ecs_flat.yml

'@timestamp':
  dashed_name: timestamp
  description: 'Date/time when the event originated.

    This is the date/time extracted from the event, typically representing when the
    event was generated by the source.

    If the event source has no original timestamp, this value is typically populated
    by the first time the event was received by the pipeline.

    Required field for all events.'
  example: '2016-05-23T08:05:34.853Z'
  flat_name: '@timestamp'
  level: core
  name: '@timestamp'
  normalize: []
  required: true
  short: Date/time when the event originated.
  type: date
acme.account.id:
  dashed_name: acme-account-id
  description: Customer account for this activity.
  flat_name: acme.account.id
  ignore_above: 1024
  level: custom
  name: account.id
  normalize: []
  short: Customer account for this activity.
  type: keyword
agent.build.original:
  dashed_name: agent-build-original
  description: 'Extended build information for the agent.

    This field is intended to contain any build information that a data source may
    provide, no specific formatting is required.'
  example: metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c
    built 2020-02-05 23:10:10 +0000 UTC]
  flat_name: agent.build.original
  ignore_above: 1024
  level: core
  name: build.original
  normalize: []
  short: Extended build information for the agent.
  type: keyword
agent.ephemeral_id:
  dashed_name: agent-ephemeral-id
  description: 'Ephemeral identifier of this agent (if one exists).

    This id normally changes across restarts, but `agent.id` does not.'
  example: 8a4f500f
  flat_name: agent.ephemeral_id
  ignore_above: 1024
  level: extended
  name: ephemeral_id
  normalize: []
  short: Ephemeral identifier of this agent.
  type: keyword
agent.id:
  dashed_name: agent-id
  description: 'Unique identifier of this agent (if one exists).

    Example: For Beats this would be beat.id.'
  example: 8a4f500d
  flat_name: agent.id
  ignore_above: 1024
  level: core
  name: id
  normalize: []
  short: Unique identifier of this agent.
  type: keyword
agent.name:
  dashed_name: agent-name
  description: 'Custom name of the agent.

    This is a name that can be given to an agent. This can be helpful if for example
    two Filebeat instances are running on the same host but a human readable separation
    is needed on which Filebeat instance data is coming from.

    If no name is given, the name is often left empty.'
  example: foo
  flat_name: agent.name
  ignore_above: 1024
  level: core
  name: name
  normalize: []
  short: Custom name of the agent.
  type: keyword
agent.type:
  dashed_name: agent-type
  description: 'Type of the agent.

    The agent type always stays the same and should be given by the agent used. In
    case of Filebeat the agent would always be Filebeat also if two Filebeat instances
    are run on the same machine.'
  example: filebeat
  flat_name: agent.type
  ignore_above: 1024
  level: core
  name: type
  normalize: []
  short: Type of the agent.
  type: keyword
agent.version:
  dashed_name: agent-version
  description: Version of the agent.
  example: 6.0.0-rc2
  flat_name: agent.version
  ignore_above: 1024
  level: core
  name: version
  normalize: []
  short: Version of the agent.
  type: keyword
client.address:
  dashed_name: client-address
  description: 'Some event client addresses are defined ambiguously. The event will
    sometimes list an IP, a domain or a unix socket.  You should always store the
    raw address in the `.address` field.

    Then it should be duplicated to `.ip` or `.domain`, depending on which one it
    is.'
  flat_name: client.address
  ignore_above: 1024
  level: extended
  name: address
  normalize: []
  short: Client network address.
  type: keyword
client.as.number:
  dashed_name: client-as-number
  description: Unique number allocated to the autonomous system. The autonomous system
    number (ASN) uniquely identifies each network on the Internet.
  example: 15169
  flat_name: client.as.number
  level: extended
  name: number
  normalize: []
  original_fieldset: as
  short: Unique number allocated to the autonomous system.
  type: long
client.as.organization.name:
  dashed_name: client-as-organization-name
  description: Organization name.
  example: Google LLC
  flat_name: client.as.organization.name
  ignore_above: 1024
  level: extended
  multi_fields:
  - flat_name: client.as.organization.name.text
    name: text
    type: match_only_text
  name: organization.name
  normalize: []
  original_fieldset: as
  short: Organization name.
  type: keyword
client.bytes:
  dashed_name: client-bytes
  description: Bytes sent from the client to the server.
  example: 184
  flat_name: client.bytes
  format: bytes
  level: core
  name: bytes
  normalize: []
  short: Bytes sent from the client to the server.
  type: long
client.domain:
  dashed_name: client-domain
  description: 'The domain name of the client system.

    This value may be a host name, a fully qualified domain name, or another host
    naming format. The value may derive from the original event or be added from enrichment.'
  example: foo.example.com
  flat_name: client.domain
  ignore_above: 1024
  level: core
  name: domain
  normalize: []
  short: The domain name of the client.
  type: keyword
client.geo.city_name:
  dashed_name: client-geo-city-name
  description: City name.
  example: Montreal
  flat_name: client.geo.city_name
  ignore_above: 1024
  level: core
  name: city_name
  normalize: []
  original_fieldset: geo
  short: City name.
  type: keyword
client.geo.continent_code:
  dashed_name: client-geo-continent-code
  description: Two-letter code representing continent's name.
  example: NA
  flat_name: client.geo.continent_code
  ignore_above: 1024
  level: core
  name: continent_code
  normalize: []
  original_fieldset: geo
  short: Continent code.
  type: keyword
client.geo.continent_name:
  dashed_name: client-geo-continent-name
  description: Name of the continent.
  example: North America
  flat_name: client.geo.continent_name
  ignore_above: 1024
  level: core
  name: continent_name
  normalize: []
  original_fieldset: geo
  short: Name of the continent.
  type: keyword
client.geo.country_iso_code:
  dashed_name: client-geo-country-iso-code
  description: Country ISO code.
  example: CA
  flat_name: client.geo.country_iso_code
  ignore_above: 1024
  level: core
  name: country_iso_code
  normalize: []
  original_fieldset: geo
  short: Country ISO code.
  type: keyword
client.geo.country_name:
  dashed_name: client-geo-country-name
  description: Country name.
  example: Canada
  flat_name: client.geo.country_name
  ignore_above: 1024
  level: core
  name: country_name
  normalize: []
  original_fieldset: geo
  short: Country name.
  type: keyword
client.geo.location:
  dashed_name: client-geo-location
  description: Longitude and latitude.
  example: '{ "lon": -73.614830, "lat": 45.505918 }'
  flat_name: client.geo.location
  level: core
  name: location
  normalize: []
  original_fieldset: geo
  short: Longitude and latitude.
  type: geo_point
client.geo.name:
  dashed_name: client-geo-name
  description: 'User-defined description of a location, at the level of granularity
    they care about.

    Could be the name of their data centers, the floor number, if this describes a
    local physical entity, city names.

    Not typically used in automated geolocation.'
  example: boston-dc
  flat_name: client.geo.name
  ignore_above: 1024
  level: extended
  name: name
  normalize: []
  original_fieldset: geo
  short: User-defined description of a location.
  type: keyword
client.geo.postal_code:
  dashed_name: client-geo-postal-code
  description: 'Postal code associated with the location.

    Values appropriate for this field may also be known as a postcode or ZIP code
    and will vary widely from country to country.'
  example: 94040
  flat_name: client.geo.postal_code
  ignore_above: 1024
  level: core
  name: postal_code
  normalize: []
  original_fieldset: geo
  short: Postal code.
  type: keyword
client.geo.region_iso_code:
  dashed_name: client-geo-region-iso-code
  description: Region ISO code.
  example: CA-QC
  flat_name: client.geo.region_iso_code
  ignore_above: 1024
  level: core
  name: region_iso_code
  normalize: []
  original_fieldset: geo
  short: Region ISO code.
  type: keyword
client.geo.region_name:
  dashed_name: client-geo-region-name
  description: Region name.
  example: Quebec
  flat_name: client.geo.region_name
  ignore_above: 1024
  level: core
  name: region_name
  normalize: []
  original_fieldset: geo
  short: Region name.
  type: keyword
client.geo.timezone:
  dashed_name: client-geo-timezone
  description: The time zone of the location, such as IANA time zone name.
  example: America/Argentina/Buenos_Aires
  flat_name: client.geo.timezone
  ignore_above: 1024
  level: core
  name: timezone
  normalize: []
  original_fieldset: geo
  short: Time zone.
  type: keyword
client.ip:
  dashed_name: client-ip
  description: IP address of the client (IPv4 or IPv6).
  flat_name: client.ip
  level: core
  name: ip
  normalize: []
  short: IP address of the client.
  type: ip
client.mac:
  dashed_name: client-mac
  description: 'MAC address of the client.

    The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte)
    is represented by two [uppercase] hexadecimal digits giving the value of the octet
    as an unsigned integer. Successive octets are separated by a hyphen.'
  example: 00-00-5E-00-53-23
  flat_name: client.mac
  ignore_above: 1024
  level: core
  name: mac
  normalize: []
  short: MAC address of the client.
  type: keyword
client.nat.ip:
  dashed_name: client-nat-ip
  description: 'Translated IP of source based NAT sessions (e.g. internal client to
    internet).

    Typically connections traversing load balancers, firewalls, or routers.'
  flat_name: client.nat.ip
  level: extended
  name: nat.ip
  normalize: []
  short: Client NAT ip address
  type: ip
client.nat.port:
  dashed_name: client-nat-port
  description: 'Translated port of source based NAT sessions (e.g. internal client
    to internet).

    Typically connections traversing load balancers, firewalls, or routers.'
  flat_name: client.nat.port
  format: string
  level: extended
  name: nat.port
  normalize: []
  short: Client NAT port
  type: long
client.packets:
  dashed_name: client-packets
  description: Packets sent from the client to the server.
  example: 12
  flat_name: client.packets
  level: core
  name: packets
  normalize: []
  short: Packets sent from the client to the server.
  type: long
client.port:
  dashed_name: client-port
  description: Port of the client.
  flat_name: client.port
  format: string
  level: core
  name: port
  normalize: []
  short: Port of the client.
  type: long
client.registered_domain:
  dashed_name: client-registered-domain
  description: 'The highest registered client domain, stripped of the subdomain.

    For example, the registered domain for "foo.example.com" is "example.com".

    This value can be determined precisely with a list like the public suffix list
    (http://publicsuffix.org). Trying to approximate this by simply taking the last
    two labels will not work well for TLDs such as "co.uk".'
  example: example.com
  flat_name: client.registered_domain
  ignore_above: 1024
  level: extended
  name: registered_domain
  normalize: []
  short: The highest registered client domain, stripped of the subdomain.
  type: keyword
client.subdomain:
  dashed_name: client-subdomain
  description: 'The subdomain portion of a fully qualified domain name includes all
    of the names except the host name under the registered_domain.  In a partially
    qualified domain, or if the the qualification level of the full name cannot be
    determined, subdomain contains all of the names below the registered domain.

    For example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the
    domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the
    subdomain field should contain "sub2.sub1", with no trailing period.'
  example: east
  flat_name: client.subdomain
  ignore_above: 1024
  level: extended
  name: subdomain
  normalize: []
  short: The subdomain of the domain.
  type: keyword
client.top_level_domain:
  dashed_name: client-top-level-domain
  description: 'The effective top level domain (eTLD), also known as the domain suffix,
    is the last part of the domain name. For example, the top level domain for example.com
    is "com".

    This value can be determined precisely with a list like the public suffix list
    (http://publicsuffix.org). Trying to approximate this by simply taking the last
    label will not work well for effective TLDs such as "co.uk".'
  example: co.uk
  flat_name: client.top_level_domain
  ignore_above: 1024
  level: extended
  name: top_level_domain
  normalize: []
  short: The effective top level domain (com, org, net, co.uk).
  type: keyword
client.user.domain:
  dashed_name: client-user-domain
  description: 'Name of the directory the user is a member of.

    For example, an LDAP or Active Directory domain name.'
  flat_name: client.user.domain
  ignore_above: 1024
  level: extended
  name: domain
  normalize: []
  original_fieldset: user
  short: Name of the directory the user is a member of.
  type: keyword
client.user.email:
  dashed_name: client-user-email
  description: User email address.
  flat_name: client.user.email
  ignore_above: 1024
  level: extended
  name: email
  normalize: []
  original_fieldset: user
  short: User email address.
  type: keyword
client.user.full_name:
  dashed_name: client-user-full-name
  description: User's full name, if available.
  example: Albert Einstein
  flat_name: client.user.full_name
  ignore_above: 1024
  level: extended
  multi_fields:
  - flat_name: client.user.full_name.text
    name: text
    type: match_only_text
  name: full_name
  normalize: []
  original_fieldset: user
  short: User's full name, if available.
  type: keyword
client.user.group.domain:
  dashed_name: client-user-group-domain
  description: 'Name of the directory the group is a member of.

