Remove deprecated host.user.* fields

CHANGELOG.next.md

@@ -12,6 +12,7 @@ Thanks, you're awesome :-) -->
 
 * Removing deprecated --oss from generator #1404
 * Removing use-cases directory #1405
+* Remove `host.user.*` field reuse. #1439
 
 ### Schema Changes
 

docs/field-details.asciidoc

@@ -4141,13 +4141,6 @@ example: `1325`
 // ===============================================================
 
 
-| <<ecs-user,user>>
-| `host.user.*`
-| This reuse is deprecated and will be removed in the next major ECS version.
-
-// ===============================================================
-
-
 |=====
 
 [[ecs-http]]
@@ -8765,7 +8758,7 @@ example: `["kibana_admin", "reporting_user"]`
 [discrete]
 ==== Field Reuse
 
-The `user` fields are expected to be nested at: `client.user`, `destination.user`, `host.user`, `server.user`, `source.user`, `user.changes`, `user.effective`, `user.target`.
+The `user` fields are expected to be nested at: `client.user`, `destination.user`, `server.user`, `source.user`, `user.changes`, `user.effective`, `user.target`.
 
 Note also that the `user` fields may be used directly at the root of the events.
 

docs/usage/user.asciidoc

@@ -18,8 +18,6 @@ Here are the subjects covered in this page.
 
 * <<ecs-user-usage-mappings>>
 
-* <<ecs-user-usage-deprecations>>
-
 [discrete]
 [[ecs-user-usage-categorization]]
 ===== Categorization
@@ -113,7 +111,6 @@ Here's the full list of places where the user fields can appear:
 * `destination.user.*`
 * `client.user.*`
 * `server.user.*`
-* `host.user.*` (<<ecs-user-usage-deprecations,deprecated>>)
 
 Let's go over the meaning of each.
 
@@ -421,10 +418,3 @@ it's the creation / rename of the user, or events where this user was active in
 
 For examples of mapping events from various sources, you can look at
 https://github.com/elastic/ecs/blob/master/rfcs/text/0007-multiple-users.md#source-data[RFC 0007 in section Source Data].
-
-[discrete]
-[[ecs-user-usage-deprecations]]
-===== Deprecations
-
-As of ECS 1.8, `host.user.*` fields are deprecated and will be removed at the next
-major version of ECS.

experimental/generated/beats/fields.ecs.yml

@@ -3309,75 +3309,6 @@
       type: long
       description: Seconds the host has been up.
       example: 1325
-    - name: user.domain
-      level: extended
-      type: keyword
-      ignore_above: 1024
-      description: 'Name of the directory the user is a member of.
-
-        For example, an LDAP or Active Directory domain name.'
-    - name: user.email
-      level: extended
-      type: wildcard
-      description: User email address.
-    - name: user.full_name
-      level: extended
-      type: wildcard
-      multi_fields:
-      - name: text
-        type: text
-        norms: false
-        default_field: false
-      description: User's full name, if available.
-      example: Albert Einstein
-    - name: user.group.domain
-      level: extended
-      type: keyword
-      ignore_above: 1024
-      description: 'Name of the directory the group is a member of.
-
-        For example, an LDAP or Active Directory domain name.'
-    - name: user.group.id
-      level: extended
-      type: keyword
-      ignore_above: 1024
-      description: Unique identifier for the group on the system/platform.
-    - name: user.group.name
-      level: extended
-      type: keyword
-      ignore_above: 1024
-      description: Name of the group.
-    - name: user.hash
-      level: extended
-      type: keyword
-      ignore_above: 1024
-      description: 'Unique user hash to correlate information for a user in anonymized
-        form.
-
-        Useful if `user.id` or `user.name` contain confidential information and cannot
-        be used.'
-    - name: user.id
-      level: core
-      type: keyword
-      ignore_above: 1024
-      description: Unique identifier of the user.
-    - name: user.name
-      level: core
-      type: wildcard
-      multi_fields:
-      - name: text
-        type: text
-        norms: false
-        default_field: false
-      description: Short name or login of the user.
-      example: albert
-    - name: user.roles
-      level: extended
-      type: keyword
-      ignore_above: 1024
-      description: Array of user roles at the time of the event.
-      example: '["kibana_admin", "reporting_user"]'
-      default_field: false
   - name: http
     title: HTTP
     group: 2

