rabbitmq.exchange.name",
    "rabbitmq.node.disk.free.bytes",
    "rabbitmq.node.disk.free.limit.bytes",
    "rabbitmq.node.fd.total",
    "rabbitmq.node.fd.used",
    "rabbitmq.node.gc.num.count",
    "rabbitmq.node.gc.reclaimed.bytes",
    "rabbitmq.node.io.file_handle.open_attempt.avg.ms",
    "rabbitmq.node.io.file_handle.open_attempt.count",
    "rabbitmq.node.io.read.avg.ms",
    "rabbitmq.node.io.read.bytes",
    "rabbitmq.node.io.read.count",
    "rabbitmq.node.io.reopen.count",
    "rabbitmq.node.io.seek.avg.ms",
    "rabbitmq.node.io.seek.count",
    "rabbitmq.node.io.sync.avg.ms",
    "rabbitmq.node.io.sync.count",
    "rabbitmq.node.io.write.avg.ms",
    "rabbitmq.node.io.write.bytes",
    "rabbitmq.node.io.write.count",
    "rabbitmq.node.mem.limit.bytes",
    "rabbitmq.node.mem.used.bytes",
    "rabbitmq.node.mnesia.disk.tx.count",
    "rabbitmq.node.mnesia.ram.tx.count",
    "rabbitmq.node.msg.store_read.count",
    "rabbitmq.node.msg.store_write.count",
    "rabbitmq.node.name",
    "rabbitmq.node.proc.total",
    "rabbitmq.node.proc.used",
    "rabbitmq.node.processors",
    "rabbitmq.node.queue.index.journal_write.count",
    "rabbitmq.node.queue.index.read.count",
    "rabbitmq.node.queue.index.write.count",
    "rabbitmq.node.run.queue",
    "rabbitmq.node.socket.total",
    "rabbitmq.node.socket.used",
    "rabbitmq.node.type",
    "rabbitmq.node.uptime",
    "rabbitmq.queue.arguments.max_priority",
    "rabbitmq.queue.auto_delete",
    "rabbitmq.queue.consumers.count",
    "rabbitmq.queue.consumers.utilisation.pct",
    "rabbitmq.queue.disk.reads.count",
    "rabbitmq.queue.disk.writes.count",
    "rabbitmq.queue.durable",
    "rabbitmq.queue.exclusive",
    "rabbitmq.queue.memory.bytes",
    "rabbitmq.queue.messages.persistent.count",
    "rabbitmq.queue.messages.ready.count",
    "rabbitmq.queue.messages.ready.details.rate",
    "rabbitmq.queue.messages.total.count",
    "rabbitmq.queue.messages.total.details.rate",
    "rabbitmq.queue.messages.unacknowledged.count",
    "rabbitmq.queue.messages.unacknowledged.details.rate",
    "rabbitmq.queue.name",
    "rabbitmq.queue.state",
    "rabbitmq.vhost",
    "redis.error",
    "redis.info.clients.biggest_input_buf",
    "redis.info.clients.blocked",
    "redis.info.clients.connected",
    "redis.info.clients.longest_output_list",
    "redis.info.clients.max_input_buffer",
    "redis.info.clients.max_output_buffer",
    "redis.info.cluster.enabled",
    "redis.info.cpu.used.sys",
    "redis.info.cpu.used.sys_children",
    "redis.info.cpu.used.user",
    "redis.info.cpu.used.user_children",
    "redis.info.memory.active_defrag.is_running",
    "redis.info.memory.allocator",
    "redis.info.memory.allocator_stats.active",
    "redis.info.memory.allocator_stats.allocated",
    "redis.info.memory.allocator_stats.fragmentation.bytes",
    "redis.info.memory.allocator_stats.fragmentation.ratio",
    "redis.info.memory.allocator_stats.resident",
    "redis.info.memory.allocator_stats.rss.bytes",
    "redis.info.memory.allocator_stats.rss.ratio",
    "redis.info.memory.fragmentation.bytes",
    "redis.info.memory.fragmentation.ratio",
    "redis.info.memory.max.policy",
    "redis.info.memory.max.value",
    "redis.info.memory.used.dataset",
    "redis.info.memory.used.lua",
    "redis.info.memory.used.peak",
    "redis.info.memory.used.rss",
    "redis.info.memory.used.value",
    "redis.info.persistence.aof.bgrewrite.last_status",
    "redis.info.persistence.aof.buffer.size",
    "redis.info.persistence.aof.copy_on_write.last_size",
    "redis.info.persistence.aof.enabled",
    "redis.info.persistence.aof.fsync.delayed",
    "redis.info.persistence.aof.fsync.pending",
    "redis.info.persistence.aof.rewrite.buffer.size",
    "redis.info.persistence.aof.rewrite.current_time.sec",
    "redis.info.persistence.aof.rewrite.in_progress",
    "redis.info.persistence.aof.rewrite.last_time.sec",
    "redis.info.persistence.aof.rewrite.scheduled",
    "redis.info.persistence.aof.size.base",
    "redis.info.persistence.aof.size.current",
    "redis.info.persistence.aof.write.last_status",
    "redis.info.persistence.loading",
    "redis.info.persistence.rdb.bgsave.current_time.sec",
    "redis.info.persistence.rdb.bgsave.in_progress",
    "redis.info.persistence.rdb.bgsave.last_status",
    "redis.info.persistence.rdb.bgsave.last_time.sec",
    "redis.info.persistence.rdb.copy_on_write.last_size",
    "redis.info.persistence.rdb.last_save.changes_since",
    "redis.info.persistence.rdb.last_save.time",
    "redis.info.replication.backlog.active",
    "redis.info.replication.backlog.first_byte_offset",
    "redis.info.replication.backlog.histlen",
    "redis.info.replication.backlog.size",
    "redis.info.replication.connected_slaves",
    "redis.info.replication.master.last_io_seconds_ago",
    "redis.info.replication.master.link_status",
    "redis.info.replication.master.offset",
    "redis.info.replication.master.second_offset",
    "redis.info.replication.master.sync.in_progress",
    "redis.info.replication.master.sync.last_io_seconds_ago",
    "redis.info.replication.master.sync.left_bytes",
    "redis.info.replication.master_offset",
    "redis.info.replication.role",
    "redis.info.replication.slave.is_readonly",
    "redis.info.replication.slave.offset",
    "redis.info.replication.slave.priority",
    "redis.info.server.arch_bits",
    "redis.info.server.build_id",