    For example, an LDAP or Active Directory domain name.'
  flat_name: client.user.group.domain
  ignore_above: 1024
  level: extended
  name: domain
  normalize: []
  original_fieldset: group
  short: Name of the directory the group is a member of.
  type: keyword
client.user.group.id:
  dashed_name: client-user-group-id
  description: Unique identifier for the group on the system/platform.
  flat_name: client.user.group.id
  ignore_above: 1024
  level: extended
  name: id
  normalize: []
  original_fieldset: group
  short: Unique identifier for the group on the system/platform.
  type: keyword
client.user.group.name:
  dashed_name: client-user-group-name
  description: Name of the group.
  flat_name: client.user.group.name
  ignore_above: 1024
  level: extended
  name: name
  normalize: []
  original_fieldset: group
  short: Name of the group.
  type: keyword
client.user.hash:
  dashed_name: client-user-hash
  description: 'Unique user hash to correlate information for a user in anonymized
    form.

    Useful if `user.id` or `user.name` contain confidential information and cannot
    be used.'
  flat_name: client.user.hash
  ignore_above: 1024
  level: extended
  name: hash
  normalize: []
  original_fieldset: user
  short: Unique user hash to correlate information for a user in anonymized form.
  type: keyword
client.user.id:
  dashed_name: client-user-id
  description: Unique identifier of the user.
  example: S-1-5-21-202424912787-2692429404-2351956786-1000
  flat_name: client.user.id
  ignore_above: 1024
  level: core
  name: id
  normalize: []
  original_fieldset: user
  short: Unique identifier of the user.
  type: keyword
client.user.name:
  dashed_name: client-user-name
  description: Short name or login of the user.
  example: a.einstein
  flat_name: client.user.name
  ignore_above: 1024
  level: core
  multi_fields:
  - flat_name: client.user.name.text
    name: text
    type: match_only_text
  name: name
  normalize: []
  original_fieldset: user
  short: Short name or login of the user.
  type: keyword
client.user.roles:
  dashed_name: client-user-roles
  description: Array of user roles at the time of the event.
  example: '["kibana_admin", "reporting_user"]'
  flat_name: client.user.roles
  ignore_above: 1024
  level: extended
  name: roles
  normalize:
  - array
  original_fieldset: user
  short: Array of user roles at the time of the event.
  type: keyword
destination.address:
  dashed_name: destination-address
  description: 'Some event destination addresses are defined ambiguously. The event
    will sometimes list an IP, a domain or a unix socket.  You should always store
    the raw address in the `.address` field.

    Then it should be duplicated to `.ip` or `.domain`, depending on which one it
    is.'
  flat_name: destination.address
  ignore_above: 1024
  level: extended
  name: address
  normalize: []
  short: Destination network address.
  type: keyword
destination.as.number:
  dashed_name: destination-as-number
  description: Unique number allocated to the autonomous system. The autonomous system
    number (ASN) uniquely identifies each network on the Internet.
  example: 15169
  flat_name: destination.as.number
  level: extended
  name: number
  normalize: []
  original_fieldset: as
  short: Unique number allocated to the autonomous system.
  type: long
destination.as.organization.name:
  dashed_name: destination-as-organization-name
  description: Organization name.
  example: Google LLC
  flat_name: destination.as.organization.name
  ignore_above: 1024
  level: extended
  multi_fields:
  - flat_name: destination.as.organization.name.text
    name: text
    type: match_only_text
  name: organization.name
  normalize: []
  original_fieldset: as
  short: Organization name.
  type: keyword
destination.bytes:
  dashed_name: destination-bytes
  description: Bytes sent from the destination to the source.
  example: 184
  flat_name: destination.bytes
  format: bytes
  level: core
  name: bytes
  normalize: []
  short: Bytes sent from the destination to the source.
  type: long
destination.domain:
  dashed_name: destination-domain
  description: 'The domain name of the destination system.

    This value may be a host name, a fully qualified domain name, or another host
    naming format. The value may derive from the original event or be added from enrichment.'
  example: foo.example.com
  flat_name: destination.domain
  ignore_above: 1024
  level: core
  name: domain
  normalize: []
  short: The domain name of the destination.
  type: keyword
destination.geo.city_name:
  dashed_name: destination-geo-city-name
  description: City name.
  example: Montreal
  flat_name: destination.geo.city_name
  ignore_above: 1024
  level: core
  name: city_name
  normalize: []
  original_fieldset: geo
  short: City name.
  type: keyword
destination.geo.continent_code:
  dashed_name: destination-geo-continent-code
  description: Two-letter code representing continent's name.
  example: NA
  flat_name: destination.geo.continent_code
  ignore_above: 1024
  level: core
  name: continent_code
  normalize: []
  original_fieldset: geo
  short: Continent code.
  type: keyword
destination.geo.continent_name:
  dashed_name: destination-geo-continent-name
  description: Name of the continent.
  example: North America
  flat_name: destination.geo.continent_name
  ignore_above: 1024
  level: core
  name: continent_name
  normalize: []
  original_fieldset: geo
  short: Name of the continent.
  type: keyword
destination.geo.country_iso_code:
  dashed_name: destination-geo-country-iso-code
  description: Country ISO code.
  example: CA
  flat_name: destination.geo.country_iso_code
  ignore_above: 1024
  level: core
  name: country_iso_code
  normalize: []
  original_fieldset: geo
  short: Country ISO code.
  type: keyword
destination.geo.country_name:
  dashed_name: destination-geo-country-name
  description: Country name.
  example: Canada
  flat_name: destination.geo.country_name
  ignore_above: 1024
  level: core
  name: country_name
  normalize: []
  original_fieldset: geo
  short: Country name.
  type: keyword
destination.geo.location:
  dashed_name: destination-geo-location
  description: Longitude and latitude.
  example: '{ "lon": -73.614830, "lat": 45.505918 }'
  flat_name: destination.geo.location
  level: core
  name: location
  normalize: []
  original_fieldset: geo
  short: Longitude and latitude.
  type: geo_point
destination.geo.name:
  dashed_name: destination-geo-name
  description: 'User-defined description of a location, at the level of granularity
    they care about.

    Could be the name of their data centers, the floor number, if this describes a
    local physical entity, city names.

    Not typically used in automated geolocation.'
  example: boston-dc
  flat_name: destination.geo.name
  ignore_above: 1024
  level: extended
  name: name
  normalize: []
  original_fieldset: geo
  short: User-defined description of a location.
  type: keyword
destination.geo.postal_code:
  dashed_name: destination-geo-postal-code
  description: 'Postal code associated with the location.

    Values appropriate for this field may also be known as a postcode or ZIP code
    and will vary widely from country to country.'
  example: 94040
  flat_name: destination.geo.postal_code
  ignore_above: 1024
  level: core
  name: postal_code
  normalize: []
  original_fieldset: geo
  short: Postal code.
  type: keyword
destination.geo.region_iso_code:
  dashed_name: destination-geo-region-iso-code
  description: Region ISO code.
  example: CA-QC
  flat_name: destination.geo.region_iso_code
  ignore_above: 1024
  level: core
  name: region_iso_code
  normalize: []
  original_fieldset: geo
  short: Region ISO code.
  type: keyword
destination.geo.region_name:
  dashed_name: destination-geo-region-name
  description: Region name.
  example: Quebec
  flat_name: destination.geo.region_name
  ignore_above: 1024
  level: core
  name: region_name
  normalize: []
  original_fieldset: geo
  short: Region name.
  type: keyword
destination.geo.timezone:
  dashed_name: destination-geo-timezone
  description: The time zone of the location, such as IANA time zone name.
  example: America/Argentina/Buenos_Aires
  flat_name: destination.geo.timezone
  ignore_above: 1024
  level: core
  name: timezone
  normalize: []
  original_fieldset: geo
  short: Time zone.
  type: keyword
destination.ip:
  dashed_name: destination-ip
  description: IP address of the destination (IPv4 or IPv6).
  flat_name: destination.ip
  level: core
  name: ip
  normalize: []
  short: IP address of the destination.
  type: ip
destination.mac:
  dashed_name: destination-mac
  description: 'MAC address of the destination.

    The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte)
    is represented by two [uppercase] hexadecimal digits giving the value of the octet
    as an unsigned integer. Successive octets are separated by a hyphen.'
  example: 00-00-5E-00-53-23
  flat_name: destination.mac
  ignore_above: 1024
  level: core
  name: mac
  normalize: []
  short: MAC address of the destination.
  type: keyword
destination.nat.ip:
  dashed_name: destination-nat-ip
  description: 'Translated ip of destination based NAT sessions (e.g. internet to
    private DMZ)

    Typically used with load balancers, firewalls, or routers.'
  flat_name: destination.nat.ip
  level: extended
  name: nat.ip
  normalize: []
  short: Destination NAT ip
  type: ip
destination.nat.port:
  dashed_name: destination-nat-port
  description: 'Port the source session is translated to by NAT Device.

    Typically used with load balancers, firewalls, or routers.'
  flat_name: destination.nat.port
  format: string
  level: extended
  name: nat.port
  normalize: []
  short: Destination NAT Port
  type: long
destination.packets:
  dashed_name: destination-packets
  description: Packets sent from the destination to the source.
  example: 12
  flat_name: destination.packets
  level: core
  name: packets
  normalize: []
  short: Packets sent from the destination to the source.
  type: long
destination.port:
  dashed_name: destination-port
  description: Port of the destination.
  flat_name: destination.port
  format: string
  level: core
  name: port
  normalize: []
  short: Port of the destination.
  type: long
destination.registered_domain:
  dashed_name: destination-registered-domain
  description: 'The highest registered destination domain, stripped of the subdomain.

    For example, the registered domain for "foo.example.com" is "example.com".

    This value can be determined precisely with a list like the public suffix list
    (http://publicsuffix.org). Trying to approximate this by simply taking the last
    two labels will not work well for TLDs such as "co.uk".'
  example: example.com
  flat_name: destination.registered_domain
  ignore_above: 1024
  level: extended
  name: registered_domain
  normalize: []
  short: The highest registered destination domain, stripped of the subdomain.
  type: keyword
destination.subdomain:
  dashed_name: destination-subdomain
  description: 'The subdomain portion of a fully qualified domain name includes all
    of the names except the host name under the registered_domain.  In a partially
    qualified domain, or if the the qualification level of the full name cannot be
    determined, subdomain contains all of the names below the registered domain.

    For example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the
    domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the
    subdomain field should contain "sub2.sub1", with no trailing period.'
  example: east
  flat_name: destination.subdomain
  ignore_above: 1024
  level: extended
  name: subdomain
  normalize: []
  short: The subdomain of the domain.
  type: keyword
destination.top_level_domain:
  dashed_name: destination-top-level-domain
  description: 'The effective top level domain (eTLD), also known as the domain suffix,
    is the last part of the domain name. For example, the top level domain for example.com
    is "com".

    This value can be determined precisely with a list like the public suffix list
    (http://publicsuffix.org). Trying to approximate this by simply taking the last
    label will not work well for effective TLDs such as "co.uk".'
  example: co.uk
  flat_name: destination.top_level_domain
  ignore_above: 1024
  level: extended
  name: top_level_domain
  normalize: []
  short: The effective top level domain (com, org, net, co.uk).
  type: keyword
destination.user.domain:
  dashed_name: destination-user-domain
  description: 'Name of the directory the user is a member of.

    For example, an LDAP or Active Directory domain name.'
  flat_name: destination.user.domain
  ignore_above: 1024
  level: extended
  name: domain
  normalize: []
  original_fieldset: user
  short: Name of the directory the user is a member of.
  type: keyword
destination.user.email:
  dashed_name: destination-user-email
  description: User email address.
  flat_name: destination.user.email
  ignore_above: 1024
  level: extended
  name: email
  normalize: []
  original_fieldset: user
  short: User email address.
  type: keyword
destination.user.full_name:
  dashed_name: destination-user-full-name
  description: User's full name, if available.
  example: Albert Einstein
  flat_name: destination.user.full_name
  ignore_above: 1024
  level: extended
  multi_fields:
  - flat_name: destination.user.full_name.text
    name: text
    type: match_only_text
  name: full_name
  normalize: []
  original_fieldset: user
  short: User's full name, if available.
  type: keyword
destination.user.group.domain:
  dashed_name: destination-user-group-domain
  description: 'Name of the directory the group is a member of.

