Adapt to ECS

metricbeat/docs/fields.asciidoc

@@ -2782,7 +2782,9 @@ Event status
 *`docker.event.id`*::
 +
 --
-type: keyword
+type: alias
+
+alias to: event.id
 
 Event id when available
 
@@ -2802,7 +2804,9 @@ Event source
 *`docker.event.type`*::
 +
 --
-type: keyword
+type: alias
+
+alias to: event.kind
 
 The type of object emitting the event
 
@@ -2812,7 +2816,9 @@ The type of object emitting the event
 *`docker.event.action`*::
 +
 --
-type: keyword
+type: alias
+
+alias to: event.action
 
 The type of event
 
@@ -2822,7 +2828,9 @@ The type of event
 *`docker.event.time`*::
 +
 --
-type: date
+type: alias
+
+alias to: event.created
 
 Timestamp of event
 
@@ -2849,7 +2857,7 @@ The ID of the object emitting the event
 *`docker.event.actor.attributes`*::
 +
 --
-type: keyword
+type: object
 
 Various key/value attributes of the object, depending on its type
 

metricbeat/docs/modules/docker/event.asciidoc

@@ -5,8 +5,6 @@ This file is generated! See scripts/docs_collector.py
 [[metricbeat-metricset-docker-event]]
 === Docker event metricset
 
-experimental[]
-
 include::../../../module/docker/event/_meta/docs.asciidoc[]
 
 

metricbeat/docs/modules_list.asciidoc

@@ -25,7 +25,7 @@ This file is generated! See scripts/docs_collector.py
 .9+| .9+|  |<<metricbeat-metricset-docker-container,container>>   
 |<<metricbeat-metricset-docker-cpu,cpu>>   
 |<<metricbeat-metricset-docker-diskio,diskio>>   
-|<<metricbeat-metricset-docker-event,event>> experimental[]  
+|<<metricbeat-metricset-docker-event,event>>   
 |<<metricbeat-metricset-docker-healthcheck,healthcheck>>   
 |<<metricbeat-metricset-docker-image,image>>   
 |<<metricbeat-metricset-docker-info,info>>   

metricbeat/module/docker/event/_meta/data.json

@@ -6,7 +6,6 @@
     },
     "docker": {
         "event": {
-            "action": "exec_create: /bin/sh -c curl -f http://localhost",
             "actor": {
                 "attributes": {
                     "com_docker_compose_config-hash": "304a077f5d6b5673cdc2ef567dcb762ddac985514d3b73c1563c2f1ae2f4bbe9",
@@ -18,17 +17,18 @@
                     "image": "metricbeat_apache",
                     "name": "metricbeat_apache_1"
                 },
-                "id": "a591e701988ebca0a62b892f99b42fd492fc3fd4581cd630f18a53abd710dbd0"
+                "id": "b7bd093f744ec9e2da9aea475c19c3a7fd9a4bdb392d79c7f1745498a7cc5415"
             },
             "from": "metricbeat_apache",
-            "id": "a591e701988ebca0a62b892f99b42fd492fc3fd4581cd630f18a53abd710dbd0",
-            "status": "exec_create: /bin/sh -c curl -f http://localhost",
-            "time": "2019-01-02T23:29:38Z",
-            "type": "container"
+            "status": "exec_create: /bin/sh -c curl -f http://localhost"
         }
     },
     "event": {
+        "action": "exec_create: /bin/sh -c curl -f http://localhost",
+        "created": "2019-01-03T11:12:57Z",
         "dataset": "event",
+        "id": "b7bd093f744ec9e2da9aea475c19c3a7fd9a4bdb392d79c7f1745498a7cc5415",
+        "kind": "container",
         "module": "docker"
     },
     "service": {

metricbeat/module/docker/event/_meta/fields.yml

@@ -2,29 +2,38 @@
   type: group
   description: >
     Docker event
+  release: ga
   fields:
     - name: status
       type: keyword
       description: >
         Event status
     - name: id
-      type: keyword
+      type: alias
+      path: event.id
+      migration: true
       description: >
         Event id when available
     - name: from
       type: keyword
       description: >
         Event source
     - name: type
-      type: keyword
+      type: alias
+      path: event.kind
+      migration: true
       description: >
         The type of object emitting the event
     - name: action
-      type: keyword
+      type: alias
+      path: event.action
+      migration: true
       description: >
         The type of event
     - name: time
-      type: date
+      type: alias
+      path: event.created
+      migration: true
       description: >
         Timestamp of event
     - name: actor
@@ -37,6 +46,7 @@
           description: >
             The ID of the object emitting the event
         - name: attributes
-          type: keyword
+          type: object
+          object_type: keyword
           description: >
             Various key/value attributes of the object, depending on its type

metricbeat/module/docker/event/event.go

@@ -110,7 +110,7 @@ func (m *MetricSet) Run(reporter mb.PushReporterV2) {
 func (m *MetricSet) reportEvent(reporter mb.PushReporterV2, event events.Message) {
 	time := time.Unix(event.Time, 0)
 
-	attributes := common.MapStr{}
+	attributes := make(map[string]string, len(event.Actor.Attributes))
 	for k, v := range event.Actor.Attributes {
 		if m.dedot {
 			k = common.DeDot(k)
@@ -120,17 +120,21 @@ func (m *MetricSet) reportEvent(reporter mb.PushReporterV2, event events.Message
 
 	reporter.Event(mb.Event{
 		Timestamp: time,
+		RootFields: common.MapStr{
+			"event": common.MapStr{
+				"kind":    event.Type,
+				"action":  event.Action,
+				"created": time,
+				"id":      event.ID,
+			},
+		},
 		MetricSetFields: common.MapStr{
 			"status": event.Status,
-			"id":     event.ID,
 			"from":   event.From,
-			"type":   event.Type,
-			"action": event.Action,
 			"actor": common.MapStr{
 				"id":         event.Actor.ID,
 				"attributes": attributes,
 			},
-			"time": time,
 		},
 	})
 }