    "redis.info.server.config_file",
    "redis.info.server.gcc_version",
    "redis.info.server.git_dirty",
    "redis.info.server.git_sha1",
    "redis.info.server.hz",
    "redis.info.server.lru_clock",
    "redis.info.server.mode",
    "redis.info.server.multiplexing_api",
    "redis.info.server.run_id",
    "redis.info.server.tcp_port",
    "redis.info.server.uptime",
    "redis.info.slowlog.count",
    "redis.info.stats.active_defrag.hits",
    "redis.info.stats.active_defrag.key_hits",
    "redis.info.stats.active_defrag.key_misses",
    "redis.info.stats.active_defrag.misses",
    "redis.info.stats.commands_processed",
    "redis.info.stats.connections.received",
    "redis.info.stats.connections.rejected",
    "redis.info.stats.instantaneous.input_kbps",
    "redis.info.stats.instantaneous.ops_per_sec",
    "redis.info.stats.instantaneous.output_kbps",
    "redis.info.stats.keys.evicted",
    "redis.info.stats.keys.expired",
    "redis.info.stats.keyspace.hits",
    "redis.info.stats.keyspace.misses",
    "redis.info.stats.latest_fork_usec",
    "redis.info.stats.migrate_cached_sockets",
    "redis.info.stats.net.input.bytes",
    "redis.info.stats.net.output.bytes",
    "redis.info.stats.pubsub.channels",
    "redis.info.stats.pubsub.patterns",
    "redis.info.stats.slave_expires_tracked_keys",
    "redis.info.stats.sync.full",
    "redis.info.stats.sync.partial.err",
    "redis.info.stats.sync.partial.ok",
    "redis.key.expire.ttl",
    "redis.key.id",
    "redis.key.length",
    "redis.key.name",
    "redis.key.type",
    "redis.keyspace.avg_ttl",
    "redis.keyspace.expires",
    "redis.keyspace.id",
    "redis.keyspace.keys",
    "redis.return_value",
    "registry.data.bytes",
    "registry.data.strings",
    "registry.data.type",
    "registry.hive",
    "registry.key",
    "registry.path",
    "registry.value",
    "related.hash",
    "related.hosts",
    "related.ip",
    "related.user",
    "request",
    "resource",
    "response",
    "rpc.auth_flavor",
    "rpc.cred.gid",
    "rpc.cred.gids",
    "rpc.cred.machinename",
    "rpc.cred.stamp",
    "rpc.cred.uid",
    "rpc.status",
    "rpc.xid",
    "rule.author",
    "rule.category",
    "rule.description",
    "rule.id",
    "rule.license",
    "rule.name",
    "rule.reference",
    "rule.ruleset",
    "rule.uuid",
    "rule.version",
    "server.address",
    "server.as.number",
    "server.as.organization.name",
    "server.as.organization.name.text",
    "server.bytes",
    "server.domain",
    "server.geo.city_name",
    "server.geo.continent_name",
    "server.geo.country_iso_code",
    "server.geo.country_name",
    "server.geo.location",
    "server.geo.name",
    "server.geo.region_iso_code",
    "server.geo.region_name",
    "server.ip",
    "server.mac",
    "server.nat.ip",
    "server.nat.port",
    "server.packets",
    "server.port",
    "server.process.args",
    "server.process.executable",
    "server.process.name",
    "server.process.start",
    "server.process.working_directory",
    "server.registered_domain",
    "server.subdomain",
    "server.top_level_domain",
    "server.user.domain",
    "server.user.email",
    "server.user.full_name",
    "server.user.full_name.text",
    "server.user.group.domain",
    "server.user.group.id",
    "server.user.group.name",
    "server.user.hash",
    "server.user.id",
    "server.user.name",
    "server.user.name.text",
    "server.user.roles",
    "service.address",
    "service.ephemeral_id",
    "service.hostname",
    "service.id",
    "service.name",
    "service.node.name",
    "service.state",
    "service.type",
    "service.version",
    "sip.accept",
    "sip.allow",
    "sip.auth.realm",
    "sip.auth.scheme",
    "sip.auth.uri.host",
    "sip.auth.uri.original",
    "sip.auth.uri.original.text",
    "sip.auth.uri.port",
    "sip.auth.uri.scheme",
    "sip.call_id",
    "sip.code",
    "sip.contact.display_info",
    "sip.contact.expires",
    "sip.contact.line",
    "sip.contact.q",
    "sip.contact.transport",
    "sip.contact.uri.host",
    "sip.contact.uri.original",
    "sip.contact.uri.original.text",
    "sip.contact.uri.port",
    "sip.contact.uri.scheme",
    "sip.contact.uri.username",
    "sip.content_length",
    "sip.content_type",
    "sip.cseq.code",
    "sip.cseq.method",
    "sip.from.display_info",
    "sip.from.tag",
    "sip.from.uri.host",
    "sip.from.uri.original",
    "sip.from.uri.original.text",
    "sip.from.uri.port",
    "sip.from.uri.scheme",
    "sip.from.uri.username",
    "sip.max_forwards",
    "sip.method",
    "sip.private.uri.host",
    "sip.private.uri.original",
    "sip.private.uri.original.text",
    "sip.private.uri.port",
    "sip.private.uri.scheme",
    "sip.private.uri.username",
    "sip.sdp.body.original",
    "sip.sdp.body.original.text",
    "sip.sdp.connection.address",
    "sip.sdp.connection.info",
    "sip.sdp.owner.ip",
    "sip.sdp.owner.session_id",
    "sip.sdp.owner.username",
    "sip.sdp.owner.version",
    "sip.sdp.session.name",
    "sip.sdp.version",
    "sip.status",
    "sip.supported",
    "sip.to.display_info",
    "sip.to.tag",
    "sip.to.uri.host",
    "sip.to.uri.original",
    "sip.to.uri.original.text",
    "sip.to.uri.port",
    "sip.to.uri.scheme",
    "sip.to.uri.username",
    "sip.type",
    "sip.uri.host",
    "sip.uri.original",
    "sip.uri.original.text",
    "sip.uri.port",
    "sip.uri.scheme",
    "sip.uri.username",
