as:
  field_details:
    dashed_name: as
    description: An autonomous system (AS) is a collection of connected Internet Protocol
      (IP) routing prefixes under the control of one or more network operators on
      behalf of a single administrative entity or domain that presents a common, clearly
      defined routing policy to the internet.
    flat_name: as
    name: as
    node_name: as
    short: Fields describing an Autonomous System (Internet routing prefix).
    type: group
  fields:
    number:
      field_details:
        dashed_name: as-number
        description: Unique number allocated to the autonomous system. The autonomous
          system number (ASN) uniquely identifies each network on the Internet.
        example: 15169
        flat_name: as.number
        level: extended
        name: number
        node_name: number
        normalize: []
        short: Unique number allocated to the autonomous system.
        type: long
    organization:
      field_details:
        dashed_name: as-organization
        flat_name: as.organization
        intermediate: true
        name: organization
        node_name: organization
        type: object
      fields:
        name:
          field_details:
            dashed_name: as-organization-name
            description: Organization name.
            example: Google LLC
            flat_name: as.organization.name
            ignore_above: 1024
            level: extended
            multi_fields:
            - flat_name: as.organization.name.text
              name: text
              norms: false
              type: text
            name: organization.name
            node_name: name
            normalize: []
            short: Organization name.
            type: keyword
  schema_details:
    group: 2
    prefix: as.
    reusable:
      expected:
      - as: as
        at: client
        full: client.as
      - as: as
        at: destination
        full: destination.as
      - as: as
        at: server
        full: server.as
      - as: as
        at: source
        full: source.as
      - as: as
        at: threat.indicator
        beta: Reusing the `as` fields in this location is currently considered beta.
        full: threat.indicator.as
      - as: as
        at: threat.enrichments.indicator
        beta: Reusing the `as` fields in this location is currently considered beta.
        full: threat.enrichments.indicator.as
      order: 2
      top_level: false
    root: false
    title: Autonomous System
base:
  field_details:
    dashed_name: base
    description: The `base` field set contains all fields which are at the root of
      the events. These fields are common across all types of events.
    flat_name: base
    name: base
    node_name: base
    short: All fields defined directly at the root of the events.
    type: group
  fields:
    '@timestamp':
      field_details:
        dashed_name: timestamp
        description: 'Date/time when the event originated.

          This is the date/time extracted from the event, typically representing when
          the event was generated by the source.

          If the event source has no original timestamp, this value is typically populated
          by the first time the event was received by the pipeline.

          Required field for all events.'
        example: '2016-05-23T08:05:34.853Z'
        flat_name: '@timestamp'
        level: core
        name: '@timestamp'
        node_name: '@timestamp'
        normalize: []
        required: true
        short: Date/time when the event originated.
        type: date
    labels:
      field_details:
        dashed_name: labels
        description: 'Custom key/value pairs.

          Can be used to add meta information to events. Should not contain nested
          objects. All values are stored as keyword.

          Example: `docker` and `k8s` labels.'
        example: '{"application": "foo-bar", "env": "production"}'
        flat_name: labels
        level: core
        name: labels
        node_name: labels
        normalize: []
        object_type: keyword
        short: Custom key/value pairs.
        type: object
    message:
      field_details:
        dashed_name: message
        description: 'For log events the message field contains the log message, optimized
          for viewing in a log viewer.

          For structured logs without an original message field, other fields can
          be concatenated to form a human-readable summary of the event.

          If multiple messages exist, they can be combined into one message.'
        example: Hello World
        flat_name: message
        level: core
        name: message
        node_name: message
        normalize: []
        norms: false
        short: Log message optimized for viewing in a log viewer.
        type: text
    tags:
      field_details:
        dashed_name: tags
        description: List of keywords used to tag each event.
        example: '["production", "env2"]'
        flat_name: tags
        ignore_above: 1024
        level: core
        name: tags
        node_name: tags
        normalize:
        - array
        short: List of keywords used to tag each event.
        type: keyword
  schema_details:
    group: 1
    prefix: ''
    root: true
    title: Base
client:
  field_details:
    dashed_name: client
    description: 'A client is defined as the initiator of a network connection for
      events regarding sessions, connections, or bidirectional flow records.

      For TCP events, the client is the initiator of the TCP connection that sends
      the SYN packet(s). For other protocols, the client is generally the initiator
      or requestor in the network transaction. Some systems use the term "originator"
      to refer the client in TCP connections. The client fields describe details about
      the system acting as the client in the network event. Client fields are usually
      populated in conjunction with server fields. Client fields are generally not
      populated for packet-level events.

      Client / server representations can add semantic context to an exchange, which
      is helpful to visualize the data in certain situations. If your context falls
      in that category, you should still ensure that source and destination are filled
      appropriately.'
    flat_name: client
    name: client
    node_name: client
    short: Fields about the client side of a network connection, used with server.
    type: group
  fields:
    address:
      field_details:
        dashed_name: client-address
        description: 'Some event client addresses are defined ambiguously. The event
          will sometimes list an IP, a domain or a unix socket.  You should always
          store the raw address in the `.address` field.

          Then it should be duplicated to `.ip` or `.domain`, depending on which one
          it is.'
        flat_name: client.address
        ignore_above: 1024
        level: extended
        name: address
        node_name: address
        normalize: []
        short: Client network address.
        type: keyword
    as:
      field_details:
        dashed_name: client-as
        description: An autonomous system (AS) is a collection of connected Internet
          Protocol (IP) routing prefixes under the control of one or more network
          operators on behalf of a single administrative entity or domain that presents
          a common, clearly defined routing policy to the internet.
        flat_name: client.as
        intermediate: true
        name: as
        node_name: as
        original_fieldset: as
        short: Fields describing an Autonomous System (Internet routing prefix).
        type: group
      fields:
        number:
          field_details:
            dashed_name: client-as-number
            description: Unique number allocated to the autonomous system. The autonomous
              system number (ASN) uniquely identifies each network on the Internet.
            example: 15169
            flat_name: client.as.number
            level: extended
            name: number
            node_name: number
            normalize: []
            original_fieldset: as
            short: Unique number allocated to the autonomous system.
            type: long
        organization:
          field_details:
            dashed_name: client-as-organization
            flat_name: client.as.organization
            intermediate: true
            name: organization
            node_name: organization
            original_fieldset: as
            type: object
          fields:
            name:
              field_details:
                dashed_name: client-as-organization-name
                description: Organization name.
                example: Google LLC
                flat_name: client.as.organization.name
                ignore_above: 1024
                level: extended
                multi_fields:
                - flat_name: client.as.organization.name.text
                  name: text
                  norms: false
                  type: text
                name: organization.name
                node_name: name
                normalize: []
                original_fieldset: as
                short: Organization name.
                type: keyword
    bytes:
      field_details:
        dashed_name: client-bytes
        description: Bytes sent from the client to the server.
        example: 184
        flat_name: client.bytes
        format: bytes
        level: core
        name: bytes
        node_name: bytes
        normalize: []
        short: Bytes sent from the client to the server.
        type: long
    domain:
      field_details:
        dashed_name: client-domain
        description: Client domain.
        flat_name: client.domain
        ignore_above: 1024
        level: core
        name: domain
        node_name: domain
        normalize: []
        short: Client domain.
        type: keyword
    geo:
      field_details:
        dashed_name: client-geo
        description: 'Geo fields can carry data about a specific location related
          to an event.