    For example, an LDAP or Active Directory domain name.'
  flat_name: destination.user.group.domain
  ignore_above: 1024
  level: extended
  name: domain
  normalize: []
  original_fieldset: group
  short: Name of the directory the group is a member of.
  type: keyword
destination.user.group.id:
  dashed_name: destination-user-group-id
  description: Unique identifier for the group on the system/platform.
  flat_name: destination.user.group.id
  ignore_above: 1024
  level: extended
  name: id
  normalize: []
  original_fieldset: group
  short: Unique identifier for the group on the system/platform.
  type: keyword
destination.user.group.name:
  dashed_name: destination-user-group-name
  description: Name of the group.
  flat_name: destination.user.group.name
  ignore_above: 1024
  level: extended
  name: name
  normalize: []
  original_fieldset: group
  short: Name of the group.
  type: keyword
destination.user.hash:
  dashed_name: destination-user-hash
  description: 'Unique user hash to correlate information for a user in anonymized
    form.

    Useful if `user.id` or `user.name` contain confidential information and cannot
    be used.'
  flat_name: destination.user.hash
  ignore_above: 1024
  level: extended
  name: hash
  normalize: []
  original_fieldset: user
  short: Unique user hash to correlate information for a user in anonymized form.
  type: keyword
destination.user.id:
  dashed_name: destination-user-id
  description: Unique identifier of the user.
  example: S-1-5-21-202424912787-2692429404-2351956786-1000
  flat_name: destination.user.id
  ignore_above: 1024
  level: core
  name: id
  normalize: []
  original_fieldset: user
  short: Unique identifier of the user.
  type: keyword
destination.user.name:
  dashed_name: destination-user-name
  description: Short name or login of the user.
  example: a.einstein
  flat_name: destination.user.name
  ignore_above: 1024
  level: core
  multi_fields:
  - flat_name: destination.user.name.text
    name: text
    type: match_only_text
  name: name
  normalize: []
  original_fieldset: user
  short: Short name or login of the user.
  type: keyword
destination.user.roles:
  dashed_name: destination-user-roles
  description: Array of user roles at the time of the event.
  example: '["kibana_admin", "reporting_user"]'
  flat_name: destination.user.roles
  ignore_above: 1024
  level: extended
  name: roles
  normalize:
  - array
  original_fieldset: user
  short: Array of user roles at the time of the event.
  type: keyword
ecs.version:
  dashed_name: ecs-version
  description: 'ECS version this event conforms to. `ecs.version` is a required field
    and must exist in all events.

    When querying across multiple indices -- which may conform to slightly different
    ECS versions -- this field lets integrations adjust to the schema version of the
    events.'
  example: 1.0.0
  flat_name: ecs.version
  ignore_above: 1024
  level: core
  name: version
  normalize: []
  required: true
  short: ECS version this event conforms to.
  type: keyword
event.action:
  dashed_name: event-action
  description: 'The action captured by the event.

    This describes the information in the event. It is more specific than `event.category`.
    Examples are `group-add`, `process-started`, `file-created`. The value is normally
    defined by the implementer.'
  example: user-password-change
  flat_name: event.action
  ignore_above: 1024
  level: core
  name: action
  normalize: []
  short: The action captured by the event.
  type: keyword
event.agent_id_status:
  dashed_name: event-agent-id-status
  description: 'Agents are normally responsible for populating the `agent.id` field
    value. If the system receiving events is capable of validating the value based
    on authentication information for the client then this field can be used to reflect
    the outcome of that validation.

    For example if the agent''s connection is authenticated with mTLS and the client
    cert contains the ID of the agent to which the cert was issued then the `agent.id`
    value in events can be checked against the certificate. If the values match then
    `event.agent_id_status: verified` is added to the event, otherwise one of the
    other allowed values should be used.

    If no validation is performed then the field should be omitted.

    The allowed values are:

    `verified` - The `agent.id` field value matches expected value obtained from auth
    metadata.

    `mismatch` - The `agent.id` field value does not match the expected value obtained
    from auth metadata.

    `missing` - There was no `agent.id` field in the event to validate.

    `auth_metadata_missing` - There was no auth metadata or it was missing information
    about the agent ID.'
  example: verified
  flat_name: event.agent_id_status
  ignore_above: 1024
  level: extended
  name: agent_id_status
  normalize: []
  short: Validation status of the event's agent.id field.
  type: keyword
event.category:
  allowed_values:
  - description: Events in this category are related to the challenge and response
      process in which credentials are supplied and verified to allow the creation
      of a session. Common sources for these logs are Windows event logs and ssh logs.
      Visualize and analyze events in this category to look for failed logins, and
      other authentication-related activity.
    expected_event_types:
    - start
    - end
    - info
    name: authentication
  - description: 'Events in the configuration category have to deal with creating,
      modifying, or deleting the settings or parameters of an application, process,
      or system.

      Example sources include security policy change logs, configuration auditing
      logging, and system integrity monitoring.'
    expected_event_types:
    - access
    - change
    - creation
    - deletion
    - info
    name: configuration
  - description: The database category denotes events and metrics relating to a data
      storage and retrieval system. Note that use of this category is not limited
      to relational database systems. Examples include event logs from MS SQL, MySQL,
      Elasticsearch, MongoDB, etc. Use this category to visualize and analyze database
      activity such as accesses and changes.
    expected_event_types:
    - access
    - change
    - info
    - error
    name: database
  - description: 'Events in the driver category have to do with operating system device
      drivers and similar software entities such as Windows drivers, kernel extensions,
      kernel modules, etc.

      Use events and metrics in this category to visualize and analyze driver-related
      activity and status on hosts.'
    expected_event_types:
    - change
    - end
    - info
    - start
    name: driver
  - description: Relating to a set of information that has been created on, or has
      existed on a filesystem. Use this category of events to visualize and analyze
      the creation, access, and deletions of files. Events in this category can come
      from both host-based and network-based sources. An example source of a network-based
      detection of a file transfer would be the Zeek file.log.
    expected_event_types:
    - change
    - creation
    - deletion
    - info
    name: file
  - description: 'Use this category to visualize and analyze information such as host
      inventory or host lifecycle events.

      Most of the events in this category can usually be observed from the outside,
      such as from a hypervisor or a control plane''s point of view. Some can also
      be seen from within, such as "start" or "end".

      Note that this category is for information about hosts themselves; it is not
      meant to capture activity "happening on a host".'
    expected_event_types:
    - access
    - change
    - end
    - info
    - start
    name: host
  - description: Identity and access management (IAM) events relating to users, groups,
      and administration. Use this category to visualize and analyze IAM-related logs
      and data from active directory, LDAP, Okta, Duo, and other IAM systems.
    expected_event_types:
    - admin
    - change
    - creation
    - deletion
    - group
    - info
    - user
    name: iam
  - description: Relating to intrusion detections from IDS/IPS systems and functions,
      both network and host-based. Use this category to visualize and analyze intrusion
      detection alerts from systems such as Snort, Suricata, and Palo Alto threat
      detections.
    expected_event_types:
    - allowed
    - denied
    - info
    name: intrusion_detection
  - description: Malware detection events and alerts. Use this category to visualize
      and analyze malware detections from EDR/EPP systems such as Elastic Endpoint
      Security, Symantec Endpoint Protection, Crowdstrike, and network IDS/IPS systems
      such as Suricata, or other sources of malware-related events such as Palo Alto
      Networks threat logs and Wildfire logs.
    expected_event_types:
    - info
    name: malware
  - description: Relating to all network activity, including network connection lifecycle,
      network traffic, and essentially any event that includes an IP address. Many
      events containing decoded network protocol transactions fit into this category.
      Use events in this category to visualize or analyze counts of network ports,
      protocols, addresses, geolocation information, etc.
    expected_event_types:
    - access
    - allowed
    - connection
    - denied
    - end
    - info
    - protocol
    - start
    name: network
  - description: Relating to software packages installed on hosts. Use this category
      to visualize and analyze inventory of software installed on various hosts, or
      to determine host vulnerability in the absence of vulnerability scan data.
    expected_event_types:
    - access
    - change
    - deletion
    - info
    - installation
    - start
    name: package
  - description: Use this category of events to visualize and analyze process-specific
      information such as lifecycle events or process ancestry.
    expected_event_types:
    - access
    - change
    - end
    - info
    - start
    name: process
  - description: Having to do with settings and assets stored in the Windows registry.
      Use this category to visualize and analyze activity such as registry access
      and modifications.
    expected_event_types:
    - access
    - change
    - creation
    - deletion
    name: registry
  - description: The session category is applied to events and metrics regarding logical
      persistent connections to hosts and services. Use this category to visualize
      and analyze interactive or automated persistent connections between assets.
      Data for this category may come from Windows Event logs, SSH logs, or stateless
      sessions such as HTTP cookie-based sessions, etc.
    expected_event_types:
    - start
    - end
    - info
    name: session
  - description: Use this category to visualize and analyze events describing threat
      actors' targets, motives, or behaviors.
    expected_event_types:
    - indicator
    name: threat
  - description: 'Relating to web server access. Use this category to create a dashboard
      of web server/proxy activity from apache, IIS, nginx web servers, etc. Note:
      events from network observers such as Zeek http log may also be included in
      this category.'
    expected_event_types:
    - access
    - error
    - info
    name: web
  dashed_name: event-category
  description: 'This is one of four ECS Categorization Fields, and indicates the second
    level in the ECS category hierarchy.

    `event.category` represents the "big buckets" of ECS categories. For example,
    filtering on `event.category:process` yields all events relating to process activity.
    This field is closely related to `event.type`, which is used as a subcategory.

    This field is an array. This will allow proper categorization of some events that
    fall in multiple categories.'
  example: authentication
  flat_name: event.category
  ignore_above: 1024
  level: core
  name: category
  normalize:
  - array
  short: Event category. The second categorization field in the hierarchy.
  type: keyword
event.code:
  dashed_name: event-code
  description: 'Identification code for this event, if one exists.

    Some event sources use event codes to identify messages unambiguously, regardless
    of message language or wording adjustments over time. An example of this is the
    Windows Event ID.'
  example: 4648
  flat_name: event.code
  ignore_above: 1024
  level: extended
  name: code
  normalize: []
  short: Identification code for this event.
  type: keyword
event.created:
  dashed_name: event-created
  description: 'event.created contains the date/time when the event was first read
    by an agent, or by your pipeline.

    This field is distinct from @timestamp in that @timestamp typically contain the
    time extracted from the original event.

    In most situations, these two timestamps will be slightly different. The difference
    can be used to calculate the delay between your source generating an event, and
    the time when your agent first processed it. This can be used to monitor your
    agent''s or pipeline''s ability to keep up with your event source.

    In case the two timestamps are identical, @timestamp should be used.'
  example: '2016-05-23T08:05:34.857Z'
  flat_name: event.created
  level: core
  name: created
  normalize: []
  short: Time when the event was first read by an agent or by your pipeline.
  type: date
event.dataset:
  dashed_name: event-dataset
  description: 'Name of the dataset.

    If an event source publishes more than one type of log or events (e.g. access
    log, error log), the dataset is used to specify which one the event comes from.

    It''s recommended but not required to start the dataset name with the module name,
    followed by a dot, then the dataset name.'
  example: apache.access
  flat_name: event.dataset
  ignore_above: 1024
  level: core
  name: dataset
  normalize: []
  short: Name of the dataset.
  type: keyword
event.duration:
  dashed_name: event-duration
  description: 'Duration of the event in nanoseconds.

    If event.start and event.end are known this value should be the difference between
    the end and start time.'
  flat_name: event.duration
  format: duration
  input_format: nanoseconds
  level: core
  name: duration
  normalize: []
  output_format: asMilliseconds
  output_precision: 1
  short: Duration of the event in nanoseconds.
  type: long
event.end:
  dashed_name: event-end
  description: event.end contains the date when the event ended or when the activity
    was last observed.
  flat_name: event.end
  level: extended
  name: end
  normalize: []
  short: event.end contains the date when the event ended or when the activity was
    last observed.
  type: date
event.hash:
  dashed_name: event-hash
  description: Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate
    log integrity.
  example: 123456789012345678901234567890ABCD
  flat_name: event.hash
  ignore_above: 1024
  level: extended
  name: hash
  normalize: []
  short: Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate
    log integrity.
  type: keyword
event.id:
  dashed_name: event-id
  description: Unique ID to describe the event.
  example: 8a4f500d
  flat_name: event.id
  ignore_above: 1024
  level: core
  name: id
  normalize: []
  short: Unique ID to describe the event.
  type: keyword
event.ingested:
  dashed_name: event-ingested
  description: 'Timestamp when an event arrived in the central data store.

    This is different from `@timestamp`, which is when the event originally occurred.  It''s
    also different from `event.created`, which is meant to capture the first time
    an agent saw the event.