    "sip.user_agent.original",
    "sip.user_agent.original.text",
    "sip.version",
    "sip.via.original",
    "sip.via.original.text",
    "source.address",
    "source.as.number",
    "source.as.organization.name",
    "source.as.organization.name.text",
    "source.bytes",
    "source.domain",
    "source.geo.city_name",
    "source.geo.continent_name",
    "source.geo.country_iso_code",
    "source.geo.country_name",
    "source.geo.location",
    "source.geo.name",
    "source.geo.region_iso_code",
    "source.geo.region_name",
    "source.ip",
    "source.mac",
    "source.nat.ip",
    "source.nat.port",
    "source.packets",
    "source.port",
    "source.registered_domain",
    "source.subdomain",
    "source.top_level_domain",
    "source.user.domain",
    "source.user.email",
    "source.user.full_name",
    "source.user.full_name.text",
    "source.user.group.domain",
    "source.user.group.id",
    "source.user.group.name",
    "source.user.hash",
    "source.user.id",
    "source.user.name",
    "source.user.name.text",
    "source.user.roles",
    "span.id",
    "status",
    "system.core.id",
    "system.core.idle.pct",
    "system.core.idle.ticks",
    "system.core.iowait.pct",
    "system.core.iowait.ticks",
    "system.core.irq.pct",
    "system.core.irq.ticks",
    "system.core.nice.pct",
    "system.core.nice.ticks",
    "system.core.softirq.pct",
    "system.core.softirq.ticks",
    "system.core.steal.pct",
    "system.core.steal.ticks",
    "system.core.system.pct",
    "system.core.system.ticks",
    "system.core.user.pct",
    "system.core.user.ticks",
    "system.cpu.cores",
    "system.cpu.idle.norm.pct",
    "system.cpu.idle.pct",
    "system.cpu.idle.ticks",
    "system.cpu.iowait.norm.pct",
    "system.cpu.iowait.pct",
    "system.cpu.iowait.ticks",
    "system.cpu.irq.norm.pct",
    "system.cpu.irq.pct",
    "system.cpu.irq.ticks",
    "system.cpu.nice.norm.pct",
    "system.cpu.nice.pct",
    "system.cpu.nice.ticks",
    "system.cpu.softirq.norm.pct",
    "system.cpu.softirq.pct",
    "system.cpu.softirq.ticks",
    "system.cpu.steal.norm.pct",
    "system.cpu.steal.pct",
    "system.cpu.steal.ticks",
    "system.cpu.system.norm.pct",
    "system.cpu.system.pct",
    "system.cpu.system.ticks",
    "system.cpu.total.norm.pct",
    "system.cpu.total.pct",
    "system.cpu.user.norm.pct",
    "system.cpu.user.pct",
    "system.cpu.user.ticks",
    "system.diskio.io.ops",
    "system.diskio.io.time",
    "system.diskio.iostat.await",
    "system.diskio.iostat.busy",
    "system.diskio.iostat.queue.avg_size",
    "system.diskio.iostat.read.await",
    "system.diskio.iostat.read.per_sec.bytes",
    "system.diskio.iostat.read.request.merges_per_sec",
    "system.diskio.iostat.read.request.per_sec",
    "system.diskio.iostat.request.avg_size",
    "system.diskio.iostat.service_time",
    "system.diskio.iostat.write.await",
    "system.diskio.iostat.write.per_sec.bytes",
    "system.diskio.iostat.write.request.merges_per_sec",
    "system.diskio.iostat.write.request.per_sec",
    "system.diskio.name",
    "system.diskio.read.bytes",
    "system.diskio.read.count",
    "system.diskio.read.time",
    "system.diskio.serial_number",
    "system.diskio.write.bytes",
    "system.diskio.write.count",
    "system.diskio.write.time",
    "system.entropy.available_bits",
    "system.entropy.pct",
    "system.filesystem.available",
    "system.filesystem.device_name",
    "system.filesystem.files",
    "system.filesystem.free",
    "system.filesystem.free_files",
    "system.filesystem.mount_point",
    "system.filesystem.total",
    "system.filesystem.type",
    "system.filesystem.used.bytes",
    "system.filesystem.used.pct",
    "system.fsstat.count",
    "system.fsstat.total_files",
    "system.fsstat.total_size.free",
    "system.fsstat.total_size.total",
    "system.fsstat.total_size.used",
    "system.load.1",
    "system.load.15",
    "system.load.5",
    "system.load.cores",
    "system.load.norm.1",
    "system.load.norm.15",
    "system.load.norm.5",
    "system.memory.actual.free",
    "system.memory.actual.used.bytes",
    "system.memory.actual.used.pct",
    "system.memory.free",
    "system.memory.hugepages.default_size",
    "system.memory.hugepages.free",
    "system.memory.hugepages.reserved",
    "system.memory.hugepages.surplus",
    "system.memory.hugepages.swap.out.fallback",
    "system.memory.hugepages.swap.out.pages",
    "system.memory.hugepages.total",
    "system.memory.hugepages.used.bytes",
    "system.memory.hugepages.used.pct",
    "system.memory.page_stats.direct_efficiency.pct",
    "system.memory.page_stats.kswapd_efficiency.pct",
    "system.memory.page_stats.pgfree.pages",
    "system.memory.page_stats.pgscan_direct.pages",
    "system.memory.page_stats.pgscan_kswapd.pages",
    "system.memory.page_stats.pgsteal_direct.pages",
    "system.memory.page_stats.pgsteal_kswapd.pages",
    "system.memory.swap.free",
    "system.memory.swap.in.pages",
    "system.memory.swap.out.pages",
    "system.memory.swap.readahead.cached",
    "system.memory.swap.readahead.pages",
    "system.memory.swap.total",
    "system.memory.swap.used.bytes",
    "system.memory.swap.used.pct",
    "system.memory.total",
    "system.memory.used.bytes",
    "system.memory.used.pct",
    "system.network.in.bytes",
    "system.network.in.dropped",
    "system.network.in.errors",
    "system.network.in.packets",
    "system.network.name",