          This geolocation information can be derived from techniques such as Geo
          IP, or be user-supplied.'
        flat_name: client.geo
        intermediate: true
        name: geo
        node_name: geo
        original_fieldset: geo
        short: Fields describing a location.
        type: group
      fields:
        city_name:
          field_details:
            dashed_name: client-geo-city-name
            description: City name.
            example: Montreal
            flat_name: client.geo.city_name
            ignore_above: 1024
            level: core
            name: city_name
            node_name: city_name
            normalize: []
            original_fieldset: geo
            short: City name.
            type: keyword
        continent_code:
          field_details:
            dashed_name: client-geo-continent-code
            description: Two-letter code representing continent's name.
            example: NA
            flat_name: client.geo.continent_code
            ignore_above: 1024
            level: core
            name: continent_code
            node_name: continent_code
            normalize: []
            original_fieldset: geo
            short: Continent code.
            type: keyword
        continent_name:
          field_details:
            dashed_name: client-geo-continent-name
            description: Name of the continent.
            example: North America
            flat_name: client.geo.continent_name
            ignore_above: 1024
            level: core
            name: continent_name
            node_name: continent_name
            normalize: []
            original_fieldset: geo
            short: Name of the continent.
            type: keyword
        country_iso_code:
          field_details:
            dashed_name: client-geo-country-iso-code
            description: Country ISO code.
            example: CA
            flat_name: client.geo.country_iso_code
            ignore_above: 1024
            level: core
            name: country_iso_code
            node_name: country_iso_code
            normalize: []
            original_fieldset: geo
            short: Country ISO code.
            type: keyword
        country_name:
          field_details:
            dashed_name: client-geo-country-name
            description: Country name.
            example: Canada
            flat_name: client.geo.country_name
            ignore_above: 1024
            level: core
            name: country_name
            node_name: country_name
            normalize: []
            original_fieldset: geo
            short: Country name.
            type: keyword
        location:
          field_details:
            dashed_name: client-geo-location
            description: Longitude and latitude.
            example: '{ "lon": -73.614830, "lat": 45.505918 }'
            flat_name: client.geo.location
            level: core
            name: location
            node_name: location
            normalize: []
            original_fieldset: geo
            short: Longitude and latitude.
            type: geo_point
        name:
          field_details:
            dashed_name: client-geo-name
            description: 'User-defined description of a location, at the level of
              granularity they care about.

              Could be the name of their data centers, the floor number, if this describes
              a local physical entity, city names.

              Not typically used in automated geolocation.'
            example: boston-dc
            flat_name: client.geo.name
            ignore_above: 1024
            level: extended
            name: name
            node_name: name
            normalize: []
            original_fieldset: geo
            short: User-defined description of a location.
            type: keyword
        postal_code:
          field_details:
            dashed_name: client-geo-postal-code
            description: 'Postal code associated with the location.

              Values appropriate for this field may also be known as a postcode or
              ZIP code and will vary widely from country to country.'
            example: 94040
            flat_name: client.geo.postal_code
            ignore_above: 1024
            level: core
            name: postal_code
            node_name: postal_code
            normalize: []
            original_fieldset: geo
            short: Postal code.
            type: keyword
        region_iso_code:
          field_details:
            dashed_name: client-geo-region-iso-code
            description: Region ISO code.
            example: CA-QC
            flat_name: client.geo.region_iso_code
            ignore_above: 1024
            level: core
            name: region_iso_code
            node_name: region_iso_code
            normalize: []
            original_fieldset: geo
            short: Region ISO code.
            type: keyword
        region_name:
          field_details:
            dashed_name: client-geo-region-name
            description: Region name.
            example: Quebec
            flat_name: client.geo.region_name
            ignore_above: 1024
            level: core
            name: region_name
            node_name: region_name
            normalize: []
            original_fieldset: geo
            short: Region name.
            type: keyword
        timezone:
          field_details:
            dashed_name: client-geo-timezone
            description: The time zone of the location, such as IANA time zone name.
            example: America/Argentina/Buenos_Aires
            flat_name: client.geo.timezone
            ignore_above: 1024
            level: core
            name: timezone
            node_name: timezone
            normalize: []
            original_fieldset: geo
            short: Time zone.
            type: keyword
    ip:
      field_details:
        dashed_name: client-ip
        description: IP address of the client (IPv4 or IPv6).
        flat_name: client.ip
        level: core
        name: ip
        node_name: ip
        normalize: []
        short: IP address of the client.
        type: ip
    mac:
      field_details:
        dashed_name: client-mac
        description: 'MAC address of the client.

          The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit
          byte) is represented by two [uppercase] hexadecimal digits giving the value
          of the octet as an unsigned integer. Successive octets are separated by
          a hyphen.'
        example: 00-00-5E-00-53-23
        flat_name: client.mac
        ignore_above: 1024
        level: core
        name: mac
        node_name: mac
        normalize: []
        short: MAC address of the client.
        type: keyword
    nat:
      field_details:
        dashed_name: client-nat
        flat_name: client.nat
        intermediate: true
        name: nat
        node_name: nat
        type: object
      fields:
        ip:
          field_details:
            dashed_name: client-nat-ip
            description: 'Translated IP of source based NAT sessions (e.g. internal
              client to internet).

              Typically connections traversing load balancers, firewalls, or routers.'
            flat_name: client.nat.ip
            level: extended
            name: nat.ip
            node_name: ip
            normalize: []
            short: Client NAT ip address
            type: ip
        port:
          field_details:
            dashed_name: client-nat-port
            description: 'Translated port of source based NAT sessions (e.g. internal
              client to internet).

              Typically connections traversing load balancers, firewalls, or routers.'
            flat_name: client.nat.port
            format: string
            level: extended
            name: nat.port
            node_name: port
            normalize: []
            short: Client NAT port
            type: long
    packets:
      field_details:
        dashed_name: client-packets
        description: Packets sent from the client to the server.
        example: 12
        flat_name: client.packets
        level: core
        name: packets
        node_name: packets
        normalize: []
        short: Packets sent from the client to the server.
        type: long
    port:
      field_details:
        dashed_name: client-port
        description: Port of the client.
        flat_name: client.port
        format: string
        level: core
        name: port
        node_name: port
        normalize: []
        short: Port of the client.
        type: long
    registered_domain:
      field_details:
        dashed_name: client-registered-domain
        description: 'The highest registered client domain, stripped of the subdomain.

          For example, the registered domain for "foo.example.com" is "example.com".

          This value can be determined precisely with a list like the public suffix
          list (http://publicsuffix.org). Trying to approximate this by simply taking
          the last two labels will not work well for TLDs such as "co.uk".'
        example: example.com
        flat_name: client.registered_domain
        ignore_above: 1024
        level: extended
        name: registered_domain
        node_name: registered_domain
        normalize: []
        short: The highest registered client domain, stripped of the subdomain.
        type: keyword
    subdomain:
      field_details:
        dashed_name: client-subdomain
        description: 'The subdomain portion of a fully qualified domain name includes
          all of the names except the host name under the registered_domain.  In a
          partially qualified domain, or if the the qualification level of the full
          name cannot be determined, subdomain contains all of the names below the
          registered domain.

          For example the subdomain portion of "www.east.mydomain.co.uk" is "east".
          If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com",
          the subdomain field should contain "sub2.sub1", with no trailing period.'
        example: east
        flat_name: client.subdomain
        ignore_above: 1024
        level: extended
        name: subdomain
        node_name: subdomain
        normalize: []
        short: The subdomain of the domain.
        type: keyword
    top_level_domain:
      field_details:
        dashed_name: client-top-level-domain
        description: 'The effective top level domain (eTLD), also known as the domain
          suffix, is the last part of the domain name. For example, the top level
          domain for example.com is "com".

          This value can be determined precisely with a list like the public suffix
          list (http://publicsuffix.org). Trying to approximate this by simply taking
          the last label will not work well for effective TLDs such as "co.uk".'
        example: co.uk
        flat_name: client.top_level_domain
        ignore_above: 1024
        level: extended
        name: top_level_domain
        node_name: top_level_domain
        normalize: []
        short: The effective top level domain (com, org, net, co.uk).
        type: keyword
    user:
      field_details:
        dashed_name: client-user
        description: 'The user fields describe information about the user that is
          relevant to the event.

          Fields can have one entry or multiple entries. If a user has more than one
          id, provide an array that includes all of them.'
        flat_name: client.user
        intermediate: true
        name: user
        node_name: user
        original_fieldset: user
        short: Fields to describe the user relevant to the event.
        type: group
      fields:
        domain:
          field_details:
            dashed_name: client-user-domain
            description: 'Name of the directory the user is a member of.

              For example, an LDAP or Active Directory domain name.'
            flat_name: client.user.domain
            ignore_above: 1024
            level: extended
            name: domain
            node_name: domain
            normalize: []
            original_fieldset: user
            short: Name of the directory the user is a member of.
            type: keyword
        email:
          field_details:
            dashed_name: client-user-email
            description: User email address.
            flat_name: client.user.email
            ignore_above: 1024
            level: extended
            name: email
            node_name: email
            normalize: []
            original_fieldset: user
            short: User email address.
            type: keyword
        extra:
          field_details:
            dashed_name: client-user-extra
            description: 'Additional information in key/value pairs.

