Usage of brackets for a URL containing IPv6 address

CHANGELOG.next.md

@@ -22,6 +22,8 @@ Thanks, you're awesome :-) -->
 
 #### Improvements
 
+* Note `[` and `]` bracket characters may enclose a literal IPv6 address when populating `url.domain`. #1131
+
 #### Deprecated
 
 ### Tooling and Artifact Changes

docs/field-details.asciidoc

@@ -6236,6 +6236,8 @@ URL fields provide support for complete or partial URLs, and supports the breaki
 
 In some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `domain` field.
 
+If the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732), the `[` and `]` characters should also be captured in the `domain` field.
+
 type: keyword
 
 

experimental/generated/beats/fields.ecs.yml

@@ -5262,7 +5262,11 @@
       description: 'Domain of the url, such as "www.elastic.co".
 
         In some cases a URL may refer to an IP and/or port directly, without a domain
-        name. In this case, the IP address would go to the `domain` field.'
+        name. In this case, the IP address would go to the `domain` field.
+
+        If the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC
+        2732), the `[` and `]` characters should also be captured in the `domain`
+        field.'
       example: www.elastic.co
     - name: extension
       level: extended

experimental/generated/ecs/ecs_flat.yml

@@ -8027,7 +8027,10 @@ url.domain:
   description: 'Domain of the url, such as "www.elastic.co".
 
     In some cases a URL may refer to an IP and/or port directly, without a domain
-    name. In this case, the IP address would go to the `domain` field.'
+    name. In this case, the IP address would go to the `domain` field.
+
+    If the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732),
+    the `[` and `]` characters should also be captured in the `domain` field.'
   example: www.elastic.co
   flat_name: url.domain
   level: extended

experimental/generated/ecs/ecs_nested.yml

@@ -9291,7 +9291,11 @@ url:
       description: 'Domain of the url, such as "www.elastic.co".
 
         In some cases a URL may refer to an IP and/or port directly, without a domain
-        name. In this case, the IP address would go to the `domain` field.'
+        name. In this case, the IP address would go to the `domain` field.
+
+        If the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC
+        2732), the `[` and `]` characters should also be captured in the `domain`
+        field.'
       example: www.elastic.co
       flat_name: url.domain
       level: extended

generated/beats/fields.ecs.yml

@@ -5350,7 +5350,11 @@
       description: 'Domain of the url, such as "www.elastic.co".
 
         In some cases a URL may refer to an IP and/or port directly, without a domain
-        name. In this case, the IP address would go to the `domain` field.'
+        name. In this case, the IP address would go to the `domain` field.
+
+        If the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC
+        2732), the `[` and `]` characters should also be captured in the `domain`
+        field.'
       example: www.elastic.co
     - name: extension
       level: extended

generated/ecs/ecs_flat.yml

@@ -8110,7 +8110,10 @@ url.domain:
   description: 'Domain of the url, such as "www.elastic.co".
 
     In some cases a URL may refer to an IP and/or port directly, without a domain
-    name. In this case, the IP address would go to the `domain` field.'
+    name. In this case, the IP address would go to the `domain` field.
+
+    If the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732),
+    the `[` and `]` characters should also be captured in the `domain` field.'
   example: www.elastic.co
   flat_name: url.domain
   ignore_above: 1024

generated/ecs/ecs_nested.yml

@@ -9379,7 +9379,11 @@ url:
       description: 'Domain of the url, such as "www.elastic.co".
 
         In some cases a URL may refer to an IP and/or port directly, without a domain
-        name. In this case, the IP address would go to the `domain` field.'
+        name. In this case, the IP address would go to the `domain` field.
+
+        If the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC
+        2732), the `[` and `]` characters should also be captured in the `domain`
+        field.'
       example: www.elastic.co
       flat_name: url.domain
       ignore_above: 1024

schemas/url.yml

@@ -58,6 +58,9 @@
 
         In some cases a URL may refer to an IP and/or port directly, without a
         domain name. In this case, the IP address would go to the `domain` field.
+
+        If the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732),
+        the `[` and `]` characters should also be captured in the `domain` field.
       example: www.elastic.co
 
     - name: registered_domain