    "system.network.out.bytes",
    "system.network.out.dropped",
    "system.network.out.errors",
    "system.network.out.packets",
    "system.process.cgroup.blkio.id",
    "system.process.cgroup.blkio.path",
    "system.process.cgroup.blkio.total.bytes",
    "system.process.cgroup.blkio.total.ios",
    "system.process.cgroup.cpu.cfs.period.us",
    "system.process.cgroup.cpu.cfs.quota.us",
    "system.process.cgroup.cpu.cfs.shares",
    "system.process.cgroup.cpu.id",
    "system.process.cgroup.cpu.path",
    "system.process.cgroup.cpu.rt.period.us",
    "system.process.cgroup.cpu.rt.runtime.us",
    "system.process.cgroup.cpu.stats.periods",
    "system.process.cgroup.cpu.stats.throttled.ns",
    "system.process.cgroup.cpu.stats.throttled.periods",
    "system.process.cgroup.cpuacct.id",
    "system.process.cgroup.cpuacct.path",
    "system.process.cgroup.cpuacct.stats.system.ns",
    "system.process.cgroup.cpuacct.stats.user.ns",
    "system.process.cgroup.cpuacct.total.ns",
    "system.process.cgroup.id",
    "system.process.cgroup.memory.id",
    "system.process.cgroup.memory.kmem.failures",
    "system.process.cgroup.memory.kmem.limit.bytes",
    "system.process.cgroup.memory.kmem.usage.bytes",
    "system.process.cgroup.memory.kmem.usage.max.bytes",
    "system.process.cgroup.memory.kmem_tcp.failures",
    "system.process.cgroup.memory.kmem_tcp.limit.bytes",
    "system.process.cgroup.memory.kmem_tcp.usage.bytes",
    "system.process.cgroup.memory.kmem_tcp.usage.max.bytes",
    "system.process.cgroup.memory.mem.failures",
    "system.process.cgroup.memory.mem.limit.bytes",
    "system.process.cgroup.memory.mem.usage.bytes",
    "system.process.cgroup.memory.mem.usage.max.bytes",
    "system.process.cgroup.memory.memsw.failures",
    "system.process.cgroup.memory.memsw.limit.bytes",
    "system.process.cgroup.memory.memsw.usage.bytes",
    "system.process.cgroup.memory.memsw.usage.max.bytes",
    "system.process.cgroup.memory.path",
    "system.process.cgroup.memory.stats.active_anon.bytes",
    "system.process.cgroup.memory.stats.active_file.bytes",
    "system.process.cgroup.memory.stats.cache.bytes",
    "system.process.cgroup.memory.stats.hierarchical_memory_limit.bytes",
    "system.process.cgroup.memory.stats.hierarchical_memsw_limit.bytes",
    "system.process.cgroup.memory.stats.inactive_anon.bytes",
    "system.process.cgroup.memory.stats.inactive_file.bytes",
    "system.process.cgroup.memory.stats.major_page_faults",
    "system.process.cgroup.memory.stats.mapped_file.bytes",
    "system.process.cgroup.memory.stats.page_faults",
    "system.process.cgroup.memory.stats.pages_in",
    "system.process.cgroup.memory.stats.pages_out",
    "system.process.cgroup.memory.stats.rss.bytes",
    "system.process.cgroup.memory.stats.rss_huge.bytes",
    "system.process.cgroup.memory.stats.swap.bytes",
    "system.process.cgroup.memory.stats.unevictable.bytes",
    "system.process.cgroup.path",
    "system.process.cmdline",
    "system.process.cpu.start_time",
    "system.process.cpu.system.ticks",
    "system.process.cpu.total.norm.pct",
    "system.process.cpu.total.pct",
    "system.process.cpu.total.ticks",
    "system.process.cpu.total.value",
    "system.process.cpu.user.ticks",
    "system.process.fd.limit.hard",
    "system.process.fd.limit.soft",
    "system.process.fd.open",
    "system.process.memory.rss.bytes",
    "system.process.memory.rss.pct",
    "system.process.memory.share",
    "system.process.memory.size",
    "system.process.state",
    "system.process.summary.dead",
    "system.process.summary.idle",
    "system.process.summary.running",
    "system.process.summary.sleeping",
    "system.process.summary.stopped",
    "system.process.summary.total",
    "system.process.summary.unknown",
    "system.process.summary.zombie",
    "system.raid.blocks.synced",
    "system.raid.blocks.total",
    "system.raid.disks.active",
    "system.raid.disks.failed",
    "system.raid.disks.spare",
    "system.raid.disks.total",
    "system.raid.level",
    "system.raid.name",
    "system.raid.status",
    "system.raid.sync_action",
    "system.service.exec_code",
    "system.service.load_state",
    "system.service.name",
    "system.service.resources.cpu.usage.ns",
    "system.service.resources.memory.usage.bytes",
    "system.service.resources.network.in.bytes",
    "system.service.resources.network.in.packets",
    "system.service.resources.network.out.bytes",
    "system.service.resources.network.out.packets",
    "system.service.resources.tasks.count",
    "system.service.state",
    "system.service.state_since",
    "system.service.sub_state",
    "system.service.unit_file.state",
    "system.service.unit_file.vendor_preset",
    "system.socket.local.ip",
    "system.socket.local.port",
    "system.socket.process.cmdline",
    "system.socket.remote.etld_plus_one",
    "system.socket.remote.host",
    "system.socket.remote.host_error",
    "system.socket.remote.ip",
    "system.socket.remote.port",
    "system.socket.summary.all.count",
    "system.socket.summary.all.listening",
    "system.socket.summary.tcp.all.close_wait",
    "system.socket.summary.tcp.all.closing",
    "system.socket.summary.tcp.all.count",
    "system.socket.summary.tcp.all.established",
    "system.socket.summary.tcp.all.fin_wait1",
    "system.socket.summary.tcp.all.fin_wait2",
    "system.socket.summary.tcp.all.last_ack",