              For additional information provided by the authenticator to events.

              Note: Not searchable or filterable.'
            enabled: false
            example: '{"authenticator": "ldap", "cipher": "argon2"}'
            flat_name: client.user.extra
            level: custom
            name: extra
            node_name: extra
            normalize: []
            object_type: keyword
            original_fieldset: user
            short: Custom key/value pairs.
            type: object
        full_name:
          field_details:
            dashed_name: client-user-full-name
            description: User's full name, if available.
            example: Albert Einstein
            flat_name: client.user.full_name
            ignore_above: 1024
            level: extended
            multi_fields:
            - flat_name: client.user.full_name.text
              name: text
              norms: false
              type: text
            name: full_name
            node_name: full_name
            normalize: []
            original_fieldset: user
            short: User's full name, if available.
            type: keyword
        group:
          field_details:
            dashed_name: client-user-group
            description: The group fields are meant to represent groups that are relevant
              to the event.
            flat_name: client.user.group
            intermediate: true
            name: group
            node_name: group
            original_fieldset: group
            short: User's group relevant to the event.
            type: group
          fields:
            domain:
              field_details:
                dashed_name: client-user-group-domain
                description: 'Name of the directory the group is a member of.

                  For example, an LDAP or Active Directory domain name.'
                flat_name: client.user.group.domain
                ignore_above: 1024
                level: extended
                name: domain
                node_name: domain
                normalize: []
                original_fieldset: group
                short: Name of the directory the group is a member of.
                type: keyword
            id:
              field_details:
                dashed_name: client-user-group-id
                description: Unique identifier for the group on the system/platform.
                flat_name: client.user.group.id
                ignore_above: 1024
                level: extended
                name: id
                node_name: id
                normalize: []
                original_fieldset: group
                short: Unique identifier for the group on the system/platform.
                type: keyword
            name:
              field_details:
                dashed_name: client-user-group-name
                description: Name of the group.
                flat_name: client.user.group.name
                ignore_above: 1024
                level: extended
                name: name
                node_name: name
                normalize: []
                original_fieldset: group
                short: Name of the group.
                type: keyword
        hash:
          field_details:
            dashed_name: client-user-hash
            description: 'Unique user hash to correlate information for a user in
              anonymized form.

              Useful if `user.id` or `user.name` contain confidential information
              and cannot be used.'
            flat_name: client.user.hash
            ignore_above: 1024
            level: extended
            name: hash
            node_name: hash
            normalize: []
            original_fieldset: user
            short: Unique user hash to correlate information for a user in anonymized
              form.
            type: keyword
        id:
          field_details:
            dashed_name: client-user-id
            description: Unique identifier of the user.
            flat_name: client.user.id
            ignore_above: 1024
            level: core
            name: id
            node_name: id
            normalize: []
            original_fieldset: user
            short: Unique identifier of the user.
            type: keyword
        name:
          field_details:
            dashed_name: client-user-name
            description: Short name or login of the user.
            example: albert
            flat_name: client.user.name
            ignore_above: 1024
            level: core
            multi_fields:
            - flat_name: client.user.name.text
              name: text
              norms: false
              type: text
            name: name
            node_name: name
            normalize: []
            original_fieldset: user
            short: Short name or login of the user.
            type: keyword
        roles:
          field_details:
            dashed_name: client-user-roles
            description: Array of user roles at the time of the event.
            example: '["kibana_admin", "reporting_user"]'
            flat_name: client.user.roles
            ignore_above: 1024
            level: extended
            name: roles
            node_name: roles
            normalize:
            - array
            original_fieldset: user
            short: Array of user roles at the time of the event.
            type: keyword
  schema_details:
    group: 2
    nestings:
    - client.as
    - client.geo
    - client.user
    prefix: client.
    reused_here:
    - full: client.as
      schema_name: as
      short: Fields describing an Autonomous System (Internet routing prefix).
    - full: client.geo
      schema_name: geo
      short: Fields describing a location.
    - full: client.user
      schema_name: user
      short: Fields to describe the user relevant to the event.
    root: false
    title: Client
container:
  field_details:
    dashed_name: container
    description: 'Container fields are used for meta information about the specific
      container that is the source of information.

      These fields help correlate data based containers from any runtime.'
    flat_name: container
    name: container
    node_name: container
    short: Fields describing the container that generated this event.
    type: group
  fields:
    id:
      field_details:
        dashed_name: container-id
        description: Unique container id.
        flat_name: container.id
        ignore_above: 1024
        level: core
        name: id
        node_name: id
        normalize: []
        short: Unique container id.
        type: keyword
    image:
      field_details:
        dashed_name: container-image
        flat_name: container.image
        intermediate: true
        name: image
        node_name: image
        type: object
      fields:
        name:
          field_details:
            dashed_name: container-image-name
            description: Name of the image the container was built on.
            flat_name: container.image.name
            ignore_above: 1024
            level: extended
            name: image.name
            node_name: name
            normalize: []
            short: Name of the image the container was built on.
            type: keyword
        tag:
          field_details:
            dashed_name: container-image-tag
            description: Container image tags.
            flat_name: container.image.tag
            ignore_above: 1024
            level: extended
            name: image.tag
            node_name: tag
            normalize:
            - array
            short: Container image tags.
            type: keyword
    labels:
      field_details:
        dashed_name: container-labels
        description: Image labels.
        flat_name: container.labels
        level: extended
        name: labels
        node_name: labels
        normalize: []
        object_type: keyword
        short: Image labels.
        type: object
    name:
      field_details:
        dashed_name: container-name
        description: Container name.
        flat_name: container.name
        ignore_above: 1024
        level: extended
        name: name
        node_name: name
        normalize: []
        short: Container name.
        type: keyword
    runtime:
      field_details:
        dashed_name: container-runtime
        description: Runtime managing this container.
        example: docker
        flat_name: container.runtime
        ignore_above: 1024
        level: extended
        name: runtime
        node_name: runtime
        normalize: []
        short: Runtime managing this container.
        type: keyword
  schema_details:
    group: 2
    prefix: container.
    root: false
    title: Container
destination:
  field_details:
    dashed_name: destination
    description: 'Destination fields capture details about the receiver of a network
      exchange/packet. These fields are populated from a network event, packet, or
      other event containing details of a network transaction.

      Destination fields are usually populated in conjunction with source fields.
      The source and destination fields are considered the baseline and should always
      be filled if an event contains source and destination details from a network
      transaction. If the event also contains identification of the client and server
      roles, then the client and server fields should also be populated.'
    flat_name: destination
    name: destination
    node_name: destination
    short: Fields about the destination side of a network connection, used with source.
    type: group
  fields:
    address:
      field_details:
        dashed_name: destination-address
        description: 'Some event destination addresses are defined ambiguously. The
          event will sometimes list an IP, a domain or a unix socket.  You should
          always store the raw address in the `.address` field.

          Then it should be duplicated to `.ip` or `.domain`, depending on which one
          it is.'
        flat_name: destination.address
        ignore_above: 1024
        level: extended
        name: address
        node_name: address
        normalize: []
        short: Destination network address.
        type: keyword
    as:
      field_details:
        dashed_name: destination-as
        description: An autonomous system (AS) is a collection of connected Internet
          Protocol (IP) routing prefixes under the control of one or more network
          operators on behalf of a single administrative entity or domain that presents
          a common, clearly defined routing policy to the internet.
        flat_name: destination.as
        intermediate: true
        name: as
        node_name: as
        original_fieldset: as
        short: Fields describing an Autonomous System (Internet routing prefix).
        type: group
      fields:
        number:
          field_details:
            dashed_name: destination-as-number
            description: Unique number allocated to the autonomous system. The autonomous
              system number (ASN) uniquely identifies each network on the Internet.
            example: 15169
            flat_name: destination.as.number
            level: extended
            name: number
            node_name: number
            normalize: []
            original_fieldset: as
            short: Unique number allocated to the autonomous system.
            type: long
        organization:
          field_details:
            dashed_name: destination-as-organization
            flat_name: destination.as.organization
            intermediate: true
            name: organization
            node_name: organization
            original_fieldset: as
            type: object
          fields:
            name:
              field_details:
                dashed_name: destination-as-organization-name
                description: Organization name.
                example: Google LLC
                flat_name: destination.as.organization.name
                ignore_above: 1024
                level: extended
                multi_fields:
                - flat_name: destination.as.organization.name.text
                  name: text
                  norms: false
                  type: text
                name: organization.name
                node_name: name
                normalize: []
                original_fieldset: as
                short: Organization name.
                type: keyword
    bytes:
      field_details:
        dashed_name: destination-bytes
        description: Bytes sent from the destination to the source.
        example: 184
        flat_name: destination.bytes
        format: bytes
        level: core
        name: bytes
        node_name: bytes
        normalize: []
        short: Bytes sent from the destination to the source.
        type: long
    domain:
      field_details:
        dashed_name: destination-domain
        description: Destination domain.
        flat_name: destination.domain
        ignore_above: 1024
        level: core
        name: domain
        node_name: domain
        normalize: []
        short: Destination domain.
        type: keyword
    geo:
      field_details:
        dashed_name: destination-geo
        description: 'Geo fields can carry data about a specific location related
          to an event.

