Make group field set extended for now

README.md

@@ -258,8 +258,8 @@ The group fields are meant to represent groups that are relevant to the event.
 
 | Field  | Description  | Level  | Type  | Example  |
 |---|---|---|---|---|
-| <a name="group.id"></a>group.id | Unique identifier for the group on the system/platform. | core | keyword |  |
-| <a name="group.name"></a>group.name | Name of the group. | core | keyword |  |
+| <a name="group.id"></a>group.id | Unique identifier for the group on the system/platform. | extended | keyword |  |
+| <a name="group.name"></a>group.name | Name of the group. | extended | keyword |  |
 
 
 ## <a name="host"></a> Host fields

fields.yml

@@ -670,13 +670,13 @@
       fields:
 
         - name: id
-          level: core
+          level: extended
           type: keyword
           description: >
             Unique identifier for the group on the system/platform.
     
         - name: name
-          level: core
+          level: extended
           type: keyword
           description: >
             Name of the group.

schema.csv

@@ -70,8 +70,8 @@ geo.continent_name,keyword,core,North America
 geo.country_iso_code,keyword,core,CA
 geo.location,geo_point,core,"{ ""lon"": -73.614830, ""lat"": 45.505918 }"
 geo.region_name,keyword,core,Quebec
-group.id,keyword,core,
-group.name,keyword,core,
+group.id,keyword,extended,
+group.name,keyword,extended,
 host.architecture,keyword,core,x86_64
 host.hostname,keyword,core,
 host.id,keyword,core,

schemas/group.yml

@@ -9,13 +9,13 @@
   fields:
 
     - name: id
-      level: core
+      level: extended
       type: keyword
       description: >
         Unique identifier for the group on the system/platform.
 
     - name: name
-      level: core
+      level: extended
       type: keyword
       description: >
         Name of the group.