    "system.socket.summary.tcp.all.listening",
    "system.socket.summary.tcp.all.orphan",
    "system.socket.summary.tcp.all.syn_recv",
    "system.socket.summary.tcp.all.syn_sent",
    "system.socket.summary.tcp.all.time_wait",
    "system.socket.summary.tcp.memory",
    "system.socket.summary.udp.all.count",
    "system.socket.summary.udp.memory",
    "system.uptime.duration.ms",
    "system.users.id",
    "system.users.leader",
    "system.users.path",
    "system.users.remote",
    "system.users.remote_host",
    "system.users.scope",
    "system.users.seat",
    "system.users.service",
    "system.users.state",
    "system.users.type",
    "systemd.fragment_path",
    "systemd.unit",
    "tags",
    "threat.framework",
    "threat.tactic.id",
    "threat.tactic.name",
    "threat.tactic.reference",
    "threat.technique.id",
    "threat.technique.name",
    "threat.technique.name.text",
    "threat.technique.reference",
    "threat.technique.subtechnique.id",
    "threat.technique.subtechnique.name",
    "threat.technique.subtechnique.name.text",
    "threat.technique.subtechnique.reference",
    "thrift.exceptions",
    "thrift.params",
    "thrift.return_value",
    "thrift.service",
    "timeseries.instance",
    "tls.alert_types",
    "tls.cipher",
    "tls.client.certificate",
    "tls.client.certificate_chain",
    "tls.client.hash.md5",
    "tls.client.hash.sha1",
    "tls.client.hash.sha256",
    "tls.client.issuer",
    "tls.client.ja3",
    "tls.client.not_after",
    "tls.client.not_before",
    "tls.client.server_name",
    "tls.client.subject",
    "tls.client.supported_ciphers",
    "tls.client.x509.alternative_names",
    "tls.client.x509.issuer.common_name",
    "tls.client.x509.issuer.country",
    "tls.client.x509.issuer.distinguished_name",
    "tls.client.x509.issuer.locality",
    "tls.client.x509.issuer.organization",
    "tls.client.x509.issuer.organizational_unit",
    "tls.client.x509.issuer.province",
    "tls.client.x509.issuer.state_or_province",
    "tls.client.x509.not_after",
    "tls.client.x509.not_before",
    "tls.client.x509.public_key_algorithm",
    "tls.client.x509.public_key_curve",
    "tls.client.x509.public_key_exponent",
    "tls.client.x509.public_key_size",
    "tls.client.x509.serial_number",
    "tls.client.x509.signature_algorithm",
    "tls.client.x509.subject.common_name",
    "tls.client.x509.subject.country",
    "tls.client.x509.subject.distinguished_name",
    "tls.client.x509.subject.locality",
    "tls.client.x509.subject.organization",
    "tls.client.x509.subject.organizational_unit",
    "tls.client.x509.subject.province",
    "tls.client.x509.subject.state_or_province",
    "tls.client.x509.version",
    "tls.client.x509.version_number",
    "tls.client_certificate.alternative_names",
    "tls.client_certificate.issuer.common_name",
    "tls.client_certificate.issuer.country",
    "tls.client_certificate.issuer.locality",
    "tls.client_certificate.issuer.organization",
    "tls.client_certificate.issuer.organizational_unit",
    "tls.client_certificate.issuer.province",
    "tls.client_certificate.not_after",
    "tls.client_certificate.not_before",
    "tls.client_certificate.public_key_algorithm",
    "tls.client_certificate.public_key_size",
    "tls.client_certificate.serial_number",
    "tls.client_certificate.signature_algorithm",
    "tls.client_certificate.subject.common_name",
    "tls.client_certificate.subject.country",
    "tls.client_certificate.subject.locality",
    "tls.client_certificate.subject.organization",
    "tls.client_certificate.subject.organizational_unit",
    "tls.client_certificate.subject.province",
    "tls.client_certificate.version",
    "tls.client_certificate_requested",
    "tls.client_hello.extensions._unparsed_",
    "tls.client_hello.extensions.application_layer_protocol_negotiation",
    "tls.client_hello.extensions.ec_points_formats",
    "tls.client_hello.extensions.server_name_indication",
    "tls.client_hello.extensions.session_ticket",
    "tls.client_hello.extensions.signature_algorithms",
    "tls.client_hello.extensions.supported_groups",
    "tls.client_hello.extensions.supported_versions",
    "tls.client_hello.session_id",
    "tls.client_hello.supported_ciphers",
    "tls.client_hello.supported_compression_methods",
    "tls.client_hello.version",
    "tls.curve",
    "tls.detailed.alert_types",
    "tls.detailed.client_certificate.alternative_names",
    "tls.detailed.client_certificate.issuer.common_name",
    "tls.detailed.client_certificate.issuer.country",
    "tls.detailed.client_certificate.issuer.distinguished_name",
    "tls.detailed.client_certificate.issuer.locality",
    "tls.detailed.client_certificate.issuer.organization",
    "tls.detailed.client_certificate.issuer.organizational_unit",
    "tls.detailed.client_certificate.issuer.province",
    "tls.detailed.client_certificate.not_after",
    "tls.detailed.client_certificate.not_before",
    "tls.detailed.client_certificate.public_key_algorithm",
    "tls.detailed.client_certificate.public_key_size",
    "tls.detailed.client_certificate.serial_number",
    "tls.detailed.client_certificate.signature_algorithm",
    "tls.detailed.client_certificate.subject.common_name",
    "tls.detailed.client_certificate.subject.country",
    "tls.detailed.client_certificate.subject.distinguished_name",
    "tls.detailed.client_certificate.subject.locality",
