Add agent.build for extended agent version information (#764)

* Add agent.build for extended agent version information

* Add changelog entry

* rename field to build.original

* re-run code generation

* Add short field and additional line about formatting

CHANGELOG.next.md

@@ -22,6 +22,7 @@ Thanks, you're awesome :-) -->
 
 * Added `search.*` fields #729
 * Add architecture and imphash for PE field set. (#763)
+* Added `agent.build.*` for extended agent version information. (#764)
 
 #### Improvements
 

docs/field-details.asciidoc

@@ -98,6 +98,21 @@ Examples include Beats. Agents may also run on observers. ECS agent.* fields sha
 
 // ===============================================================
 
+| agent.build.original
+| Extended build information for the agent.
+
+This field is intended to contain any build information that a data source may provide, no specific formatting is required.
+
+type: keyword
+
+
+
+example: `metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]`
+
+| core
+
+// ===============================================================
+
 | agent.ephemeral_id
 | Ephemeral identifier of this agent (if one exists).
 

generated/beats/fields.ecs.yml

@@ -64,6 +64,17 @@
       systems such as Logstash or APM Server.'
     type: group
     fields:
+    - name: build.original
+      level: core
+      type: keyword
+      ignore_above: 1024
+      description: 'Extended build information for the agent.
+
+        This field is intended to contain any build information that a data source
+        may provide, no specific formatting is required.'
+      example: metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c
+        built 2020-02-05 23:10:10 +0000 UTC]
+      default_field: false
     - name: ephemeral_id
       level: extended
       type: keyword

generated/csv/fields.csv

@@ -3,6 +3,7 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description
 1.6.0-dev,true,base,labels,object,core,,"{""application"": ""foo-bar"", ""env"": ""production""}",Custom key/value pairs.
 1.6.0-dev,true,base,message,text,core,,Hello World,Log message optimized for viewing in a log viewer.
 1.6.0-dev,true,base,tags,keyword,core,array,"[""production"", ""env2""]",List of keywords used to tag each event.
+1.6.0-dev,true,agent,agent.build.original,keyword,core,,"metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]",Extended build information for the agent.
 1.6.0-dev,true,agent,agent.ephemeral_id,keyword,extended,,8a4f500f,Ephemeral identifier of this agent.
 1.6.0-dev,true,agent,agent.id,keyword,core,,8a4f500d,Unique identifier of this agent.
 1.6.0-dev,true,agent,agent.name,keyword,core,,foo,Custom name of the agent.

generated/ecs/ecs_flat.yml

@@ -18,6 +18,22 @@
   required: true
   short: Date/time when the event originated.
   type: date
+agent.build.original:
+  dashed_name: agent-build-original
+  description: 'Extended build information for the agent.
+
+    This field is intended to contain any build information that a data source may
+    provide, no specific formatting is required.'
+  example: metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c
+    built 2020-02-05 23:10:10 +0000 UTC]
+  flat_name: agent.build.original
+  ignore_above: 1024
+  level: core
+  name: build.original
+  normalize: []
+  order: 1
+  short: Extended build information for the agent.
+  type: keyword
 agent.ephemeral_id:
   dashed_name: agent-ephemeral-id
   description: 'Ephemeral identifier of this agent (if one exists).
@@ -29,7 +45,7 @@ agent.ephemeral_id:
   level: extended
   name: ephemeral_id
   normalize: []
-  order: 4
+  order: 5
   short: Ephemeral identifier of this agent.
   type: keyword
 agent.id:
@@ -43,7 +59,7 @@ agent.id:
   level: core
   name: id
   normalize: []
-  order: 3
+  order: 4
   short: Unique identifier of this agent.
   type: keyword
 agent.name:
@@ -61,7 +77,7 @@ agent.name:
   level: core
   name: name
   normalize: []
-  order: 1
+  order: 2
   short: Custom name of the agent.
   type: keyword
 agent.type:
@@ -77,7 +93,7 @@ agent.type:
   level: core
   name: type
   normalize: []
-  order: 2
+  order: 3
   short: Type of the agent.
   type: keyword
 agent.version:

generated/ecs/ecs_nested.yml

@@ -7,6 +7,22 @@ agent:
     be populated with details of the agent running on the host or observer where the
     event happened or the measurement was taken.'
   fields:
+    build.original:
+      dashed_name: agent-build-original
+      description: 'Extended build information for the agent.
+
+        This field is intended to contain any build information that a data source
+        may provide, no specific formatting is required.'
+      example: metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c
+        built 2020-02-05 23:10:10 +0000 UTC]
+      flat_name: agent.build.original
+      ignore_above: 1024
+      level: core
+      name: build.original
+      normalize: []
+      order: 1
+      short: Extended build information for the agent.
+      type: keyword
     ephemeral_id:
       dashed_name: agent-ephemeral-id
       description: 'Ephemeral identifier of this agent (if one exists).
@@ -18,7 +34,7 @@ agent:
       level: extended
       name: ephemeral_id
       normalize: []
-      order: 4
+      order: 5
       short: Ephemeral identifier of this agent.
       type: keyword
     id:
@@ -32,7 +48,7 @@ agent:
       level: core
       name: id
       normalize: []
-      order: 3
+      order: 4
       short: Unique identifier of this agent.
       type: keyword
     name:
@@ -50,7 +66,7 @@ agent:
       level: core
       name: name
       normalize: []
-      order: 1
+      order: 2
       short: Custom name of the agent.
       type: keyword
     type:
@@ -66,7 +82,7 @@ agent:
       level: core
       name: type
       normalize: []
-      order: 2
+      order: 3
       short: Type of the agent.
       type: keyword
     version:

generated/elasticsearch/6/template.json

@@ -25,6 +25,14 @@
         },
         "agent": {
           "properties": {
+            "build": {
+              "properties": {
+                "original": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
             "ephemeral_id": {
               "ignore_above": 1024,
               "type": "keyword"

generated/elasticsearch/7/template.json

@@ -24,6 +24,14 @@
       },
       "agent": {
         "properties": {
+          "build": {
+            "properties": {
+              "original": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              }
+            }
+          },
           "ephemeral_id": {
             "ignore_above": 1024,
             "type": "keyword"

schemas/agent.yml

@@ -14,7 +14,6 @@
     such as Logstash or APM Server.
   type: group
   fields:
-
     - name: version
       level: core
       type: keyword
@@ -23,6 +22,17 @@
 
       example: 6.0.0-rc2
 
+    - name: build.original
+      level: core
+      type: keyword
+      short: Extended build information for the agent.
+      description: >
+        Extended build information for the agent.
+
+        This field is intended to contain any build information that a data source
+        may provide, no specific formatting is required.
+      example: metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]
+
     - name: name
       level: core
       type: keyword