    In normal conditions, assuming no tampering, the timestamps should chronologically
    look like this: `@timestamp` < `event.created` < `event.ingested`.'
  example: '2016-05-23T08:05:35.101Z'
  flat_name: event.ingested
  level: core
  name: ingested
  normalize: []
  short: Timestamp when an event arrived in the central data store.
  type: date
event.kind:
  allowed_values:
  - description: 'This value indicates an event such as an alert or notable event,
      triggered by a detection rule executing externally to the Elastic Stack.

      `event.kind:alert` is often populated for events coming from firewalls, intrusion
      detection systems, endpoint detection and response systems, and so on.

      This value is not used by Elastic solutions for alert documents that are created
      by rules executing within the Kibana alerting framework.'
    name: alert
  - description: 'The `enrichment` value indicates an event collected to provide additional
      context, often to other events.

      An example is collecting indicators of compromise (IOCs) from a threat intelligence
      provider with the intent to use those values to enrich other events. The IOC
      events from the intelligence provider should be categorized as `event.kind:enrichment`.'
    name: enrichment
  - description: This value is the most general and most common value for this field.
      It is used to represent events that indicate that something happened.
    name: event
  - description: 'This value is used to indicate that this event describes a numeric
      measurement taken at given point in time.

      Examples include CPU utilization, memory usage, or device temperature.

      Metric events are often collected on a predictable frequency, such as once every
      few seconds, or once a minute, but can also be used to describe ad-hoc numeric
      metric queries.'
    name: metric
  - description: 'The state value is similar to metric, indicating that this event
      describes a measurement taken at given point in time, except that the measurement
      does not result in a numeric value, but rather one of a fixed set of categorical
      values that represent conditions or states.

      Examples include periodic events reporting Elasticsearch cluster state (green/yellow/red),
      the state of a TCP connection (open, closed, fin_wait, etc.), the state of a
      host with respect to a software vulnerability (vulnerable, not vulnerable),
      and the state of a system regarding compliance with a regulatory standard (compliant,
      not compliant).

      Note that an event that describes a change of state would not use `event.kind:state`,
      but instead would use ''event.kind:event'' since a state change fits the more
      general event definition of something that happened.

      State events are often collected on a predictable frequency, such as once every
      few seconds, once a minute, once an hour, or once a day, but can also be used
      to describe ad-hoc state queries.'
    name: state
  - description: This value indicates that an error occurred during the ingestion
      of this event, and that event data may be missing, inconsistent, or incorrect.
      `event.kind:pipeline_error` is often associated with parsing errors.
    name: pipeline_error
  - description: 'This value is used by Elastic solutions (e.g., Security, Observability)
      for alert documents that are created by rules executing within the Kibana alerting
      framework.

      Usage of this value is reserved, and data ingestion pipelines must not populate
      `event.kind` with the value "signal".'
    name: signal
  dashed_name: event-kind
  description: 'This is one of four ECS Categorization Fields, and indicates the highest
    level in the ECS category hierarchy.

    `event.kind` gives high-level information about what type of information the event
    contains, without being specific to the contents of the event. For example, values
    of this field distinguish alert events from metric events.

    The value of this field can be used to inform how these kinds of events should
    be handled. They may warrant different retention, different access control, it
    may also help understand whether the data coming in at a regular interval or not.'
  example: alert
  flat_name: event.kind
  ignore_above: 1024
  level: core
  name: kind
  normalize: []
  short: The kind of the event. The highest categorization field in the hierarchy.
  type: keyword
event.module:
  dashed_name: event-module
  description: 'Name of the module this data is coming from.

    If your monitoring agent supports the concept of modules or plugins to process
    events of a given source (e.g. Apache logs), `event.module` should contain the
    name of this module.'
  example: apache
  flat_name: event.module
  ignore_above: 1024
  level: core
  name: module
  normalize: []
  short: Name of the module this data is coming from.
  type: keyword
event.original:
  dashed_name: event-original
  description: 'Raw text message of entire event. Used to demonstrate log integrity
    or where the full log message (before splitting it up in multiple parts) may be
    required, e.g. for reindex.

    This field is not indexed and doc_values are disabled. It cannot be searched,
    but it can be retrieved from `_source`. If users wish to override this and index
    this field, please see `Field data types` in the `Elasticsearch Reference`.'
  doc_values: false
  example: Sep 19 08:26:10 host CEF:0&#124;Security&#124; threatmanager&#124;1.0&#124;100&#124;
    worm successfully stopped&#124;10&#124;src=10.0.0.1 dst=2.1.2.2spt=1232
  flat_name: event.original
  index: false
  level: core
  name: original
  normalize: []
  short: Raw text message of entire event.
  type: keyword
event.outcome:
  allowed_values:
  - description: Indicates that this event describes a failed result. A common example
      is `event.category:file AND event.type:access AND event.outcome:failure` to
      indicate that a file access was attempted, but was not successful.
    name: failure
  - description: Indicates that this event describes a successful result. A common
      example is `event.category:file AND event.type:create AND event.outcome:success`
      to indicate that a file was successfully created.
    name: success
  - description: Indicates that this event describes only an attempt for which the
      result is unknown from the perspective of the event producer. For example, if
      the event contains information only about the request side of a transaction
      that results in a response, populating `event.outcome:unknown` in the request
      event is appropriate. The unknown value should not be used when an outcome doesn't
      make logical sense for the event. In such cases `event.outcome` should not be
      populated.
    name: unknown
  dashed_name: event-outcome
  description: 'This is one of four ECS Categorization Fields, and indicates the lowest
    level in the ECS category hierarchy.

    `event.outcome` simply denotes whether the event represents a success or a failure
    from the perspective of the entity that produced the event.

    Note that when a single transaction is described in multiple events, each event
    may populate different values of `event.outcome`, according to their perspective.

    Also note that in the case of a compound event (a single event that contains multiple
    logical events), this field should be populated with the value that best captures
    the overall success or failure from the perspective of the event producer.

    Further note that not all events will have an associated outcome. For example,
    this field is generally not populated for metric events, events with `event.type:info`,
    or any events for which an outcome does not make logical sense.'
  example: success
  flat_name: event.outcome
  ignore_above: 1024
  level: core
  name: outcome
  normalize: []
  short: The outcome of the event. The lowest level categorization field in the hierarchy.
  type: keyword
event.provider:
  dashed_name: event-provider
  description: 'Source of the event.

    Event transports such as Syslog or the Windows Event Log typically mention the
    source of an event. It can be the name of the software that generated the event
    (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).'
  example: kernel
  flat_name: event.provider
  ignore_above: 1024
  level: extended
  name: provider
  normalize: []
  short: Source of the event.
  type: keyword
event.reason:
  dashed_name: event-reason
  description: 'Reason why this event happened, according to the source.

    This describes the why of a particular action or outcome captured in the event.
    Where `event.action` captures the action from the event, `event.reason` describes
    why that action was taken. For example, a web proxy with an `event.action` which
    denied the request may also populate `event.reason` with the reason why (e.g.
    `blocked site`).'
  example: Terminated an unexpected process
  flat_name: event.reason
  ignore_above: 1024
  level: extended
  name: reason
  normalize: []
  short: Reason why this event happened, according to the source
  type: keyword
event.reference:
  dashed_name: event-reference
  description: 'Reference URL linking to additional information about this event.

    This URL links to a static definition of this event. Alert events, indicated by
    `event.kind:alert`, are a common use case for this field.'
  example: https://system.example.com/event/#0001234
  flat_name: event.reference
  ignore_above: 1024
  level: extended
  name: reference
  normalize: []
  short: Event reference URL
  type: keyword
event.risk_score:
  dashed_name: event-risk-score
  description: Risk score or priority of the event (e.g. security solutions). Use
    your system's original value here.
  flat_name: event.risk_score
  level: core
  name: risk_score
  normalize: []
  short: Risk score or priority of the event (e.g. security solutions). Use your system's
    original value here.
  type: float
event.risk_score_norm:
  dashed_name: event-risk-score-norm
  description: 'Normalized risk score or priority of the event, on a scale of 0 to
    100.

    This is mainly useful if you use more than one system that assigns risk scores,
    and you want to see a normalized value across all systems.'
  flat_name: event.risk_score_norm
  level: extended
  name: risk_score_norm
  normalize: []
  short: Normalized risk score or priority of the event (0-100).
  type: float
event.sequence:
  dashed_name: event-sequence
  description: 'Sequence number of the event.

    The sequence number is a value published by some event sources, to make the exact
    ordering of events unambiguous, regardless of the timestamp precision.'
  flat_name: event.sequence
  format: string
  level: extended
  name: sequence
  normalize: []
  short: Sequence number of the event.
  type: long
event.severity:
  dashed_name: event-severity
  description: 'The numeric severity of the event according to your event source.

    What the different severity values mean can be different between sources and use
    cases. It''s up to the implementer to make sure severities are consistent across
    events from the same source.

    The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is
    meant to represent the severity according to the event source (e.g. firewall,
    IDS). If the event source does not publish its own severity, you may optionally
    copy the `log.syslog.severity.code` to `event.severity`.'
  example: 7
  flat_name: event.severity
  format: string
  level: core
  name: severity
  normalize: []
  short: Numeric severity of the event.
  type: long
event.start:
  dashed_name: event-start
  description: event.start contains the date when the event started or when the activity
    was first observed.
  flat_name: event.start
  level: extended
  name: start
  normalize: []
  short: event.start contains the date when the event started or when the activity
    was first observed.
  type: date
event.timezone:
  dashed_name: event-timezone
  description: 'This field should be populated when the event''s timestamp does not
    include timezone information already (e.g. default Syslog timestamps). It''s optional
    otherwise.

    Acceptable timezone formats are: a canonical ID (e.g. "Europe/Amsterdam"), abbreviated
    (e.g. "EST") or an HH:mm differential (e.g. "-05:00").'
  flat_name: event.timezone
  ignore_above: 1024
  level: extended
  name: timezone
  normalize: []
  short: Event time zone.
  type: keyword
event.type:
  allowed_values:
  - description: The access event type is used for the subset of events within a category
      that indicate that something was accessed. Common examples include `event.category:database
      AND event.type:access`, or `event.category:file AND event.type:access`. Note
      for file access, both directory listings and file opens should be included in
      this subcategory. You can further distinguish access operations using the ECS
      `event.action` field.
    name: access
  - description: 'The admin event type is used for the subset of events within a category
      that are related to admin objects. For example, administrative changes within
      an IAM framework that do not specifically affect a user or group (e.g., adding
      new applications to a federation solution or connecting discrete forests in
      Active Directory) would fall into this subcategory. Common example: `event.category:iam
      AND event.type:change AND event.type:admin`. You can further distinguish admin
      operations using the ECS `event.action` field.'
    name: admin
  - description: The allowed event type is used for the subset of events within a
      category that indicate that something was allowed. Common examples include `event.category:network
      AND event.type:connection AND event.type:allowed` (to indicate a network firewall
      event for which the firewall disposition was to allow the connection to complete)
      and `event.category:intrusion_detection AND event.type:allowed` (to indicate
      a network intrusion prevention system event for which the IPS disposition was
      to allow the connection to complete). You can further distinguish allowed operations
      using the ECS `event.action` field, populating with values of your choosing,
      such as "allow", "detect", or "pass".
    name: allowed
  - description: The change event type is used for the subset of events within a category
      that indicate that something has changed. If semantics best describe an event
      as modified, then include them in this subcategory. Common examples include
      `event.category:process AND event.type:change`, and `event.category:file AND
      event.type:change`. You can further distinguish change operations using the
      ECS `event.action` field.
    name: change
  - description: Used primarily with `event.category:network` this value is used for
      the subset of network traffic that includes sufficient information for the event
      to be included in flow or connection analysis. Events in this subcategory will
      contain at least source and destination IP addresses, source and destination
      TCP/UDP ports, and will usually contain counts of bytes and/or packets transferred.
      Events in this subcategory may contain unidirectional or bidirectional information,
      including summary information. Use this subcategory to visualize and analyze
      network connections. Flow analysis, including Netflow, IPFIX, and other flow-related
      events fit in this subcategory. Note that firewall events from many Next-Generation
      Firewall (NGFW) devices will also fit into this subcategory.  A common filter
      for flow/connection information would be `event.category:network AND event.type:connection
      AND event.type:end` (to view or analyze all completed network connections, ignoring
      mid-flow reports). You can further distinguish connection events using the ECS
      `event.action` field, populating with values of your choosing, such as "timeout",
      or "reset".
    name: connection
  - description: The "creation" event type is used for the subset of events within
      a category that indicate that something was created. A common example is `event.category:file
      AND event.type:creation`.
    name: creation
  - description: The deletion event type is used for the subset of events within a
      category that indicate that something was deleted. A common example is `event.category:file
      AND event.type:deletion` to indicate that a file has been deleted.
    name: deletion
  - description: The denied event type is used for the subset of events within a category
      that indicate that something was denied. Common examples include `event.category:network
      AND event.type:denied` (to indicate a network firewall event for which the firewall
      disposition was to deny the connection) and `event.category:intrusion_detection
      AND event.type:denied` (to indicate a network intrusion prevention system event
      for which the IPS disposition was to deny the connection to complete). You can
      further distinguish denied operations using the ECS `event.action` field, populating
      with values of your choosing, such as "blocked", "dropped", or "quarantined".
    name: denied
  - description: The end event type is used for the subset of events within a category
      that indicate something has ended. A common example is `event.category:process
      AND event.type:end`.
    name: end
  - description: The error event type is used for the subset of events within a category
      that indicate or describe an error. A common example is `event.category:database
      AND event.type:error`. Note that pipeline errors that occur during the event
      ingestion process should not use this `event.type` value. Instead, they should
      use `event.kind:pipeline_error`.
    name: error
  - description: 'The group event type is used for the subset of events within a category
      that are related to group objects. Common example: `event.category:iam AND event.type:creation
      AND event.type:group`. You can further distinguish group operations using the
      ECS `event.action` field.'
    name: group
  - description: 'The indicator event type is used for the subset of events within
      a category that contain details about indicators of compromise (IOCs).