    "tls.detailed.client_certificate.subject.organization",
    "tls.detailed.client_certificate.subject.organizational_unit",
    "tls.detailed.client_certificate.subject.province",
    "tls.detailed.client_certificate.version",
    "tls.detailed.client_certificate.version_number",
    "tls.detailed.client_certificate_requested",
    "tls.detailed.client_hello.extensions._unparsed_",
    "tls.detailed.client_hello.extensions.application_layer_protocol_negotiation",
    "tls.detailed.client_hello.extensions.ec_points_formats",
    "tls.detailed.client_hello.extensions.server_name_indication",
    "tls.detailed.client_hello.extensions.session_ticket",
    "tls.detailed.client_hello.extensions.signature_algorithms",
    "tls.detailed.client_hello.extensions.supported_groups",
    "tls.detailed.client_hello.extensions.supported_versions",
    "tls.detailed.client_hello.session_id",
    "tls.detailed.client_hello.supported_compression_methods",
    "tls.detailed.client_hello.version",
    "tls.detailed.resumption_method",
    "tls.detailed.server_certificate.alternative_names",
    "tls.detailed.server_certificate.issuer.common_name",
    "tls.detailed.server_certificate.issuer.country",
    "tls.detailed.server_certificate.issuer.distinguished_name",
    "tls.detailed.server_certificate.issuer.locality",
    "tls.detailed.server_certificate.issuer.organization",
    "tls.detailed.server_certificate.issuer.organizational_unit",
    "tls.detailed.server_certificate.issuer.province",
    "tls.detailed.server_certificate.issuer.state_or_province",
    "tls.detailed.server_certificate.not_after",
    "tls.detailed.server_certificate.not_before",
    "tls.detailed.server_certificate.public_key_algorithm",
    "tls.detailed.server_certificate.public_key_size",
    "tls.detailed.server_certificate.serial_number",
    "tls.detailed.server_certificate.signature_algorithm",
    "tls.detailed.server_certificate.subject.common_name",
    "tls.detailed.server_certificate.subject.country",
    "tls.detailed.server_certificate.subject.distinguished_name",
    "tls.detailed.server_certificate.subject.locality",
    "tls.detailed.server_certificate.subject.organization",
    "tls.detailed.server_certificate.subject.organizational_unit",
    "tls.detailed.server_certificate.subject.province",
    "tls.detailed.server_certificate.subject.state_or_province",
    "tls.detailed.server_certificate.version",
    "tls.detailed.server_certificate.version_number",
    "tls.detailed.server_certificate_chain.issuer.common_name",
    "tls.detailed.server_certificate_chain.issuer.country",
    "tls.detailed.server_certificate_chain.issuer.distinguished_name",
    "tls.detailed.server_certificate_chain.issuer.locality",
    "tls.detailed.server_certificate_chain.issuer.organization",
    "tls.detailed.server_certificate_chain.issuer.organizational_unit",
    "tls.detailed.server_certificate_chain.issuer.province",
    "tls.detailed.server_certificate_chain.issuer.state_or_province",
    "tls.detailed.server_certificate_chain.not_after",
    "tls.detailed.server_certificate_chain.not_before",
    "tls.detailed.server_certificate_chain.public_key_algorithm",
    "tls.detailed.server_certificate_chain.public_key_size",
    "tls.detailed.server_certificate_chain.serial_number",
    "tls.detailed.server_certificate_chain.signature_algorithm",
    "tls.detailed.server_certificate_chain.subject.common_name",
    "tls.detailed.server_certificate_chain.subject.country",
    "tls.detailed.server_certificate_chain.subject.distinguished_name",
    "tls.detailed.server_certificate_chain.subject.locality",
    "tls.detailed.server_certificate_chain.subject.organization",
    "tls.detailed.server_certificate_chain.subject.organizational_unit",
    "tls.detailed.server_certificate_chain.subject.province",
    "tls.detailed.server_certificate_chain.subject.state_or_province",
    "tls.detailed.server_certificate_chain.version",
    "tls.detailed.server_certificate_chain.version_number",
    "tls.detailed.server_hello.extensions._unparsed_",
    "tls.detailed.server_hello.extensions.application_layer_protocol_negotiation",
    "tls.detailed.server_hello.extensions.ec_points_formats",
    "tls.detailed.server_hello.extensions.session_ticket",
    "tls.detailed.server_hello.extensions.supported_versions",
    "tls.detailed.server_hello.selected_compression_method",
    "tls.detailed.server_hello.session_id",
    "tls.detailed.server_hello.version",
    "tls.detailed.version",
    "tls.established",
    "tls.fingerprints.ja3",
    "tls.handshake_completed",
    "tls.next_protocol",
    "tls.resumed",
    "tls.resumption_method",
    "tls.server.certificate",
    "tls.server.certificate_chain",
    "tls.server.hash.md5",
    "tls.server.hash.sha1",
    "tls.server.hash.sha256",
    "tls.server.issuer",
    "tls.server.ja3s",
    "tls.server.not_after",
    "tls.server.not_before",
    "tls.server.subject",
    "tls.server.x509.alternative_names",
    "tls.server.x509.issuer.common_name",
    "tls.server.x509.issuer.country",
    "tls.server.x509.issuer.distinguished_name",
    "tls.server.x509.issuer.locality",
    "tls.server.x509.issuer.organization",
    "tls.server.x509.issuer.organizational_unit",
    "tls.server.x509.issuer.province",
    "tls.server.x509.issuer.state_or_province",
    "tls.server.x509.not_after",
    "tls.server.x509.not_before",
    "tls.server.x509.public_key_algorithm",
    "tls.server.x509.public_key_curve",