          This geolocation information can be derived from techniques such as Geo
          IP, or be user-supplied.'
        flat_name: destination.geo
        intermediate: true
        name: geo
        node_name: geo
        original_fieldset: geo
        short: Fields describing a location.
        type: group
      fields:
        city_name:
          field_details:
            dashed_name: destination-geo-city-name
            description: City name.
            example: Montreal
            flat_name: destination.geo.city_name
            ignore_above: 1024
            level: core
            name: city_name
            node_name: city_name
            normalize: []
            original_fieldset: geo
            short: City name.
            type: keyword
        continent_code:
          field_details:
            dashed_name: destination-geo-continent-code
            description: Two-letter code representing continent's name.
            example: NA
            flat_name: destination.geo.continent_code
            ignore_above: 1024
            level: core
            name: continent_code
            node_name: continent_code
            normalize: []
            original_fieldset: geo
            short: Continent code.
            type: keyword
        continent_name:
          field_details:
            dashed_name: destination-geo-continent-name
            description: Name of the continent.
            example: North America
            flat_name: destination.geo.continent_name
            ignore_above: 1024
            level: core
            name: continent_name
            node_name: continent_name
            normalize: []
            original_fieldset: geo
            short: Name of the continent.
            type: keyword
        country_iso_code:
          field_details:
            dashed_name: destination-geo-country-iso-code
            description: Country ISO code.
            example: CA
            flat_name: destination.geo.country_iso_code
            ignore_above: 1024
            level: core
            name: country_iso_code
            node_name: country_iso_code
            normalize: []
            original_fieldset: geo
            short: Country ISO code.
            type: keyword
        country_name:
          field_details:
            dashed_name: destination-geo-country-name
            description: Country name.
            example: Canada
            flat_name: destination.geo.country_name
            ignore_above: 1024
            level: core
            name: country_name
            node_name: country_name
            normalize: []
            original_fieldset: geo
            short: Country name.
            type: keyword
        location:
          field_details:
            dashed_name: destination-geo-location
            description: Longitude and latitude.
            example: '{ "lon": -73.614830, "lat": 45.505918 }'
            flat_name: destination.geo.location
            level: core
            name: location
            node_name: location
            normalize: []
            original_fieldset: geo
            short: Longitude and latitude.
            type: geo_point
        name:
          field_details:
            dashed_name: destination-geo-name
            description: 'User-defined description of a location, at the level of
              granularity they care about.

              Could be the name of their data centers, the floor number, if this describes
              a local physical entity, city names.

              Not typically used in automated geolocation.'
            example: boston-dc
            flat_name: destination.geo.name
            ignore_above: 1024
            level: extended
            name: name
            node_name: name
            normalize: []
            original_fieldset: geo
            short: User-defined description of a location.
            type: keyword
        postal_code:
          field_details:
            dashed_name: destination-geo-postal-code
            description: 'Postal code associated with the location.

              Values appropriate for this field may also be known as a postcode or
              ZIP code and will vary widely from country to country.'
            example: 94040
            flat_name: destination.geo.postal_code
            ignore_above: 1024
            level: core
            name: postal_code
            node_name: postal_code
            normalize: []
            original_fieldset: geo
            short: Postal code.
            type: keyword
        region_iso_code:
          field_details:
            dashed_name: destination-geo-region-iso-code
            description: Region ISO code.
            example: CA-QC
            flat_name: destination.geo.region_iso_code
            ignore_above: 1024
            level: core
            name: region_iso_code
            node_name: region_iso_code
            normalize: []
            original_fieldset: geo
            short: Region ISO code.
            type: keyword
        region_name:
          field_details:
            dashed_name: destination-geo-region-name
            description: Region name.
            example: Quebec
            flat_name: destination.geo.region_name
            ignore_above: 1024
            level: core
            name: region_name
            node_name: region_name
            normalize: []
            original_fieldset: geo
            short: Region name.
            type: keyword
        timezone:
          field_details:
            dashed_name: destination-geo-timezone
            description: The time zone of the location, such as IANA time zone name.
            example: America/Argentina/Buenos_Aires
            flat_name: destination.geo.timezone
            ignore_above: 1024
            level: core
            name: timezone
            node_name: timezone
            normalize: []
            original_fieldset: geo
            short: Time zone.
            type: keyword
    ip:
      field_details:
        dashed_name: destination-ip
        description: IP address of the destination (IPv4 or IPv6).
        flat_name: destination.ip
        level: core
        name: ip
        node_name: ip
        normalize: []
        short: IP address of the destination.
        type: ip
    mac:
      field_details:
        dashed_name: destination-mac
        description: 'MAC address of the destination.

          The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit
          byte) is represented by two [uppercase] hexadecimal digits giving the value
          of the octet as an unsigned integer. Successive octets are separated by
          a hyphen.'
        example: 00-00-5E-00-53-23
        flat_name: destination.mac
        ignore_above: 1024
        level: core
        name: mac
        node_name: mac
        normalize: []
        short: MAC address of the destination.
        type: keyword
    nat:
      field_details:
        dashed_name: destination-nat
        flat_name: destination.nat
        intermediate: true
        name: nat
        node_name: nat
        type: object
      fields:
        ip:
          field_details:
            dashed_name: destination-nat-ip
            description: 'Translated ip of destination based NAT sessions (e.g. internet
              to private DMZ)

              Typically used with load balancers, firewalls, or routers.'
            flat_name: destination.nat.ip
            level: extended
            name: nat.ip
            node_name: ip
            normalize: []
            short: Destination NAT ip
            type: ip
        port:
          field_details:
            dashed_name: destination-nat-port
            description: 'Port the source session is translated to by NAT Device.

              Typically used with load balancers, firewalls, or routers.'
            flat_name: destination.nat.port
            format: string
            level: extended
            name: nat.port
            node_name: port
            normalize: []
            short: Destination NAT Port
            type: long
    packets:
      field_details:
        dashed_name: destination-packets
        description: Packets sent from the destination to the source.
        example: 12
        flat_name: destination.packets
        level: core
        name: packets
        node_name: packets
        normalize: []
        short: Packets sent from the destination to the source.
        type: long
    port:
      field_details:
        dashed_name: destination-port
        description: Port of the destination.
        flat_name: destination.port
        format: string
        level: core
        name: port
        node_name: port
        normalize: []
        short: Port of the destination.
        type: long
    registered_domain:
      field_details:
        dashed_name: destination-registered-domain
        description: 'The highest registered destination domain, stripped of the subdomain.

          For example, the registered domain for "foo.example.com" is "example.com".

          This value can be determined precisely with a list like the public suffix
          list (http://publicsuffix.org). Trying to approximate this by simply taking
          the last two labels will not work well for TLDs such as "co.uk".'
        example: example.com
        flat_name: destination.registered_domain
        ignore_above: 1024
        level: extended
        name: registered_domain
        node_name: registered_domain
        normalize: []
        short: The highest registered destination domain, stripped of the subdomain.
        type: keyword
    subdomain:
      field_details:
        dashed_name: destination-subdomain
        description: 'The subdomain portion of a fully qualified domain name includes
          all of the names except the host name under the registered_domain.  In a
          partially qualified domain, or if the the qualification level of the full
          name cannot be determined, subdomain contains all of the names below the
          registered domain.