      A common example is `event.category:threat AND event.type:indicator`.'
    name: indicator
  - description: The info event type is used for the subset of events within a category
      that indicate that they are purely informational, and don't report a state change,
      or any type of action. For example, an initial run of a file integrity monitoring
      system (FIM), where an agent reports all files under management, would fall
      into the "info" subcategory. Similarly, an event containing a dump of all currently
      running processes (as opposed to reporting that a process started/ended) would
      fall into the "info" subcategory. An additional common examples is `event.category:intrusion_detection
      AND event.type:info`.
    name: info
  - description: The installation event type is used for the subset of events within
      a category that indicate that something was installed. A common example is `event.category:package`
      AND `event.type:installation`.
    name: installation
  - description: The protocol event type is used for the subset of events within a
      category that indicate that they contain protocol details or analysis, beyond
      simply identifying the protocol. Generally, network events that contain specific
      protocol details will fall into this subcategory. A common example is `event.category:network
      AND event.type:protocol AND event.type:connection AND event.type:end` (to indicate
      that the event is a network connection event sent at the end of a connection
      that also includes a protocol detail breakdown). Note that events that only
      indicate the name or id of the protocol should not use the protocol value. Further
      note that when the protocol subcategory is used, the identified protocol is
      populated in the ECS `network.protocol` field.
    name: protocol
  - description: The start event type is used for the subset of events within a category
      that indicate something has started. A common example is `event.category:process
      AND event.type:start`.
    name: start
  - description: 'The user event type is used for the subset of events within a category
      that are related to user objects. Common example: `event.category:iam AND event.type:deletion
      AND event.type:user`. You can further distinguish user operations using the
      ECS `event.action` field.'
    name: user
  dashed_name: event-type
  description: 'This is one of four ECS Categorization Fields, and indicates the third
    level in the ECS category hierarchy.

    `event.type` represents a categorization "sub-bucket" that, when used along with
    the `event.category` field values, enables filtering events down to a level appropriate
    for single visualization.

    This field is an array. This will allow proper categorization of some events that
    fall in multiple event types.'
  flat_name: event.type
  ignore_above: 1024
  level: core
  name: type
  normalize:
  - array
  short: Event type. The third categorization field in the hierarchy.
  type: keyword
event.url:
  dashed_name: event-url
  description: 'URL linking to an external system to continue investigation of this
    event.

    This URL links to another system where in-depth investigation of the specific
    occurrence of this event can take place. Alert events, indicated by `event.kind:alert`,
    are a common use case for this field.'
  example: https://mysystem.example.com/alert/5271dedb-f5b0-4218-87f0-4ac4870a38fe
  flat_name: event.url
  ignore_above: 1024
  level: extended
  name: url
  normalize: []
  short: Event investigation URL
  type: keyword
http.request.body.bytes:
  dashed_name: http-request-body-bytes
  description: Size in bytes of the request body.
  example: 887
  flat_name: http.request.body.bytes
  format: bytes
  level: extended
  name: request.body.bytes
  normalize: []
  short: Size in bytes of the request body.
  type: long
http.request.body.content:
  dashed_name: http-request-body-content
  description: The full HTTP request body.
  example: Hello world
  flat_name: http.request.body.content
  level: extended
  multi_fields:
  - flat_name: http.request.body.content.text
    name: text
    type: match_only_text
  name: request.body.content
  normalize: []
  short: The full HTTP request body.
  type: wildcard
http.request.bytes:
  dashed_name: http-request-bytes
  description: Total size in bytes of the request (body and headers).
  example: 1437
  flat_name: http.request.bytes
  format: bytes
  level: extended
  name: request.bytes
  normalize: []
  short: Total size in bytes of the request (body and headers).
  type: long
http.request.id:
  dashed_name: http-request-id
  description: 'A unique identifier for each HTTP request to correlate logs between
    clients and servers in transactions.

    The id may be contained in a non-standard HTTP header, such as `X-Request-ID`
    or `X-Correlation-ID`.'
  example: 123e4567-e89b-12d3-a456-426614174000
  flat_name: http.request.id
  ignore_above: 1024
  level: extended
  name: request.id
  normalize: []
  short: HTTP request ID.
  type: keyword
http.request.method:
  dashed_name: http-request-method
  description: 'HTTP request method.

    The value should retain its casing from the original event. For example, `GET`,
    `get`, and `GeT` are all considered valid values for this field.'
  example: POST
  flat_name: http.request.method
  ignore_above: 1024
  level: extended
  name: request.method
  normalize: []
  short: HTTP request method.
  type: keyword
http.request.mime_type:
  dashed_name: http-request-mime-type
  description: 'Mime type of the body of the request.

    This value must only be populated based on the content of the request body, not
    on the `Content-Type` header. Comparing the mime type of a request with the request''s
    Content-Type header can be helpful in detecting threats or misconfigured clients.'
  example: image/gif
  flat_name: http.request.mime_type
  ignore_above: 1024
  level: extended
  name: request.mime_type
  normalize: []
  short: Mime type of the body of the request.
  type: keyword
http.request.referrer:
  dashed_name: http-request-referrer
  description: Referrer for this HTTP request.
  example: https://blog.example.com/
  flat_name: http.request.referrer
  ignore_above: 1024
  level: extended
  name: request.referrer
  normalize: []
  short: Referrer for this HTTP request.
  type: keyword
http.response.body.bytes:
  dashed_name: http-response-body-bytes
  description: Size in bytes of the response body.
  example: 887
  flat_name: http.response.body.bytes
  format: bytes
  level: extended
  name: response.body.bytes
  normalize: []
  short: Size in bytes of the response body.
  type: long
http.response.body.content:
  dashed_name: http-response-body-content
  description: The full HTTP response body.
  example: Hello world
  flat_name: http.response.body.content
  level: extended
  multi_fields:
  - flat_name: http.response.body.content.text
    name: text
    type: match_only_text
  name: response.body.content
  normalize: []
  short: The full HTTP response body.
  type: wildcard
http.response.bytes:
  dashed_name: http-response-bytes
  description: Total size in bytes of the response (body and headers).
  example: 1437
  flat_name: http.response.bytes
  format: bytes
  level: extended
  name: response.bytes
  normalize: []
  short: Total size in bytes of the response (body and headers).
  type: long
http.response.mime_type:
  dashed_name: http-response-mime-type
  description: 'Mime type of the body of the response.

    This value must only be populated based on the content of the response body, not
    on the `Content-Type` header. Comparing the mime type of a response with the response''s
    Content-Type header can be helpful in detecting misconfigured servers.'
  example: image/gif
  flat_name: http.response.mime_type
  ignore_above: 1024
  level: extended
  name: response.mime_type
  normalize: []
  short: Mime type of the body of the response.
  type: keyword
http.response.status_code:
  dashed_name: http-response-status-code
  description: HTTP response status code.
  example: 404
  flat_name: http.response.status_code
  format: string
  level: extended
  name: response.status_code
  normalize: []
  short: HTTP response status code.
  type: long
http.version:
  dashed_name: http-version
  description: HTTP version.
  example: 1.1
  flat_name: http.version
  ignore_above: 1024
  level: extended
  name: version
  normalize: []
  short: HTTP version.
  type: keyword
labels:
  dashed_name: labels
  description: 'Custom key/value pairs.

    Can be used to add meta information to events. Should not contain nested objects.
    All values are stored as keyword.

    Example: `docker` and `k8s` labels.'
  example: '{"application": "foo-bar", "env": "production"}'
  flat_name: labels
  level: core
  name: labels
  normalize: []
  object_type: keyword
  short: Custom key/value pairs.
  type: object
message:
  dashed_name: message
  description: 'For log events the message field contains the log message, optimized
    for viewing in a log viewer.

    For structured logs without an original message field, other fields can be concatenated
    to form a human-readable summary of the event.

    If multiple messages exist, they can be combined into one message.'
  example: Hello World
  flat_name: message
  level: core
  name: message
  normalize: []
  short: Log message optimized for viewing in a log viewer.
  type: match_only_text
network.application:
  dashed_name: network-application
  description: 'When a specific application or service is identified from network
    connection details (source/dest IPs, ports, certificates, or wire format), this
    field captures the application''s or service''s name.

    For example, the original event identifies the network connection being from a
    specific web service in a `https` network connection, like `facebook` or `twitter`.

    The field value must be normalized to lowercase for querying.'
  example: aim
  flat_name: network.application
  ignore_above: 1024
  level: extended
  name: application
  normalize: []
  short: Application level protocol name.
  type: keyword
network.bytes:
  dashed_name: network-bytes
  description: 'Total bytes transferred in both directions.

    If `source.bytes` and `destination.bytes` are known, `network.bytes` is their
    sum.'
  example: 368
  flat_name: network.bytes
  format: bytes
  level: core
  name: bytes
  normalize: []
  short: Total bytes transferred in both directions.
  type: long
network.community_id:
  dashed_name: network-community-id
  description: 'A hash of source and destination IPs and ports, as well as the protocol
    used in a communication. This is a tool-agnostic standard to identify flows.

    Learn more at https://github.com/corelight/community-id-spec.'
  example: 1:hO+sN4H+MG5MY/8hIrXPqc4ZQz0=
  flat_name: network.community_id
  ignore_above: 1024
  level: extended
  name: community_id
  normalize: []
  short: A hash of source and destination IPs and ports.
  type: keyword
network.direction:
  dashed_name: network-direction
  description: "Direction of the network traffic.\nRecommended values are:\n  * ingress\n\
    \  * egress\n  * inbound\n  * outbound\n  * internal\n  * external\n  * unknown\n\
    \nWhen mapping events from a host-based monitoring context, populate this field\
    \ from the host's point of view, using the values \"ingress\" or \"egress\".\n\
    When mapping events from a network or perimeter-based monitoring context, populate\
    \ this field from the point of view of the network perimeter, using the values\
    \ \"inbound\", \"outbound\", \"internal\" or \"external\".\nNote that \"internal\"\
    \ is not crossing perimeter boundaries, and is meant to describe communication\
    \ between two hosts within the perimeter. Note also that \"external\" is meant\
    \ to describe traffic between two hosts that are external to the perimeter. This\
    \ could for example be useful for ISPs or VPN service providers."
  example: inbound
  flat_name: network.direction
  ignore_above: 1024
  level: core
  name: direction
  normalize: []
  short: Direction of the network traffic.
  type: keyword
network.forwarded_ip:
  dashed_name: network-forwarded-ip
  description: Host IP address when the source IP address is the proxy.
  example: 192.1.1.2
  flat_name: network.forwarded_ip
  level: core
  name: forwarded_ip
  normalize: []
  short: Host IP address when the source IP address is the proxy.
  type: ip
network.iana_number:
  dashed_name: network-iana-number
  description: IANA Protocol Number (https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml).
    Standardized list of protocols. This aligns well with NetFlow and sFlow related
    logs which use the IANA Protocol Number.
  example: 6
  flat_name: network.iana_number
  ignore_above: 1024
  level: extended
  name: iana_number
  normalize: []
  short: IANA Protocol Number.
  type: keyword
network.inner:
  dashed_name: network-inner
  description: Network.inner fields are added in addition to network.vlan fields to
    describe the innermost VLAN when q-in-q VLAN tagging is present. Allowed fields
    include vlan.id and vlan.name. Inner vlan fields are typically used when sending
    traffic with multiple 802.1q encapsulations to a network sensor (e.g. Zeek, Wireshark.)
  flat_name: network.inner
  level: extended
  name: inner
  normalize: []
  short: Inner VLAN tag information
  type: object
network.inner.vlan.id:
  dashed_name: network-inner-vlan-id
  description: VLAN ID as reported by the observer.
  example: 10
  flat_name: network.inner.vlan.id
  ignore_above: 1024
  level: extended
  name: id
  normalize: []
  original_fieldset: vlan
  short: VLAN ID as reported by the observer.
  type: keyword
network.inner.vlan.name:
  dashed_name: network-inner-vlan-name
  description: Optional VLAN name as reported by the observer.
  example: outside
  flat_name: network.inner.vlan.name
  ignore_above: 1024
  level: extended
  name: name
  normalize: []
  original_fieldset: vlan
  short: Optional VLAN name as reported by the observer.
  type: keyword
network.name:
  dashed_name: network-name
  description: Name given by operators to sections of their network.
  example: Guest Wifi
  flat_name: network.name
  ignore_above: 1024
  level: extended
  name: name
  normalize: []
  short: Name given by operators to sections of their network.
  type: keyword
network.packets:
  dashed_name: network-packets
  description: 'Total packets transferred in both directions.