    "tls.server.x509.public_key_exponent",
    "tls.server.x509.public_key_size",
    "tls.server.x509.serial_number",
    "tls.server.x509.signature_algorithm",
    "tls.server.x509.subject.common_name",
    "tls.server.x509.subject.country",
    "tls.server.x509.subject.distinguished_name",
    "tls.server.x509.subject.locality",
    "tls.server.x509.subject.organization",
    "tls.server.x509.subject.organizational_unit",
    "tls.server.x509.subject.province",
    "tls.server.x509.subject.state_or_province",
    "tls.server.x509.version",
    "tls.server.x509.version_number",
    "tls.server_certificate.alternative_names",
    "tls.server_certificate.issuer.common_name",
    "tls.server_certificate.issuer.country",
    "tls.server_certificate.issuer.locality",
    "tls.server_certificate.issuer.organization",
    "tls.server_certificate.issuer.organizational_unit",
    "tls.server_certificate.issuer.province",
    "tls.server_certificate.not_after",
    "tls.server_certificate.not_before",
    "tls.server_certificate.public_key_algorithm",
    "tls.server_certificate.public_key_size",
    "tls.server_certificate.serial_number",
    "tls.server_certificate.signature_algorithm",
    "tls.server_certificate.subject.common_name",
    "tls.server_certificate.subject.country",
    "tls.server_certificate.subject.locality",
    "tls.server_certificate.subject.organization",
    "tls.server_certificate.subject.organizational_unit",
    "tls.server_certificate.subject.province",
    "tls.server_certificate.version",
    "tls.server_hello.extensions._unparsed_",
    "tls.server_hello.extensions.application_layer_protocol_negotiation",
    "tls.server_hello.extensions.ec_points_formats",
    "tls.server_hello.extensions.session_ticket",
    "tls.server_hello.extensions.supported_versions",
    "tls.server_hello.selected_cipher",
    "tls.server_hello.selected_compression_method",
    "tls.server_hello.session_id",
    "tls.server_hello.version",
    "tls.version",
    "tls.version_protocol",
    "trace.id",
    "tracing.trace.id",
    "tracing.transaction.id",
    "traefik.health.response.avg_time.us",
    "traefik.health.response.count",
    "traefik.health.uptime.sec",
    "transaction.id",
    "type",
    "url.domain",
    "url.extension",
    "url.fragment",
    "url.full",
    "url.full.text",
    "url.original",
    "url.original.text",
    "url.password",
    "url.path",
    "url.port",
    "url.query",
    "url.registered_domain",
    "url.scheme",
    "url.subdomain",
    "url.top_level_domain",
    "url.username",
    "user.domain",
    "user.email",
    "user.full_name",
    "user.full_name.text",
    "user.group.domain",
    "user.group.id",
    "user.group.name",
    "user.hash",
    "user.id",
    "user.name",
    "user.name.text",
    "user.roles",
    "user_agent.device.name",
    "user_agent.name",
    "user_agent.original",
    "user_agent.original.text",
    "user_agent.os.family",
    "user_agent.os.full",
    "user_agent.os.full.text",
    "user_agent.os.kernel",
    "user_agent.os.name",
    "user_agent.os.name.text",
    "user_agent.os.platform",
    "user_agent.os.version",
    "user_agent.version",
    "uwsgi.status.core.id",
    "uwsgi.status.core.read_errors",
    "uwsgi.status.core.requests.offloaded",
    "uwsgi.status.core.requests.routed",
    "uwsgi.status.core.requests.static",
    "uwsgi.status.core.requests.total",
    "uwsgi.status.core.worker_pid",
    "uwsgi.status.core.write_errors",
    "uwsgi.status.total.exceptions",
    "uwsgi.status.total.pid",
    "uwsgi.status.total.read_errors",
    "uwsgi.status.total.requests",
    "uwsgi.status.total.write_errors",
    "uwsgi.status.worker.accepting",
    "uwsgi.status.worker.avg_rt",
    "uwsgi.status.worker.delta_requests",
    "uwsgi.status.worker.exceptions",
    "uwsgi.status.worker.harakiri_count",
    "uwsgi.status.worker.id",
    "uwsgi.status.worker.pid",
    "uwsgi.status.worker.requests",
    "uwsgi.status.worker.respawn_count",
    "uwsgi.status.worker.rss",
    "uwsgi.status.worker.running_time",
    "uwsgi.status.worker.signal_queue",
    "uwsgi.status.worker.signals",
    "uwsgi.status.worker.status",
    "uwsgi.status.worker.tx",
    "uwsgi.status.worker.vsz",
    "vlan.id",
    "vlan.name",
    "vsphere.datastore.capacity.free.bytes",
    "vsphere.datastore.capacity.total.bytes",
    "vsphere.datastore.capacity.used.bytes",
    "vsphere.datastore.capacity.used.pct",
    "vsphere.datastore.fstype",
    "vsphere.datastore.name",
    "vsphere.host.cpu.free.mhz",
    "vsphere.host.cpu.total.mhz",
    "vsphere.host.cpu.used.mhz",
    "vsphere.host.memory.free.bytes",
    "vsphere.host.memory.total.bytes",
    "vsphere.host.memory.used.bytes",
    "vsphere.host.name",
    "vsphere.host.network_names",
    "vsphere.virtualmachine.cpu.used.mhz",
    "vsphere.virtualmachine.host.hostname",
    "vsphere.virtualmachine.host.id",
    "vsphere.virtualmachine.memory.free.guest.bytes",
    "vsphere.virtualmachine.memory.total.guest.bytes",
    "vsphere.virtualmachine.memory.used.guest.bytes",
    "vsphere.virtualmachine.memory.used.host.bytes",
    "vsphere.virtualmachine.name",
    "vsphere.virtualmachine.network_names",
    "vsphere.virtualmachine.os",
    "vulnerability.category",
    "vulnerability.classification",
    "vulnerability.description",
    "vulnerability.description.text",
    "vulnerability.enumeration",
    "vulnerability.id",
