base.yml

---
- name: base
  root: true
  title: Base
  group: 1
  short: All fields defined directly at the top level
  description: >
    The `base` field set contains all fields which are on the top level.
    These fields are common across all types of events.
  type: group
  fields:
    - name: "@timestamp"
      type: date
      level: core
      required: true
      example: "2016-05-23T08:05:34.853Z"
      short: Date/time when the event originated.
      description: >
        Date/time when the event originated.

        This is the date/time extracted from the event, typically representing
        when the event was generated by the source.

        If the event source has no original timestamp, this value is typically
        populated by the first time the event was received by the pipeline.

        Required field for all events.

    - name: tags
      level: core
      type: keyword
      example: "[\"production\", \"env2\"]"
      description: >
        List of keywords used to tag each event.

    - name: labels
      level: core
      type: object
      object_type: keyword
      example: {env: production, application: foo-bar}
      short: Custom key/value pairs.
      description: >
        Custom key/value pairs.

        Can be used to add meta information to events. Should not contain nested
        objects. All values are stored as keyword.

        Example: `docker` and `k8s` labels.

    - name: message
      level: core
      type: text
      example: "Hello World"
      short: Log message optimized for viewing in a log viewer.
      description: >
        For log events the message field contains the log message, optimized for
        viewing in a log viewer.

        For structured logs without an original message field, other fields can
        be concatenated to form a human-readable summary of the event.

        If multiple messages exist, they can be combined into one message.