    If `source.packets` and `destination.packets` are known, `network.packets` is
    their sum.'
  example: 24
  flat_name: network.packets
  level: core
  name: packets
  normalize: []
  short: Total packets transferred in both directions.
  type: long
network.protocol:
  dashed_name: network-protocol
  description: 'In the OSI Model this would be the Application Layer protocol. For
    example, `http`, `dns`, or `ssh`.

    The field value must be normalized to lowercase for querying.'
  example: http
  flat_name: network.protocol
  ignore_above: 1024
  level: core
  name: protocol
  normalize: []
  short: Application protocol name.
  type: keyword
network.transport:
  dashed_name: network-transport
  description: 'Same as network.iana_number, but instead using the Keyword name of
    the transport layer (udp, tcp, ipv6-icmp, etc.)

    The field value must be normalized to lowercase for querying.'
  example: tcp
  flat_name: network.transport
  ignore_above: 1024
  level: core
  name: transport
  normalize: []
  short: Protocol Name corresponding to the field `iana_number`.
  type: keyword
network.type:
  dashed_name: network-type
  description: 'In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec,
    pim, etc

    The field value must be normalized to lowercase for querying.'
  example: ipv4
  flat_name: network.type
  ignore_above: 1024
  level: core
  name: type
  normalize: []
  short: In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim,
    etc
  type: keyword
network.vlan.id:
  dashed_name: network-vlan-id
  description: VLAN ID as reported by the observer.
  example: 10
  flat_name: network.vlan.id
  ignore_above: 1024
  level: extended
  name: id
  normalize: []
  original_fieldset: vlan
  short: VLAN ID as reported by the observer.
  type: keyword
network.vlan.name:
  dashed_name: network-vlan-name
  description: Optional VLAN name as reported by the observer.
  example: outside
  flat_name: network.vlan.name
  ignore_above: 1024
  level: extended
  name: name
  normalize: []
  original_fieldset: vlan
  short: Optional VLAN name as reported by the observer.
  type: keyword
related.ip:
  dashed_name: related-ip
  description: All of the IPs seen on your event.
  flat_name: related.ip
  level: extended
  name: ip
  normalize:
  - array
  short: All of the IPs seen on your event.
  type: ip
related.user:
  dashed_name: related-user
  description: All the user names or other user identifiers seen on the event.
  flat_name: related.user
  ignore_above: 1024
  level: extended
  name: user
  normalize:
  - array
  short: All the user names or other user identifiers seen on the event.
  type: keyword
server.address:
  dashed_name: server-address
  description: 'Some event server addresses are defined ambiguously. The event will
    sometimes list an IP, a domain or a unix socket.  You should always store the
    raw address in the `.address` field.

    Then it should be duplicated to `.ip` or `.domain`, depending on which one it
    is.'
  flat_name: server.address
  ignore_above: 1024
  level: extended
  name: address
  normalize: []
  short: Server network address.
  type: keyword
server.as.number:
  dashed_name: server-as-number
  description: Unique number allocated to the autonomous system. The autonomous system
    number (ASN) uniquely identifies each network on the Internet.
  example: 15169
  flat_name: server.as.number
  level: extended
  name: number
  normalize: []
  original_fieldset: as
  short: Unique number allocated to the autonomous system.
  type: long
server.as.organization.name:
  dashed_name: server-as-organization-name
  description: Organization name.
  example: Google LLC
  flat_name: server.as.organization.name
  ignore_above: 1024
  level: extended
  multi_fields:
  - flat_name: server.as.organization.name.text
    name: text
    type: match_only_text
  name: organization.name
  normalize: []
  original_fieldset: as
  short: Organization name.
  type: keyword
server.bytes:
  dashed_name: server-bytes
  description: Bytes sent from the server to the client.
  example: 184
  flat_name: server.bytes
  format: bytes
  level: core
  name: bytes
  normalize: []
  short: Bytes sent from the server to the client.
  type: long
server.domain:
  dashed_name: server-domain
  description: 'The domain name of the server system.

    This value may be a host name, a fully qualified domain name, or another host
    naming format. The value may derive from the original event or be added from enrichment.'
  example: foo.example.com
  flat_name: server.domain
  ignore_above: 1024
  level: core
  name: domain
  normalize: []
  short: The domain name of the server.
  type: keyword
server.geo.city_name:
  dashed_name: server-geo-city-name
  description: City name.
  example: Montreal
  flat_name: server.geo.city_name
  ignore_above: 1024
  level: core
  name: city_name
  normalize: []
  original_fieldset: geo
  short: City name.
  type: keyword
server.geo.continent_code:
  dashed_name: server-geo-continent-code
  description: Two-letter code representing continent's name.
  example: NA
  flat_name: server.geo.continent_code
  ignore_above: 1024
  level: core
  name: continent_code
  normalize: []
  original_fieldset: geo
  short: Continent code.
  type: keyword
server.geo.continent_name:
  dashed_name: server-geo-continent-name
  description: Name of the continent.
  example: North America
  flat_name: server.geo.continent_name
  ignore_above: 1024
  level: core
  name: continent_name
  normalize: []
  original_fieldset: geo
  short: Name of the continent.
  type: keyword
server.geo.country_iso_code:
  dashed_name: server-geo-country-iso-code
  description: Country ISO code.
  example: CA
  flat_name: server.geo.country_iso_code
  ignore_above: 1024
  level: core
  name: country_iso_code
  normalize: []
  original_fieldset: geo
  short: Country ISO code.
  type: keyword
server.geo.country_name:
  dashed_name: server-geo-country-name
  description: Country name.
  example: Canada
  flat_name: server.geo.country_name
  ignore_above: 1024
  level: core
  name: country_name
  normalize: []
  original_fieldset: geo
  short: Country name.
  type: keyword
server.geo.location:
  dashed_name: server-geo-location
  description: Longitude and latitude.
  example: '{ "lon": -73.614830, "lat": 45.505918 }'
  flat_name: server.geo.location
  level: core
  name: location
  normalize: []
  original_fieldset: geo
  short: Longitude and latitude.
  type: geo_point
server.geo.name:
  dashed_name: server-geo-name
  description: 'User-defined description of a location, at the level of granularity
    they care about.

    Could be the name of their data centers, the floor number, if this describes a
    local physical entity, city names.

    Not typically used in automated geolocation.'
  example: boston-dc
  flat_name: server.geo.name
  ignore_above: 1024
  level: extended
  name: name
  normalize: []
  original_fieldset: geo
  short: User-defined description of a location.
  type: keyword
server.geo.postal_code:
  dashed_name: server-geo-postal-code
  description: 'Postal code associated with the location.

    Values appropriate for this field may also be known as a postcode or ZIP code
    and will vary widely from country to country.'
  example: 94040
  flat_name: server.geo.postal_code
  ignore_above: 1024
  level: core
  name: postal_code
  normalize: []
  original_fieldset: geo
  short: Postal code.
  type: keyword
server.geo.region_iso_code:
  dashed_name: server-geo-region-iso-code
  description: Region ISO code.
  example: CA-QC
  flat_name: server.geo.region_iso_code
  ignore_above: 1024
  level: core
  name: region_iso_code
  normalize: []
  original_fieldset: geo
  short: Region ISO code.
  type: keyword
server.geo.region_name:
  dashed_name: server-geo-region-name
  description: Region name.
  example: Quebec
  flat_name: server.geo.region_name
  ignore_above: 1024
  level: core
  name: region_name
  normalize: []
  original_fieldset: geo
  short: Region name.
  type: keyword
server.geo.timezone:
  dashed_name: server-geo-timezone
  description: The time zone of the location, such as IANA time zone name.
  example: America/Argentina/Buenos_Aires
  flat_name: server.geo.timezone
  ignore_above: 1024
  level: core
  name: timezone
  normalize: []
  original_fieldset: geo
  short: Time zone.
  type: keyword
server.ip:
  dashed_name: server-ip
  description: IP address of the server (IPv4 or IPv6).
  flat_name: server.ip
  level: core
  name: ip
  normalize: []
  short: IP address of the server.
  type: ip
server.mac:
  dashed_name: server-mac
  description: 'MAC address of the server.

    The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte)
    is represented by two [uppercase] hexadecimal digits giving the value of the octet
    as an unsigned integer. Successive octets are separated by a hyphen.'
  example: 00-00-5E-00-53-23
  flat_name: server.mac
  ignore_above: 1024
  level: core
  name: mac
  normalize: []
  short: MAC address of the server.
  type: keyword
server.nat.ip:
  dashed_name: server-nat-ip
  description: 'Translated ip of destination based NAT sessions (e.g. internet to
    private DMZ)

    Typically used with load balancers, firewalls, or routers.'
  flat_name: server.nat.ip
  level: extended
  name: nat.ip
  normalize: []
  short: Server NAT ip
  type: ip
server.nat.port:
  dashed_name: server-nat-port
  description: 'Translated port of destination based NAT sessions (e.g. internet to
    private DMZ)

    Typically used with load balancers, firewalls, or routers.'
  flat_name: server.nat.port
  format: string
  level: extended
  name: nat.port
  normalize: []
  short: Server NAT port
  type: long
server.packets:
  dashed_name: server-packets
  description: Packets sent from the server to the client.
  example: 12
  flat_name: server.packets
  level: core
  name: packets
  normalize: []
  short: Packets sent from the server to the client.
  type: long
server.port:
  dashed_name: server-port
  description: Port of the server.
  flat_name: server.port
  format: string
  level: core
  name: port
  normalize: []
  short: Port of the server.
  type: long
server.registered_domain:
  dashed_name: server-registered-domain
  description: 'The highest registered server domain, stripped of the subdomain.

    For example, the registered domain for "foo.example.com" is "example.com".

    This value can be determined precisely with a list like the public suffix list
    (http://publicsuffix.org). Trying to approximate this by simply taking the last
    two labels will not work well for TLDs such as "co.uk".'
  example: example.com
  flat_name: server.registered_domain
  ignore_above: 1024
  level: extended
  name: registered_domain
  normalize: []
  short: The highest registered server domain, stripped of the subdomain.
  type: keyword
server.subdomain:
  dashed_name: server-subdomain
  description: 'The subdomain portion of a fully qualified domain name includes all
    of the names except the host name under the registered_domain.  In a partially
    qualified domain, or if the the qualification level of the full name cannot be
    determined, subdomain contains all of the names below the registered domain.

    For example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the
    domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the
    subdomain field should contain "sub2.sub1", with no trailing period.'
  example: east
  flat_name: server.subdomain
  ignore_above: 1024
  level: extended
  name: subdomain
  normalize: []
  short: The subdomain of the domain.
  type: keyword
server.top_level_domain:
  dashed_name: server-top-level-domain
  description: 'The effective top level domain (eTLD), also known as the domain suffix,
    is the last part of the domain name. For example, the top level domain for example.com
    is "com".

    This value can be determined precisely with a list like the public suffix list
    (http://publicsuffix.org). Trying to approximate this by simply taking the last
    label will not work well for effective TLDs such as "co.uk".'
  example: co.uk
  flat_name: server.top_level_domain
  ignore_above: 1024
  level: extended
  name: top_level_domain
  normalize: []
  short: The effective top level domain (com, org, net, co.uk).
  type: keyword
server.user.domain:
  dashed_name: server-user-domain
  description: 'Name of the directory the user is a member of.