          For example the subdomain portion of "www.east.mydomain.co.uk" is "east".
          If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com",
          the subdomain field should contain "sub2.sub1", with no trailing period.'
        example: east
        flat_name: destination.subdomain
        ignore_above: 1024
        level: extended
        name: subdomain
        node_name: subdomain
        normalize: []
        short: The subdomain of the domain.
        type: keyword
    top_level_domain:
      field_details:
        dashed_name: destination-top-level-domain
        description: 'The effective top level domain (eTLD), also known as the domain
          suffix, is the last part of the domain name. For example, the top level
          domain for example.com is "com".

          This value can be determined precisely with a list like the public suffix
          list (http://publicsuffix.org). Trying to approximate this by simply taking
          the last label will not work well for effective TLDs such as "co.uk".'
        example: co.uk
        flat_name: destination.top_level_domain
        ignore_above: 1024
        level: extended
        name: top_level_domain
        node_name: top_level_domain
        normalize: []
        short: The effective top level domain (com, org, net, co.uk).
        type: keyword
    user:
      field_details:
        dashed_name: destination-user
        description: 'The user fields describe information about the user that is
          relevant to the event.

          Fields can have one entry or multiple entries. If a user has more than one
          id, provide an array that includes all of them.'
        flat_name: destination.user
        intermediate: true
        name: user
        node_name: user
        original_fieldset: user
        short: Fields to describe the user relevant to the event.
        type: group
      fields:
        domain:
          field_details:
            dashed_name: destination-user-domain
            description: 'Name of the directory the user is a member of.

              For example, an LDAP or Active Directory domain name.'
            flat_name: destination.user.domain
            ignore_above: 1024
            level: extended
            name: domain
            node_name: domain
            normalize: []
            original_fieldset: user
            short: Name of the directory the user is a member of.
            type: keyword
        email:
          field_details:
            dashed_name: destination-user-email
            description: User email address.
            flat_name: destination.user.email
            ignore_above: 1024
            level: extended
            name: email
            node_name: email
            normalize: []
            original_fieldset: user
            short: User email address.
            type: keyword
        extra:
          field_details:
            dashed_name: destination-user-extra
            description: 'Additional information in key/value pairs.

              For additional information provided by the authenticator to events.

              Note: Not searchable or filterable.'
            enabled: false
            example: '{"authenticator": "ldap", "cipher": "argon2"}'
            flat_name: destination.user.extra
            level: custom
            name: extra
            node_name: extra
            normalize: []
            object_type: keyword
            original_fieldset: user
            short: Custom key/value pairs.
            type: object
        full_name:
          field_details:
            dashed_name: destination-user-full-name
            description: User's full name, if available.
            example: Albert Einstein
            flat_name: destination.user.full_name
            ignore_above: 1024
            level: extended
            multi_fields:
            - flat_name: destination.user.full_name.text
              name: text
              norms: false
              type: text
            name: full_name
            node_name: full_name
            normalize: []
            original_fieldset: user
            short: User's full name, if available.
            type: keyword
        group:
          field_details:
            dashed_name: destination-user-group
            description: The group fields are meant to represent groups that are relevant
              to the event.
            flat_name: destination.user.group
            intermediate: true
            name: group
            node_name: group
            original_fieldset: group
            short: User's group relevant to the event.
            type: group
          fields:
            domain:
              field_details:
                dashed_name: destination-user-group-domain
                description: 'Name of the directory the group is a member of.

                  For example, an LDAP or Active Directory domain name.'
                flat_name: destination.user.group.domain
                ignore_above: 1024
                level: extended
                name: domain
                node_name: domain
                normalize: []
                original_fieldset: group
                short: Name of the directory the group is a member of.
                type: keyword
            id:
              field_details:
                dashed_name: destination-user-group-id
                description: Unique identifier for the group on the system/platform.
                flat_name: destination.user.group.id
                ignore_above: 1024
                level: extended
                name: id
                node_name: id
                normalize: []
                original_fieldset: group
                short: Unique identifier for the group on the system/platform.
                type: keyword
            name:
              field_details:
                dashed_name: destination-user-group-name
                description: Name of the group.
                flat_name: destination.user.group.name
                ignore_above: 1024
                level: extended
                name: name
                node_name: name
                normalize: []
                original_fieldset: group
                short: Name of the group.
                type: keyword
        hash:
          field_details:
            dashed_name: destination-user-hash
            description: 'Unique user hash to correlate information for a user in
              anonymized form.

              Useful if `user.id` or `user.name` contain confidential information
              and cannot be used.'
            flat_name: destination.user.hash
            ignore_above: 1024
            level: extended
            name: hash
            node_name: hash
            normalize: []
            original_fieldset: user
            short: Unique user hash to correlate information for a user in anonymized
              form.
            type: keyword
        id:
          field_details:
            dashed_name: destination-user-id
            description: Unique identifier of the user.
            flat_name: destination.user.id
            ignore_above: 1024
            level: core
            name: id
            node_name: id
            normalize: []
            original_fieldset: user
            short: Unique identifier of the user.
            type: keyword
        name:
          field_details:
            dashed_name: destination-user-name
            description: Short name or login of the user.
            example: albert
            flat_name: destination.user.name
            ignore_above: 1024
            level: core
            multi_fields:
            - flat_name: destination.user.name.text
              name: text
              norms: false
              type: text
            name: name
            node_name: name
            normalize: []
            original_fieldset: user
            short: Short name or login of the user.
            type: keyword
        roles:
          field_details:
            dashed_name: destination-user-roles
            description: Array of user roles at the time of the event.
            example: '["kibana_admin", "reporting_user"]'
            flat_name: destination.user.roles
            ignore_above: 1024
            level: extended
            name: roles
            node_name: roles
            normalize:
            - array
            original_fieldset: user
            short: Array of user roles at the time of the event.
            type: keyword
  schema_details:
    group: 2
    nestings:
    - destination.as
    - destination.geo
    - destination.user
    prefix: destination.
    reused_here:
    - full: destination.as
      schema_name: as
      short: Fields describing an Autonomous System (Internet routing prefix).
    - full: destination.geo
      schema_name: geo
      short: Fields describing a location.
    - full: destination.user
      schema_name: user
      short: Fields to describe the user relevant to the event.
    root: false
    title: Destination
ecs:
  field_details:
    dashed_name: ecs
    description: Meta-information specific to ECS.
    flat_name: ecs
    name: ecs
    node_name: ecs
    short: Meta-information specific to ECS.
    type: group
  fields:
    version:
      field_details:
        dashed_name: ecs-version
        description: 'ECS version this event conforms to. `ecs.version` is a required
          field and must exist in all events.

          Must match `^(?<major>[0-9]+)\.(?<minor>[0-9]+)\.(?<patch>[0-9]+)$`.

          When querying across multiple indices -- which may conform to slightly different
          ECS versions -- this field lets integrations adjust to the schema version
          of the events.'
        example: 1.0.0
        flat_name: ecs.version
        ignore_above: 1024
        level: core
        name: version
        node_name: version
        normalize: []
        required: true
        short: ECS version this event conforms to.
        type: keyword
  schema_details:
    group: 2
    prefix: ecs.
    root: false
    title: ECS
error:
  field_details:
    dashed_name: error
    description: 'These fields can represent errors of any kind.

      Use them for errors that happen while fetching events or in cases where the
      event itself contains an error.'
    flat_name: error
    name: error
    node_name: error
    short: Fields about errors of any kind.
    type: group
  fields:
    code:
      field_details:
        dashed_name: error-code
        description: Error code describing the error.
        flat_name: error.code
        ignore_above: 1024
        level: core
        name: code
        node_name: code
        normalize: []
        short: Error code describing the error.
        type: keyword
    id:
      field_details:
        dashed_name: error-id
        description: Unique identifier for the error.
        flat_name: error.id
        ignore_above: 1024
        level: core
        name: id
        node_name: id
        normalize: []
        short: Unique identifier for the error.
        type: keyword
    message:
      field_details:
        dashed_name: error-message
        description: Error message.
        flat_name: error.message
        level: core
        name: message
        node_name: message
        normalize: []
        norms: false
        short: Error message.
        type: text
    stack:
      field_details:
        dashed_name: error-stack
        flat_name: error.stack
        intermediate: true
        name: stack
        node_name: stack
        type: object
      fields:
        head:
          field_details:
            dashed_name: error-stack-head
            description: 'The first line of the stack trace useful for aggregation.