    "vulnerability.reference",
    "vulnerability.report_id",
    "vulnerability.scanner.vendor",
    "vulnerability.score.base",
    "vulnerability.score.environmental",
    "vulnerability.score.temporal",
    "vulnerability.score.version",
    "vulnerability.severity",
    "windows.perfmon.instance",
    "windows.service.display_name",
    "windows.service.exit_code",
    "windows.service.id",
    "windows.service.name",
    "windows.service.path_name",
    "windows.service.pid",
    "windows.service.start_name",
    "windows.service.start_type",
    "windows.service.state",
    "windows.service.uptime.ms",
    "x509.alternative_names",
    "x509.issuer.common_name",
    "x509.issuer.country",
    "x509.issuer.distinguished_name",
    "x509.issuer.locality",
    "x509.issuer.organization",
    "x509.issuer.organizational_unit",
    "x509.issuer.state_or_province",
    "x509.not_after",
    "x509.not_before",
    "x509.public_key_algorithm",
    "x509.public_key_curve",
    "x509.public_key_exponent",
    "x509.public_key_size",
    "x509.serial_number",
    "x509.signature_algorithm",
    "x509.subject.common_name",
    "x509.subject.country",
    "x509.subject.distinguished_name",
    "x509.subject.locality",
    "x509.subject.organization",
    "x509.subject.organizational_unit",
    "x509.subject.state_or_province",
    "x509.version_number",
    "zookeeper.connection.interest_ops",
    "zookeeper.connection.queued",
    "zookeeper.connection.received",
    "zookeeper.connection.sent",
    "zookeeper.mntr.approximate_data_size",
    "zookeeper.mntr.ephemerals_count",
    "zookeeper.mntr.followers",
    "zookeeper.mntr.hostname",
    "zookeeper.mntr.latency.avg",
    "zookeeper.mntr.latency.max",
    "zookeeper.mntr.latency.min",
    "zookeeper.mntr.max_file_descriptor_count",
    "zookeeper.mntr.num_alive_connections",
    "zookeeper.mntr.open_file_descriptor_count",
    "zookeeper.mntr.outstanding_requests",
    "zookeeper.mntr.packets.received",
    "zookeeper.mntr.packets.sent",
    "zookeeper.mntr.pending_syncs",
    "zookeeper.mntr.server_state",
    "zookeeper.mntr.synced_followers",
    "zookeeper.mntr.version",
    "zookeeper.mntr.watch_count",
    "zookeeper.mntr.znode_count",
    "zookeeper.server.connections",
    "zookeeper.server.count",
    "zookeeper.server.epoch",
    "zookeeper.server.latency.avg",
    "zookeeper.server.latency.max",
    "zookeeper.server.latency.min",
    "zookeeper.server.mode",
    "zookeeper.server.node_count",
    "zookeeper.server.outstanding",
    "zookeeper.server.received",
    "zookeeper.server.sent",
    "zookeeper.server.version_date",
    "zookeeper.server.zxid"
  ],
  "runtime_mappings": {},
  "_source": {
    "excludes": [
      "aero*"
    ]
  },
  "query": {
    "bool": {
      "must": [],
      "filter": [
        {
          "match_all": {}
        },
        {
          "range": {
            "@timestamp": {
              "gte": "2021-02-23T12:56:01.284Z",
              "lte": "2021-02-23T13:11:01.284Z",
              "format": "strict_date_optional_time"
            }
          }
        }
      ],
      "should": [],
      "must_not": []
    }
  },
  "highlight": {
    "pre_tags": [
      "@kibana-highlighted-field@"
    ],
    "post_tags": [
      "@/kibana-highlighted-field@"
    ],
    "fields": {
      "*": {}
    },
    "fragment_size": 2147483647
  }
}

[timroes]

The problem here is that we're requesting stored_fields explicitly in 7.12 for those "non leaf" fields in the rollup index. Beforehand we've requested *. I'll sync with @lukeelmers later and talk about that.

[timroes]

I've discussed this with Luke offline. Given that we don't see much use-case in that specific combination of having stored_fields and rollup v1 at the same time, we discussed that our preferred way would be to simply not sending stored_fields with an explicit list when a rollup index pattern is used. Fields inside a rollup index pattern are anyway never stored fields and the chance we're mixing it with a live index pattern that uses stored fields that are not mapped (and thus not working in the fields API) is rather low.

I.e. we would like to make https://github.com/elastic/kibana/blob/master/src/plugins/data/common/search/search_source/search_source.ts#L619 conditional to only be called on non rollup index patterns.

Since we have no urgency for 7.12 to get this in, I want to ask @ppisljar if app services team could just take that into their planning for 7.13, since it's a rather minor adjustment to the search source?

[elasticmachine]

Pinging @elastic/kibana-app-services (Team:AppServices)

[ppisljar]

isn't this a regression introduced in 7.12 ? if so we should probably try to fix it ASAP (and our fix it week is next week).

[timroes]

Yes it's a regression introduced in 7.12, though it should be a really nieche that ever have a valid scenario for that and I think it only fails in Discover (as the only consumer of raw documents in search source + rollup index patterns atm?) and if we fix it as above, we don't restore previous behavior, but would disable stored_fields with rollup index patterns (which to Luke and my impression is fine, but we can sync about it again if you have doubts about that).

[lukasolson]

I'm not able to reproduce this. It looks to me like we're requesting "stored_fields": ["*"] even for rollup index patterns with discover:searchFieldsFromSource enabled, and the query succeeds.