    For example, an LDAP or Active Directory domain name.'
  flat_name: server.user.domain
  ignore_above: 1024
  level: extended
  name: domain
  normalize: []
  original_fieldset: user
  short: Name of the directory the user is a member of.
  type: keyword
server.user.email:
  dashed_name: server-user-email
  description: User email address.
  flat_name: server.user.email
  ignore_above: 1024
  level: extended
  name: email
  normalize: []
  original_fieldset: user
  short: User email address.
  type: keyword
server.user.full_name:
  dashed_name: server-user-full-name
  description: User's full name, if available.
  example: Albert Einstein
  flat_name: server.user.full_name
  ignore_above: 1024
  level: extended
  multi_fields:
  - flat_name: server.user.full_name.text
    name: text
    type: match_only_text
  name: full_name
  normalize: []
  original_fieldset: user
  short: User's full name, if available.
  type: keyword
server.user.group.domain:
  dashed_name: server-user-group-domain
  description: 'Name of the directory the group is a member of.

    For example, an LDAP or Active Directory domain name.'
  flat_name: server.user.group.domain
  ignore_above: 1024
  level: extended
  name: domain
  normalize: []
  original_fieldset: group
  short: Name of the directory the group is a member of.
  type: keyword
server.user.group.id:
  dashed_name: server-user-group-id
  description: Unique identifier for the group on the system/platform.
  flat_name: server.user.group.id
  ignore_above: 1024
  level: extended
  name: id
  normalize: []
  original_fieldset: group
  short: Unique identifier for the group on the system/platform.
  type: keyword
server.user.group.name:
  dashed_name: server-user-group-name
  description: Name of the group.
  flat_name: server.user.group.name
  ignore_above: 1024
  level: extended
  name: name
  normalize: []
  original_fieldset: group
  short: Name of the group.
  type: keyword
server.user.hash:
  dashed_name: server-user-hash
  description: 'Unique user hash to correlate information for a user in anonymized
    form.

    Useful if `user.id` or `user.name` contain confidential information and cannot
    be used.'
  flat_name: server.user.hash
  ignore_above: 1024
  level: extended
  name: hash
  normalize: []
  original_fieldset: user
  short: Unique user hash to correlate information for a user in anonymized form.
  type: keyword
server.user.id:
  dashed_name: server-user-id
  description: Unique identifier of the user.
  example: S-1-5-21-202424912787-2692429404-2351956786-1000
  flat_name: server.user.id
  ignore_above: 1024
  level: core
  name: id
  normalize: []
  original_fieldset: user
  short: Unique identifier of the user.
  type: keyword
server.user.name:
  dashed_name: server-user-name
  description: Short name or login of the user.
  example: a.einstein
  flat_name: server.user.name
  ignore_above: 1024
  level: core
  multi_fields:
  - flat_name: server.user.name.text
    name: text
    type: match_only_text
  name: name
  normalize: []
  original_fieldset: user
  short: Short name or login of the user.
  type: keyword
server.user.roles:
  dashed_name: server-user-roles
  description: Array of user roles at the time of the event.
  example: '["kibana_admin", "reporting_user"]'
  flat_name: server.user.roles
  ignore_above: 1024
  level: extended
  name: roles
  normalize:
  - array
  original_fieldset: user
  short: Array of user roles at the time of the event.
  type: keyword
source.address:
  dashed_name: source-address
  description: 'Some event source addresses are defined ambiguously. The event will
    sometimes list an IP, a domain or a unix socket.  You should always store the
    raw address in the `.address` field.

    Then it should be duplicated to `.ip` or `.domain`, depending on which one it
    is.'
  flat_name: source.address
  ignore_above: 1024
  level: extended
  name: address
  normalize: []
  short: Source network address.
  type: keyword
source.as.number:
  dashed_name: source-as-number
  description: Unique number allocated to the autonomous system. The autonomous system
    number (ASN) uniquely identifies each network on the Internet.
  example: 15169
  flat_name: source.as.number
  level: extended
  name: number
  normalize: []
  original_fieldset: as
  short: Unique number allocated to the autonomous system.
  type: long
source.as.organization.name:
  dashed_name: source-as-organization-name
  description: Organization name.
  example: Google LLC
  flat_name: source.as.organization.name
  ignore_above: 1024
  level: extended
  multi_fields:
  - flat_name: source.as.organization.name.text
    name: text
    type: match_only_text
  name: organization.name
  normalize: []
  original_fieldset: as
  short: Organization name.
  type: keyword
source.bytes:
  dashed_name: source-bytes
  description: Bytes sent from the source to the destination.
  example: 184
  flat_name: source.bytes
  format: bytes
  level: core
  name: bytes
  normalize: []
  short: Bytes sent from the source to the destination.
  type: long
source.domain:
  dashed_name: source-domain
  description: 'The domain name of the source system.

    This value may be a host name, a fully qualified domain name, or another host
    naming format. The value may derive from the original event or be added from enrichment.'
  example: foo.example.com
  flat_name: source.domain
  ignore_above: 1024
  level: core
  name: domain
  normalize: []
  short: The domain name of the source.
  type: keyword
source.geo.city_name:
  dashed_name: source-geo-city-name
  description: City name.
  example: Montreal
  flat_name: source.geo.city_name
  ignore_above: 1024
  level: core
  name: city_name
  normalize: []
  original_fieldset: geo
  short: City name.
  type: keyword
source.geo.continent_code:
  dashed_name: source-geo-continent-code
  description: Two-letter code representing continent's name.
  example: NA
  flat_name: source.geo.continent_code
  ignore_above: 1024
  level: core
  name: continent_code
  normalize: []
  original_fieldset: geo
  short: Continent code.
  type: keyword
source.geo.continent_name:
  dashed_name: source-geo-continent-name
  description: Name of the continent.
  example: North America
  flat_name: source.geo.continent_name
  ignore_above: 1024
  level: core
  name: continent_name
  normalize: []
  original_fieldset: geo
  short: Name of the continent.
  type: keyword
source.geo.country_iso_code:
  dashed_name: source-geo-country-iso-code
  description: Country ISO code.
  example: CA
  flat_name: source.geo.country_iso_code
  ignore_above: 1024
  level: core
  name: country_iso_code
  normalize: []
  original_fieldset: geo
  short: Country ISO code.
  type: keyword
source.geo.country_name:
  dashed_name: source-geo-country-name
  description: Country name.
  example: Canada
  flat_name: source.geo.country_name
  ignore_above: 1024
  level: core
  name: country_name
  normalize: []
  original_fieldset: geo
  short: Country name.
  type: keyword
source.geo.location:
  dashed_name: source-geo-location
  description: Longitude and latitude.
  example: '{ "lon": -73.614830, "lat": 45.505918 }'
  flat_name: source.geo.location
  level: core
  name: location
  normalize: []
  original_fieldset: geo
  short: Longitude and latitude.
  type: geo_point
source.geo.name:
  dashed_name: source-geo-name
  description: 'User-defined description of a location, at the level of granularity
    they care about.

    Could be the name of their data centers, the floor number, if this describes a
    local physical entity, city names.

    Not typically used in automated geolocation.'
  example: boston-dc
  flat_name: source.geo.name
  ignore_above: 1024
  level: extended
  name: name
  normalize: []
  original_fieldset: geo
  short: User-defined description of a location.
  type: keyword
source.geo.postal_code:
  dashed_name: source-geo-postal-code
  description: 'Postal code associated with the location.

    Values appropriate for this field may also be known as a postcode or ZIP code
    and will vary widely from country to country.'
  example: 94040
  flat_name: source.geo.postal_code
  ignore_above: 1024
  level: core
  name: postal_code
  normalize: []
  original_fieldset: geo
  short: Postal code.
  type: keyword
source.geo.region_iso_code:
  dashed_name: source-geo-region-iso-code
  description: Region ISO code.
  example: CA-QC
  flat_name: source.geo.region_iso_code
  ignore_above: 1024
  level: core
  name: region_iso_code
  normalize: []
  original_fieldset: geo
  short: Region ISO code.
  type: keyword
source.geo.region_name:
  dashed_name: source-geo-region-name
  description: Region name.
  example: Quebec
  flat_name: source.geo.region_name
  ignore_above: 1024
  level: core
  name: region_name
  normalize: []
  original_fieldset: geo
  short: Region name.
  type: keyword
source.geo.timezone:
  dashed_name: source-geo-timezone
  description: The time zone of the location, such as IANA time zone name.
  example: America/Argentina/Buenos_Aires
  flat_name: source.geo.timezone
  ignore_above: 1024
  level: core
  name: timezone
  normalize: []
  original_fieldset: geo
  short: Time zone.
  type: keyword
source.ip:
  dashed_name: source-ip
  description: IP address of the source (IPv4 or IPv6).
  flat_name: source.ip
  level: core
  name: ip
  normalize: []
  short: IP address of the source.
  type: ip
source.mac:
  dashed_name: source-mac
  description: 'MAC address of the source.

    The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte)
    is represented by two [uppercase] hexadecimal digits giving the value of the octet
    as an unsigned integer. Successive octets are separated by a hyphen.'
  example: 00-00-5E-00-53-23
  flat_name: source.mac
  ignore_above: 1024
  level: core
  name: mac
  normalize: []
  short: MAC address of the source.
  type: keyword
source.nat.ip:
  dashed_name: source-nat-ip
  description: 'Translated ip of source based NAT sessions (e.g. internal client to
    internet)

    Typically connections traversing load balancers, firewalls, or routers.'
  flat_name: source.nat.ip
  level: extended
  name: nat.ip
  normalize: []
  short: Source NAT ip
  type: ip
source.nat.port:
  dashed_name: source-nat-port
  description: 'Translated port of source based NAT sessions. (e.g. internal client
    to internet)

    Typically used with load balancers, firewalls, or routers.'
  flat_name: source.nat.port
  format: string
  level: extended
  name: nat.port
  normalize: []
  short: Source NAT port
  type: long
source.packets:
  dashed_name: source-packets
  description: Packets sent from the source to the destination.
  example: 12
  flat_name: source.packets
  level: core
  name: packets
  normalize: []
  short: Packets sent from the source to the destination.
  type: long
source.port:
  dashed_name: source-port
  description: Port of the source.
  flat_name: source.port
  format: string
  level: core
  name: port
  normalize: []
  short: Port of the source.
  type: long
source.registered_domain:
  dashed_name: source-registered-domain
  description: 'The highest registered source domain, stripped of the subdomain.

    For example, the registered domain for "foo.example.com" is "example.com".

    This value can be determined precisely with a list like the public suffix list
    (http://publicsuffix.org). Trying to approximate this by simply taking the last
    two labels will not work well for TLDs such as "co.uk".'
  example: example.com
  flat_name: source.registered_domain
  ignore_above: 1024
  level: extended
  name: registered_domain
  normalize: []
  short: The highest registered source domain, stripped of the subdomain.
  type: keyword
source.subdomain:
  dashed_name: source-subdomain
  description: 'The subdomain portion of a fully qualified domain name includes all
    of the names except the host name under the registered_domain.  In a partially
    qualified domain, or if the the qualification level of the full name cannot be
    determined, subdomain contains all of the names below the registered domain.

    For example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the
    domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the
    subdomain field should contain "sub2.sub1", with no trailing period.'
  example: east
  flat_name: source.subdomain
  ignore_above: 1024
  level: extended
  name: subdomain
  normalize: []
  short: The subdomain of the domain.
  type: keyword
source.top_level_domain:
  dashed_name: source-top-level-domain
  description: 'The effective top level domain (eTLD), also known as the domain suffix,
    is the last part of the domain name. For example, the top level domain for example.com
    is "com".

    This value can be determined precisely with a list like the public suffix list
    (http://publicsuffix.org). Trying to approximate this by simply taking the last
    label will not work well for effective TLDs such as "co.uk".'
  example: co.uk
  flat_name: source.top_level_domain
  ignore_above: 1024
  level: extended
  name: top_level_domain
  normalize: []
  short: The effective top level domain (com, org, net, co.uk).
  type: keyword
source.user.domain:
  dashed_name: source-user-domain
  description: 'Name of the directory the user is a member of.

    For example, an LDAP or Active Directory domain name.'
  flat_name: source.user.domain
  ignore_above: 1024
  level: extended
  name: domain
  normalize: []
  original_fieldset: user
  short: Name of the directory the user is a member of.
  type: keyword
source.user.email:
  dashed_name: source-user-email
  description: User email address.
  flat_name: source.user.email
  ignore_above: 1024
  level: extended
  name: email
  normalize: []
  original_fieldset: user
  short: User email address.
  type: keyword
source.user.full_name:
  dashed_name: source-user-full-name
  description: User's full name, if available.
  example: Albert Einstein
  flat_name: source.user.full_name
  ignore_above: 1024
  level: extended
  multi_fields:
  - flat_name: source.user.full_name.text
    name: text
    type: match_only_text
  name: full_name
  normalize: []
  original_fieldset: user
  short: User's full name, if available.
  type: keyword
source.user.group.domain:
  dashed_name: source-user-group-domain
  description: 'Name of the directory the group is a member of.