              This is an attribute of the `stack` object, unlike `stack_trace`.'
            flat_name: error.stack.head
            ignore_above: 1024
            level: custom
            name: stack.head
            node_name: head
            normalize: []
            short: Head of the stack trace.
            type: keyword
        previous_trace:
          field_details:
            dashed_name: error-stack-previous-trace
            description: The previous stack trace.
            doc_values: false
            flat_name: error.stack.previous_trace
            index: false
            level: custom
            multi_fields:
            - flat_name: error.stack.previous_trace.text
              name: text
              norms: false
              type: text
            name: stack.previous_trace
            node_name: previous_trace
            normalize: []
            short: The previous stack trace.
            type: keyword
    stack_trace:
      field_details:
        dashed_name: error-stack-trace
        description: The stack trace of this error in plain text.
        doc_values: false
        flat_name: error.stack_trace
        index: false
        level: extended
        multi_fields:
        - flat_name: error.stack_trace.text
          name: text
          norms: false
          type: text
        name: stack_trace
        node_name: stack_trace
        normalize: []
        short: The stack trace of this error in plain text.
        type: keyword
    type:
      field_details:
        dashed_name: error-type
        description: The type of the error, for example the class name of the exception.
        example: java.lang.NullPointerException
        flat_name: error.type
        ignore_above: 1024
        level: extended
        name: type
        node_name: type
        normalize: []
        short: The type of the error, for example the class name of the exception.
        type: keyword
  schema_details:
    group: 2
    prefix: error.
    root: false
    title: Error
event:
  field_details:
    dashed_name: event
    description: 'The event fields are used for context information about the log
      or metric event itself.

      A log is defined as an event containing details of something that happened.
      Log events must include the time at which the thing happened. Examples of log
      events include a process starting on a host, a network packet being sent from
      a source to a destination, or a network connection between a client and a server
      being initiated or closed. A metric is defined as an event containing one or
      more numerical measurements and the time at which the measurement was taken.
      Examples of metric events include memory pressure measured on a host and device
      temperature. See the `event.kind` definition in this section for additional
      details about metric and state events.'
    flat_name: event
    name: event
    node_name: event
    short: Fields breaking down the event details.
    type: group
  fields:
    action:
      field_details:
        dashed_name: event-action
        description: 'The action captured by the event.

          This describes the information in the event. It is more specific than `event.category`.
          Examples are `group-add`, `process-started`, `file-created`. The value is
          normally defined by the implementer.'
        example: user-password-change
        flat_name: event.action
        ignore_above: 1024
        level: core
        name: action
        node_name: action
        normalize: []
        short: The action captured by the event.
        type: keyword
    agent_id_status:
      field_details:
        dashed_name: event-agent-id-status
        description: 'Agents are normally responsible for populating the `agent.id`
          field value. If the system receiving events is capable of validating the
          value based on authentication information for the client then this field
          can be used to reflect the outcome of that validation.

          For example if the agent''s connection is authenticated with mTLS and the
          client cert contains the ID of the agent to which the cert was issued then
          the `agent.id` value in events can be checked against the certificate. If
          the values match then `event.agent_id_status: verified` is added to the
          event, otherwise one of the other allowed values should be used.

          If no validation is performed then the field should be omitted.

          The allowed values are:

          `verified` - The `agent.id` field value matches expected value obtained
          from auth metadata.

          `mismatch` - The `agent.id` field value does not match the expected value
          obtained from auth metadata.

          `missing` - There was no `agent.id` field in the event to validate.

          `auth_metadata_missing` - There was no auth metadata or it was missing information
          about the agent ID.'
        example: verified
        flat_name: event.agent_id_status
        ignore_above: 1024
        level: extended
        name: agent_id_status
        node_name: agent_id_status
        normalize: []
        short: Validation status of the event's agent.id field.
        type: keyword
    category:
      field_details:
        allowed_values:
        - description: Events in this category are related to the challenge and response
            process in which credentials are supplied and verified to allow the creation
            of a session. Common sources for these logs are Windows event logs and
            ssh logs. Visualize and analyze events in this category to look for failed
            logins, and other authentication-related activity.
          expected_event_types:
          - start
          - end
          - info
          name: authentication
        - description: 'Events in the configuration category have to deal with creating,
            modifying, or deleting the settings or parameters of an application, process,
            or system.

            Example sources include security policy change logs, configuration auditing
            logging, and system integrity monitoring.'
          expected_event_types:
          - access
          - change
          - creation
          - deletion
          - info
          name: configuration
        - description: The database category denotes events and metrics relating to
            a data storage and retrieval system. Note that use of this category is
            not limited to relational database systems. Examples include event logs
            from MS SQL, MySQL, Elasticsearch, MongoDB, etc. Use this category to
            visualize and analyze database activity such as accesses and changes.
          expected_event_types:
          - access
          - change
          - info
          - error
          name: database
        - description: 'Events in the driver category have to do with operating system
            device drivers and similar software entities such as Windows drivers,
            kernel extensions, kernel modules, etc.

            Use events and metrics in this category to visualize and analyze driver-related
            activity and status on hosts.'
          expected_event_types:
          - change
          - end
          - info
          - start
          name: driver
        - description: Relating to a set of information that has been created on,
            or has existed on a filesystem. Use this category of events to visualize
            and analyze the creation, access, and deletions of files. Events in this
            category can come from both host-based and network-based sources. An example
            source of a network-based detection of a file transfer would be the Zeek
            file.log.
          expected_event_types:
          - change
          - creation
          - deletion
          - info
          name: file
        - description: 'Use this category to visualize and analyze information such
            as host inventory or host lifecycle events.

            Most of the events in this category can usually be observed from the outside,
            such as from a hypervisor or a control plane''s point of view. Some can
            also be seen from within, such as "start" or "end".

            Note that this category is for information about hosts themselves; it
            is not meant to capture activity "happening on a host".'
          expected_event_types:
          - access
          - change
          - end
          - info
          - start
          name: host
        - description: Identity and access management (IAM) events relating to users,
            groups, and administration. Use this category to visualize and analyze
            IAM-related logs and data from active directory, LDAP, Okta, Duo, and
            other IAM systems.
          expected_event_types:
          - admin
          - change
          - creation
          - deletion
          - group
          - info
          - user
          name: iam
        - description: Relating to intrusion detections from IDS/IPS systems and functions,
            both network and host-based. Use this category to visualize and analyze
            intrusion detection alerts from systems such as Snort, Suricata, and Palo
            Alto threat detections.
          expected_event_types:
          - allowed
          - denied
          - info
          name: intrusion_detection
        - description: Malware detection events and alerts. Use this category to visualize
            and analyze malware detections from EDR/EPP systems such as Elastic Endpoint
            Security, Symantec Endpoint Protection, Crowdstrike, and network IDS/IPS
            systems such as Suricata, or other sources of malware-related events such
            as Palo Alto Networks threat logs and Wildfire logs.
          expected_event_types:
          - info
          name: malware
        - description: Relating to all network activity, including network connection
            lifecycle, network traffic, and essentially any event that includes an
            IP address. Many events containing decoded network protocol transactions
            fit into this category. Use events in this category to visualize or analyze
            counts of network ports, protocols, addresses, geolocation information,
            etc.
          expected_event_types:
          - access
          - allowed
          - connection
          - denied
          - end
          - info
          - protocol
          - start
          name: network
        - description: Relating to software packages installed on hosts. Use this
            category to visualize and analyze inventory of software installed on various
            hosts, or to determine host vulnerability in the absence of vulnerability
            scan data.
          expected_event_types:
          - access
          - change
          - deletion
          - info
          - installation
          - start
          name: package
        - description: Use this category of events to visualize and analyze process-specific
            information such as lifecycle events or process ancestry.
          expected_event_types:
          - access
          - change
          - end
          - info
          - start
          name: process
        - description: Having to do with settings and assets stored in the Windows
            registry. Use this category to visualize and analyze activity such as
            registry access and modifications.
          expected_event_types:
          - access
          - change
          - creation
          - deletion
          name: registry
        - description: The session category is applied to events and metrics regarding
            logical persistent connections to hosts and services. Use this category
            to visualize and analyze interactive or automated persistent connections
            between assets. Data for this category may come from Windows Event logs,
            SSH logs, or stateless sessions such as HTTP cookie-based sessions, etc.
          expected_event_types:
          - start
          - end
          - info
          name: session
        - description: Use this category to visualize and analyze events describing
            threat actors' targets, motives, or behaviors.
          expected_event_types:
          - indicator
          name: threat
        - description: 'Relating to web server access. Use this category to create
            a dashboard of web server/proxy activity from apache, IIS, nginx web servers,
            etc. Note: events from network observers such as Zeek http log may also
            be included in this category.'
          expected_event_types:
          - access
          - error
          - info
          name: web
        dashed_name: event-category
        description: 'This is one of four ECS Categorization Fields, and indicates
          the second level in the ECS category hierarchy.