experimental/generated/csv/fields.csv

@@ -372,18 +372,6 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description
 2.0.0-dev+exp,true,host,host.os.version,keyword,extended,,10.14.1,Operating system version as a raw string.
 2.0.0-dev+exp,true,host,host.type,keyword,core,,,Type of host.
 2.0.0-dev+exp,true,host,host.uptime,long,extended,,1325,Seconds the host has been up.
-2.0.0-dev+exp,true,host,host.user.domain,keyword,extended,,,Name of the directory the user is a member of.
-2.0.0-dev+exp,true,host,host.user.email,wildcard,extended,,,User email address.
-2.0.0-dev+exp,true,host,host.user.full_name,wildcard,extended,,Albert Einstein,"User's full name, if available."
-2.0.0-dev+exp,true,host,host.user.full_name.text,text,extended,,Albert Einstein,"User's full name, if available."
-2.0.0-dev+exp,true,host,host.user.group.domain,keyword,extended,,,Name of the directory the group is a member of.
-2.0.0-dev+exp,true,host,host.user.group.id,keyword,extended,,,Unique identifier for the group on the system/platform.
-2.0.0-dev+exp,true,host,host.user.group.name,keyword,extended,,,Name of the group.
-2.0.0-dev+exp,true,host,host.user.hash,keyword,extended,,,Unique user hash to correlate information for a user in anonymized form.
-2.0.0-dev+exp,true,host,host.user.id,keyword,core,,,Unique identifier of the user.
-2.0.0-dev+exp,true,host,host.user.name,wildcard,core,,albert,Short name or login of the user.
-2.0.0-dev+exp,true,host,host.user.name.text,text,core,,albert,Short name or login of the user.
-2.0.0-dev+exp,true,host,host.user.roles,keyword,extended,array,"[""kibana_admin"", ""reporting_user""]",Array of user roles at the time of the event.
 2.0.0-dev+exp,true,http,http.request.body.bytes,long,extended,,887,Size in bytes of the request body.
 2.0.0-dev+exp,true,http,http.request.body.content,wildcard,extended,,Hello world,The full HTTP request body.
 2.0.0-dev+exp,true,http,http.request.body.content.text,text,extended,,Hello world,The full HTTP request body.

experimental/generated/ecs/ecs_flat.yml

@@ -4900,135 +4900,6 @@ host.uptime:
   normalize: []
   short: Seconds the host has been up.
   type: long
-host.user.domain:
-  dashed_name: host-user-domain
-  description: 'Name of the directory the user is a member of.
-
-    For example, an LDAP or Active Directory domain name.'
-  flat_name: host.user.domain
-  ignore_above: 1024
-  level: extended
-  name: domain
-  normalize: []
-  original_fieldset: user
-  short: Name of the directory the user is a member of.
-  type: keyword
-host.user.email:
-  dashed_name: host-user-email
-  description: User email address.
-  flat_name: host.user.email
-  level: extended
-  name: email
-  normalize: []
-  original_fieldset: user
-  short: User email address.
-  type: wildcard
-host.user.full_name:
-  dashed_name: host-user-full-name
-  description: User's full name, if available.
-  example: Albert Einstein
-  flat_name: host.user.full_name
-  level: extended
-  multi_fields:
-  - flat_name: host.user.full_name.text
-    name: text
-    norms: false
-    type: text
-  name: full_name
-  normalize: []
-  original_fieldset: user
-  short: User's full name, if available.
-  type: wildcard
-host.user.group.domain:
-  dashed_name: host-user-group-domain
-  description: 'Name of the directory the group is a member of.
-
-    For example, an LDAP or Active Directory domain name.'
-  flat_name: host.user.group.domain
-  ignore_above: 1024
-  level: extended
-  name: domain
-  normalize: []
-  original_fieldset: group
-  short: Name of the directory the group is a member of.
-  type: keyword
-host.user.group.id:
-  dashed_name: host-user-group-id
-  description: Unique identifier for the group on the system/platform.
-  flat_name: host.user.group.id
-  ignore_above: 1024
-  level: extended
-  name: id
-  normalize: []
-  original_fieldset: group
-  short: Unique identifier for the group on the system/platform.
-  type: keyword
-host.user.group.name:
-  dashed_name: host-user-group-name
-  description: Name of the group.
-  flat_name: host.user.group.name
-  ignore_above: 1024
-  level: extended
-  name: name
-  normalize: []
-  original_fieldset: group
-  short: Name of the group.
-  type: keyword
-host.user.hash:
-  dashed_name: host-user-hash
-  description: 'Unique user hash to correlate information for a user in anonymized
-    form.
-
-    Useful if `user.id` or `user.name` contain confidential information and cannot
-    be used.'
-  flat_name: host.user.hash
-  ignore_above: 1024
-  level: extended
-  name: hash
-  normalize: []
-  original_fieldset: user
-  short: Unique user hash to correlate information for a user in anonymized form.
-  type: keyword
-host.user.id:
-  dashed_name: host-user-id
-  description: Unique identifier of the user.
-  flat_name: host.user.id
-  ignore_above: 1024
-  level: core
-  name: id
-  normalize: []
-  original_fieldset: user
-  short: Unique identifier of the user.
-  type: keyword
-host.user.name:
-  dashed_name: host-user-name
-  description: Short name or login of the user.
-  example: albert
-  flat_name: host.user.name
-  level: core
-  multi_fields:
-  - flat_name: host.user.name.text
-    name: text
-    norms: false
-    type: text
-  name: name
-  normalize: []
-  original_fieldset: user
-  short: Short name or login of the user.
-  type: wildcard
-host.user.roles:
-  dashed_name: host-user-roles
-  description: Array of user roles at the time of the event.
-  example: '["kibana_admin", "reporting_user"]'
-  flat_name: host.user.roles
-  ignore_above: 1024
-  level: extended
-  name: roles
-  normalize:
-  - array
-  original_fieldset: user
-  short: Array of user roles at the time of the event.
-  type: keyword
 http.request.body.bytes:
   dashed_name: http-request-body-bytes
   description: Size in bytes of the request body.