    For example, an LDAP or Active Directory domain name.'
  flat_name: source.user.group.domain
  ignore_above: 1024
  level: extended
  name: domain
  normalize: []
  original_fieldset: group
  short: Name of the directory the group is a member of.
  type: keyword
source.user.group.id:
  dashed_name: source-user-group-id
  description: Unique identifier for the group on the system/platform.
  flat_name: source.user.group.id
  ignore_above: 1024
  level: extended
  name: id
  normalize: []
  original_fieldset: group
  short: Unique identifier for the group on the system/platform.
  type: keyword
source.user.group.name:
  dashed_name: source-user-group-name
  description: Name of the group.
  flat_name: source.user.group.name
  ignore_above: 1024
  level: extended
  name: name
  normalize: []
  original_fieldset: group
  short: Name of the group.
  type: keyword
source.user.hash:
  dashed_name: source-user-hash
  description: 'Unique user hash to correlate information for a user in anonymized
    form.

    Useful if `user.id` or `user.name` contain confidential information and cannot
    be used.'
  flat_name: source.user.hash
  ignore_above: 1024
  level: extended
  name: hash
  normalize: []
  original_fieldset: user
  short: Unique user hash to correlate information for a user in anonymized form.
  type: keyword
source.user.id:
  dashed_name: source-user-id
  description: Unique identifier of the user.
  example: S-1-5-21-202424912787-2692429404-2351956786-1000
  flat_name: source.user.id
  ignore_above: 1024
  level: core
  name: id
  normalize: []
  original_fieldset: user
  short: Unique identifier of the user.
  type: keyword
source.user.name:
  dashed_name: source-user-name
  description: Short name or login of the user.
  example: a.einstein
  flat_name: source.user.name
  ignore_above: 1024
  level: core
  multi_fields:
  - flat_name: source.user.name.text
    name: text
    type: match_only_text
  name: name
  normalize: []
  original_fieldset: user
  short: Short name or login of the user.
  type: keyword
source.user.roles:
  dashed_name: source-user-roles
  description: Array of user roles at the time of the event.
  example: '["kibana_admin", "reporting_user"]'
  flat_name: source.user.roles
  ignore_above: 1024
  level: extended
  name: roles
  normalize:
  - array
  original_fieldset: user
  short: Array of user roles at the time of the event.
  type: keyword
tags:
  dashed_name: tags
  description: List of keywords used to tag each event.
  example: '["production", "env2"]'
  flat_name: tags
  ignore_above: 1024
  level: core
  name: tags
  normalize:
  - array
  short: List of keywords used to tag each event.
  type: keyword
url.domain:
  dashed_name: url-domain
  description: 'Domain of the url, such as "www.elastic.co".

    In some cases a URL may refer to an IP and/or port directly, without a domain
    name. In this case, the IP address would go to the `domain` field.

    If the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732),
    the `[` and `]` characters should also be captured in the `domain` field.'
  example: www.elastic.co
  flat_name: url.domain
  ignore_above: 1024
  level: extended
  name: domain
  normalize: []
  short: Domain of the url.
  type: keyword
url.extension:
  dashed_name: url-extension
  description: 'The field contains the file extension from the original request url,
    excluding the leading dot.

    The file extension is only set if it exists, as not every url has a file extension.

    The leading period must not be included. For example, the value must be "png",
    not ".png".

    Note that when the file name has multiple extensions (example.tar.gz), only the
    last one should be captured ("gz", not "tar.gz").'
  example: png
  flat_name: url.extension
  ignore_above: 1024
  level: extended
  name: extension
  normalize: []
  short: File extension from the request url, excluding the leading dot.
  type: keyword
url.fragment:
  dashed_name: url-fragment
  description: 'Portion of the url after the `#`, such as "top".

    The `#` is not part of the fragment.'
  flat_name: url.fragment
  ignore_above: 1024
  level: extended
  name: fragment
  normalize: []
  short: Portion of the url after the `#`.
  type: keyword
url.full:
  dashed_name: url-full
  description: If full URLs are important to your use case, they should be stored
    in `url.full`, whether this field is reconstructed or present in the event source.
  example: https://www.elastic.co:443/search?q=elasticsearch#top
  flat_name: url.full
  level: extended
  multi_fields:
  - flat_name: url.full.text
    name: text
    type: match_only_text
  name: full
  normalize: []
  short: Full unparsed URL.
  type: wildcard
url.original:
  dashed_name: url-original
  description: 'Unmodified original url as seen in the event source.

    Note that in network monitoring, the observed URL may be a full URL, whereas in
    access logs, the URL is often just represented as a path.

    This field is meant to represent the URL as it was observed, complete or not.'
  example: https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch
  flat_name: url.original
  level: extended
  multi_fields:
  - flat_name: url.original.text
    name: text
    type: match_only_text
  name: original
  normalize: []
  short: Unmodified original url as seen in the event source.
  type: wildcard
url.password:
  dashed_name: url-password
  description: Password of the request.
  flat_name: url.password
  ignore_above: 1024
  level: extended
  name: password
  normalize: []
  short: Password of the request.
  type: keyword
url.path:
  dashed_name: url-path
  description: Path of the request, such as "/search".
  flat_name: url.path
  level: extended
  name: path
  normalize: []
  short: Path of the request, such as "/search".
  type: wildcard
url.port:
  dashed_name: url-port
  description: Port of the request, such as 443.
  example: 443
  flat_name: url.port
  format: string
  level: extended
  name: port
  normalize: []
  short: Port of the request, such as 443.
  type: long
url.query:
  dashed_name: url-query
  description: 'The query field describes the query string of the request, such as
    "q=elasticsearch".

    The `?` is excluded from the query string. If a URL contains no `?`, there is
    no query field. If there is a `?` but no query, the query field exists with an
    empty string. The `exists` query can be used to differentiate between the two
    cases.'
  flat_name: url.query
  ignore_above: 1024
  level: extended
  name: query
  normalize: []
  short: Query string of the request.
  type: keyword
url.registered_domain:
  dashed_name: url-registered-domain
  description: 'The highest registered url domain, stripped of the subdomain.

    For example, the registered domain for "foo.example.com" is "example.com".

    This value can be determined precisely with a list like the public suffix list
    (http://publicsuffix.org). Trying to approximate this by simply taking the last
    two labels will not work well for TLDs such as "co.uk".'
  example: example.com
  flat_name: url.registered_domain
  ignore_above: 1024
  level: extended
  name: registered_domain
  normalize: []
  short: The highest registered url domain, stripped of the subdomain.
  type: keyword
url.scheme:
  dashed_name: url-scheme
  description: 'Scheme of the request, such as "https".

    Note: The `:` is not part of the scheme.'
  example: https
  flat_name: url.scheme
  ignore_above: 1024
  level: extended
  name: scheme
  normalize: []
  short: Scheme of the url.
  type: keyword
url.subdomain:
  dashed_name: url-subdomain
  description: 'The subdomain portion of a fully qualified domain name includes all
    of the names except the host name under the registered_domain.  In a partially
    qualified domain, or if the the qualification level of the full name cannot be
    determined, subdomain contains all of the names below the registered domain.

    For example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the
    domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the
    subdomain field should contain "sub2.sub1", with no trailing period.'
  example: east
  flat_name: url.subdomain
  ignore_above: 1024
  level: extended
  name: subdomain
  normalize: []
  short: The subdomain of the domain.
  type: keyword
url.top_level_domain:
  dashed_name: url-top-level-domain
  description: 'The effective top level domain (eTLD), also known as the domain suffix,
    is the last part of the domain name. For example, the top level domain for example.com
    is "com".

    This value can be determined precisely with a list like the public suffix list
    (http://publicsuffix.org). Trying to approximate this by simply taking the last
    label will not work well for effective TLDs such as "co.uk".'
  example: co.uk
  flat_name: url.top_level_domain
  ignore_above: 1024
  level: extended
  name: top_level_domain
  normalize: []
  short: The effective top level domain (com, org, net, co.uk).
  type: keyword
url.username:
  dashed_name: url-username
  description: Username of the request.
  flat_name: url.username
  ignore_above: 1024
  level: extended
  name: username
  normalize: []
  short: Username of the request.
  type: keyword
user.name:
  dashed_name: user-name
  description: Short name or login of the user.
  example: a.einstein
  flat_name: user.name
  ignore_above: 1024
  level: core
  multi_fields:
  - flat_name: user.name.text
    name: text
    type: match_only_text
  name: name
  normalize: []
  short: Short name or login of the user.
  type: keyword
user_agent.device.name:
  dashed_name: user-agent-device-name
  description: Name of the device.
  example: iPhone
  flat_name: user_agent.device.name
  ignore_above: 1024
  level: extended
  name: device.name
  normalize: []
  short: Name of the device.
  type: keyword
user_agent.name:
  dashed_name: user-agent-name
  description: Name of the user agent.
  example: Safari
  flat_name: user_agent.name
  ignore_above: 1024
  level: extended
  name: name
  normalize: []
  short: Name of the user agent.
  type: keyword
user_agent.original:
  dashed_name: user-agent-original
  description: Unparsed user_agent string.
  example: Mozilla/5.0 (iPhone; CPU iPhone OS 12_1 like Mac OS X) AppleWebKit/605.1.15
    (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1
  flat_name: user_agent.original
  ignore_above: 1024
  level: extended
  multi_fields:
  - flat_name: user_agent.original.text
    name: text
    type: match_only_text
  name: original
  normalize: []
  short: Unparsed user_agent string.
  type: keyword
user_agent.os.family:
  dashed_name: user-agent-os-family
  description: OS family (such as redhat, debian, freebsd, windows).
  example: debian
  flat_name: user_agent.os.family
  ignore_above: 1024
  level: extended
  name: family
  normalize: []
  original_fieldset: os
  short: OS family (such as redhat, debian, freebsd, windows).
  type: keyword
user_agent.os.full:
  dashed_name: user-agent-os-full
  description: Operating system name, including the version or code name.
  example: Mac OS Mojave
  flat_name: user_agent.os.full
  ignore_above: 1024
  level: extended
  multi_fields:
  - flat_name: user_agent.os.full.text
    name: text
    type: match_only_text
  name: full
  normalize: []
  original_fieldset: os
  short: Operating system name, including the version or code name.
  type: keyword
user_agent.os.kernel:
  dashed_name: user-agent-os-kernel
  description: Operating system kernel version as a raw string.
  example: 4.4.0-112-generic
  flat_name: user_agent.os.kernel
  ignore_above: 1024
  level: extended
  name: kernel
  normalize: []
  original_fieldset: os
  short: Operating system kernel version as a raw string.
  type: keyword
user_agent.os.name:
  dashed_name: user-agent-os-name
  description: Operating system name, without the version.
  example: Mac OS X
  flat_name: user_agent.os.name
  ignore_above: 1024
  level: extended
  multi_fields:
  - flat_name: user_agent.os.name.text
    name: text
    type: match_only_text
  name: name
  normalize: []
  original_fieldset: os
  short: Operating system name, without the version.
  type: keyword
user_agent.os.platform:
  dashed_name: user-agent-os-platform
  description: Operating system platform (such centos, ubuntu, windows).
  example: darwin
  flat_name: user_agent.os.platform
  ignore_above: 1024
  level: extended
  name: platform
  normalize: []
  original_fieldset: os
  short: Operating system platform (such centos, ubuntu, windows).
  type: keyword
user_agent.os.type:
  dashed_name: user-agent-os-type
  description: 'Use the `os.type` field to categorize the operating system into one
    of the broad commercial families.

    One of these following values should be used (lowercase): linux, macos, unix,
    windows.

    If the OS you''re dealing with is not in the list, the field should not be populated.
    Please let us know by opening an issue with ECS, to propose its addition.'
  example: macos
  flat_name: user_agent.os.type
  ignore_above: 1024
  level: extended
  name: type
  normalize: []
  original_fieldset: os
  short: 'Which commercial OS family (one of: linux, macos, unix or windows).'
  type: keyword
user_agent.os.version:
  dashed_name: user-agent-os-version
  description: Operating system version as a raw string.
  example: 10.14.1
  flat_name: user_agent.os.version
  ignore_above: 1024
  level: extended
  name: version
  normalize: []
  original_fieldset: os
  short: Operating system version as a raw string.
  type: keyword
user_agent.version:
  dashed_name: user-agent-version
  description: Version of the user agent.
  example: 12.0
  flat_name: user_agent.version
  ignore_above: 1024
  level: extended
  name: version
  normalize: []
  short: Version of the user agent.
  type: keyword