          `event.category` represents the "big buckets" of ECS categories. For example,
          filtering on `event.category:process` yields all events relating to process
          activity. This field is closely related to `event.type`, which is used as
          a subcategory.

          This field is an array. This will allow proper categorization of some events
          that fall in multiple categories.'
        example: authentication
        flat_name: event.category
        ignore_above: 1024
        level: core
        name: category
        node_name: category
        normalize:
        - array
        short: Event category. The second categorization field in the hierarchy.
        type: keyword
    code:
      field_details:
        dashed_name: event-code
        description: 'Identification code for this event, if one exists.

          Some event sources use event codes to identify messages unambiguously, regardless
          of message language or wording adjustments over time. An example of this
          is the Windows Event ID.'
        example: 4648
        flat_name: event.code
        ignore_above: 1024
        level: extended
        name: code
        node_name: code
        normalize: []
        short: Identification code for this event.
        type: keyword
    created:
      field_details:
        dashed_name: event-created
        description: 'event.created contains the date/time when the event was first
          read by an agent, or by your pipeline.

          This field is distinct from @timestamp in that @timestamp typically contain
          the time extracted from the original event.

          In most situations, these two timestamps will be slightly different. The
          difference can be used to calculate the delay between your source generating
          an event, and the time when your agent first processed it. This can be used
          to monitor your agent''s or pipeline''s ability to keep up with your event
          source.

          In case the two timestamps are identical, @timestamp should be used.'
        example: '2016-05-23T08:05:34.857Z'
        flat_name: event.created
        level: core
        name: created
        node_name: created
        normalize: []
        short: Time when the event was first read by an agent or by your pipeline.
        type: date
    dataset:
      field_details:
        dashed_name: event-dataset
        description: 'Name of the dataset.

          If an event source publishes more than one type of log or events (e.g. access
          log, error log), the dataset is used to specify which one the event comes
          from.

          It''s recommended but not required to start the dataset name with the module
          name, followed by a dot, then the dataset name.'
        example: apache.access
        flat_name: event.dataset
        ignore_above: 1024
        level: core
        name: dataset
        node_name: dataset
        normalize: []
        short: Name of the dataset.
        type: keyword
    duration:
      field_details:
        dashed_name: event-duration
        description: 'Duration of the event in nanoseconds.

          If event.start and event.end are known this value should be the difference
          between the end and start time.'
        flat_name: event.duration
        format: duration
        input_format: nanoseconds
        level: core
        name: duration
        node_name: duration
        normalize: []
        output_format: asMilliseconds
        output_precision: 1
        short: Duration of the event in nanoseconds.
        type: long
    end:
      field_details:
        dashed_name: event-end
        description: event.end contains the date when the event ended or when the
          activity was last observed.
        flat_name: event.end
        level: extended
        name: end
        node_name: end
        normalize: []
        short: event.end contains the date when the event ended or when the activity
          was last observed.
        type: date
    hash:
      field_details:
        dashed_name: event-hash
        description: Hash (perhaps logstash fingerprint) of raw field to be able to
          demonstrate log integrity.
        example: 123456789012345678901234567890ABCD
        flat_name: event.hash
        ignore_above: 1024
        level: extended
        name: hash
        node_name: hash
        normalize: []
        short: Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate
          log integrity.
        type: keyword
    id:
      field_details:
        dashed_name: event-id
        description: Unique ID to describe the event.
        example: 8a4f500d
        flat_name: event.id
        ignore_above: 1024
        level: core
        name: id
        node_name: id
        normalize: []
        short: Unique ID to describe the event.
        type: keyword
    ingested:
      field_details:
        dashed_name: event-ingested
        description: 'Timestamp when an event arrived in the central data store.

          This is different from `@timestamp`, which is when the event originally
          occurred.  It''s also different from `event.created`, which is meant to
          capture the first time an agent saw the event.

          In normal conditions, assuming no tampering, the timestamps should chronologically
          look like this: `@timestamp` < `event.created` < `event.ingested`.'
        example: '2016-05-23T08:05:35.101Z'
        flat_name: event.ingested
        level: core
        name: ingested
        node_name: ingested
        normalize: []
        short: Timestamp when an event arrived in the central data store.
        type: date
    kind:
      field_details:
        allowed_values:
        - description: 'This value indicates an event such as an alert or notable
            event, triggered by a detection rule executing externally to the Elastic
            Stack.

            `event.kind:alert` is often populated for events coming from firewalls,
            intrusion detection systems, endpoint detection and response systems,
            and so on.

            This value is not used by Elastic solutions for alert documents that are
            created by rules executing within the Kibana alerting framework.'
          name: alert
        - description: 'The `enrichment` value indicates an event collected to provide
            additional context, often to other events.

            An example is collecting indicators of compromise (IOCs) from a threat
            intelligence provider with the intent to use those values to enrich other
            events. The IOC events from the intelligence provider should be categorized
            as `event.kind:enrichment`.'
          name: enrichment
        - description: This value is the most general and most common value for this
            field. It is used to represent events that indicate that something happened.
          name: event
        - description: 'This value is used to indicate that this event describes a
            numeric measurement taken at given point in time.

            Examples include CPU utilization, memory usage, or device temperature.

            Metric events are often collected on a predictable frequency, such as
            once every few seconds, or once a minute, but can also be used to describe
            ad-hoc numeric metric queries.'
          name: metric
        - description: 'The state value is similar to metric, indicating that this
            event describes a measurement taken at given point in time, except that
            the measurement does not result in a numeric value, but rather one of
            a fixed set of categorical values that represent conditions or states.

            Examples include periodic events reporting Elasticsearch cluster state
            (green/yellow/red), the state of a TCP connection (open, closed, fin_wait,
            etc.), the state of a host with respect to a software vulnerability (vulnerable,
            not vulnerable), and the state of a system regarding compliance with a
            regulatory standard (compliant, not compliant).

            Note that an event that describes a change of state would not use `event.kind:state`,
            but instead would use ''event.kind:event'' since a state change fits the
            more general event definition of something that happened.

            State events are often collected on a predictable frequency, such as once
            every few seconds, once a minute, once an hour, or once a day, but can
            also be used to describe ad-hoc state queries.'
          name: state
        - description: This value indicates that an error occurred during the ingestion
            of this event, and that event data may be missing, inconsistent, or incorrect.
            `event.kind:pipeline_error` is often associated with parsing errors.
          name: pipeline_error
        - description: 'This value is used by Elastic solutions (e.g., Security, Observability)
            for alert documents that are created by rules executing within the Kibana
            alerting framework.

            Usage of this value is reserved, and data ingestion pipelines must not
            populate `event.kind` with the value "signal".'
          name: signal
        dashed_name: event-kind
        description: 'This is one of four ECS Categorization Fields, and indicates
          the highest level in the ECS category hierarchy.

          `event.kind` gives high-level information about what type of information
          the event contains, without being specific to the contents of the event.
          For example, values of this field distinguish alert events from metric events.

          The value of this field can be used to inform how these kinds of events
          should be handled. They may warrant different retention, different access
          control, it may also help understand whether the data coming in at a regular
          interval or not.'
        example: alert
        flat_name: event.kind
        ignore_above: 1024
        level: core
        name: kind
        node_name: kind
        normalize: []
        short: The kind of the event. The highest categorization field in the hierarchy.
        type: keyword
    module:
      field_details:
        dashed_name: event-module
        description: 'Name of the module this data is coming from.

          If your monitoring agent supports the concept of modules or plugins to process
          events of a given source (e.g. Apache logs), `event.module` should contain
          the name of this module.'
        example: apache
        flat_name: event.module
        ignore_above: 1024
        level: core
        name: module
        node_name: module
        normalize: []
        short: Name of the module this data is coming from.
        type: keyword
    original:
      field_details:
        dashed_name: event-original
        description: 'Raw text message of entire event. Used to demonstrate log integrity
          or where the full log message (before splitting it up in multiple parts)
          may be required, e.g. for reindex.

          This field is not indexed and doc_values are disabled. It cannot be searched,
          but it can be retrieved from `_source`. If users wish to override this and
          index this field, please see `Field data types` in the `Elasticsearch Reference`.'
        doc_values: false
        example: Sep 19 08:26:10 host CEF:0&#124;Security&#124; threatmanager&#124;1.0&#124;100&#124;
          worm successfully stopped&#124;10&#124;src=10.0.0.1 dst=2.1.2.2spt=1232
        flat_name: event.original
        index: false
        level: core
        name: original
        node_name: original
        normalize: []
        short: Raw text message of entire event.
        type: keyword
    outcome:
      field_details:
        allowed_values:
        - description: Indicates that this event describes a failed result. A common
            example is `event.category:file AND event.type:access AND event.outcome:failure`
            to indicate that a file access was attempted, but was not successful.
          name: failure
        - description: Indicates that this event describes a successful result. A
            common example is `event.category:file AND event.type:create AND event.outcome:success`
            to indicate that a file was successfully created.
          name: success
        - description: Indicates that this event describes only an attempt for which
            the result is unknown from the perspective of the event producer. For
            example, if the event contains information only about the request side
            of a transaction that results in a response, populating `event.outcome:unknown`
            in the request event is appropriate. The unknown value should not be used
            when an outcome doesn't make logical sense for the event. In such cases
            `event.outcome` should not be populated.
          name: unknown
        dashed_name: event-outcome
        description: 'This is one of four ECS Categorization Fields, and indicates
          the lowest level in the ECS category hierarchy.

          `event.outcome` simply denotes whether the event represents a success or
          a failure from the perspective of the entity that produced the event.

          Note that when a single transaction is described in multiple events, each
          event may populate different values of `event.outcome`, according to their
          perspective.

          Also note that in the case of a compound event (a single event that contains
          multiple logical events), this field should be populated with the value
          that best captures the overall success or failure from the perspective of
          the event producer.

          Further note that not all events will have an associated outcome. For example,
          this field is generally not populated for metric events, events with `event.type:info`,
          or any events for which an outcome does not make logical sense.'
        example: success
        flat_name: event.outcome
        ignore_above: 1024
        level: core
        name: outcome
        node_name: outcome
        normalize: []
        short: The outcome of the event. The lowest level categorization field in
          the hierarchy.
        type: keyword
    provider:
      field_details:
        dashed_name: event-provider
        description: 'Source of the event.

          Event transports such as Syslog or the Windows Event Log typically mention
          the source of an event. It can be the name of the software that generated
          the event (e.g. Sysmon, httpd), or of a subsystem of the operating system
          (kernel, Microsoft-Windows-Security-Auditing).'
        example: kernel
        flat_name: event.provider
        ignore_above: 1024
        level: extended
        name: provider
        node_name: provider
        normalize: []
        short: Source of the event.
        type: keyword
    reason:
      field_details:
        dashed_name: event-reason
        description: 'Reason why this event happened, according to the source.

          This describes the why of a particular action or outcome captured in the
          event. Where `event.action` captures the action from the event, `event.reason`
          describes why that action was taken. For example, a web proxy with an `event.action`
          which denied the request may also populate `event.reason` with the reason
          why (e.g. `blocked site`).'
        example: Terminated an unexpected process
        flat_name: event.reason
        ignore_above: 1024
        level: extended
        name: reason
        node_name: reason
        normalize: []
        short: Reason why this event happened, according to the source
        type: keyword
    reference:
      field_details:
        dashed_name: event-reference
        description: 'Reference URL linking to additional information about this event.

          This URL links to a static definition of this event. Alert events, indicated
          by `event.kind:alert`, are a common use case for this field.'
        example: https://system.example.com/event/#0001234
        flat_name: event.reference
        ignore_above: 1024
        level: extended
        name: reference
        node_name: reference
        normalize: []
        short: Event reference URL
        type: keyword
    risk_score:
      field_details:
        dashed_name: event-risk-score
        description: Risk score or priority of the event (e.g. security solutions).
          Use your system's original value here.
        flat_name: event.risk_score
        level: core
        name: risk_score
        node_name: risk_score
        normalize: []
        short: Risk score or priority of the event (e.g. security solutions). Use
          your system's original value here.
        type: float
    risk_score_norm:
      field_details:
        dashed_name: event-risk-score-norm
        description: 'Normalized risk score or priority of the event, on a scale of
          0 to 100.

          This is mainly useful if you use more than one system that assigns risk
          scores, and you want to see a normalized value across all systems.'
        flat_name: event.risk_score_norm
        level: extended
        name: risk_score_norm
        node_name: risk_score_norm
        normalize: []
        short: Normalized risk score or priority of the event (0-100).
        type: float
    sequence:
      field_details:
        dashed_name: event-sequence
        description: 'Sequence number of the event.

          The sequence number is a value published by some event sources, to make
          the exact ordering of events unambiguous, regardless of the timestamp precision.'
        flat_name: event.sequence
        format: string
        level: extended
        name: sequence
        node_name: sequence
        normalize: []
        short: Sequence number of the event.
        type: long
    severity:
      field_details:
        dashed_name: event-severity
        description: 'The numeric severity of the event according to your event source.

          What the different severity values mean can be different between sources
          and use cases. It''s up to the implementer to make sure severities are consistent
          across events from the same source.

          The Syslog severity belongs in `log.syslog.severity.code`. `event.severity`
          is meant to represent the severity according to the event source (e.g. firewall,
          IDS). If the event source does not publish its own severity, you may optionally
          copy the `log.syslog.severity.code` to `event.severity`.'
        example: 7
        flat_name: event.severity
        format: string
        level: core
        name: severity
        node_name: severity
        normalize: []
        short: Numeric severity of the event.
        type: long
    start:
      field_details:
        dashed_name: event-start
        description: event.start contains the date when the event started or when
          the activity was first observed.
        flat_name: event.start
        level: extended
        name: start
        node_name: start
        normalize: []
        short: event.start contains the date when the event started or when the activity
          was first observed.
        type: date
    timezone:
      field_details:
        dashed_name: event-timezone
        description: 'This field should be populated when the event''s timestamp does
          not include timezone information already (e.g. default Syslog timestamps).
          It''s optional otherwise.

          Acceptable timezone formats are: a canonical ID (e.g. "Europe/Amsterdam"),
          abbreviated (e.g. "EST") or an HH:mm differential (e.g. "-05:00").'
        flat_name: event.timezone
        ignore_above: 1024
        level: extended
        name: timezone
        node_name: timezone
        normalize: []
        short: Event time zone.
        type: keyword
    type:
      field_details:
        allowed_values:
        - description: The access event type is used for the subset of events within
            a category that indicate that something was accessed. Common examples
            include `event.category:database AND event.type:access`, or `event.category:file
            AND event.type:access`. Note for file access, both directory listings
            and file opens should be included in this subcategory. You can further
            distinguish access operations using the ECS `event.action` field.
          name: access
        - description: 'The admin event type is used for the subset of events within
            a category that are related to admin objects. For example, administrative
            changes within an IAM framework that do not specifically affect a user
            or group (e.g., adding new applications to a federation solution or connecting
            discrete forests in Active Directory) would fall into this subcategory.
            Common example: `event.category:iam AND event.type:change AND event.type:admin`.
            You can further distinguish admin operations using the ECS `event.action`
            field.'
          name: admin
        - description: The allowed event type is used for the subset of events within
            a category that indicate that something was allowed. Common examples include
            `event.category:network AND event.type:connection AND event.type:allowed`
            (to indicate a network firewall event for which the firewall disposition
            was to allow the connection to complete) and `event.category:intrusion_detection
            AND event.type:allowed` (to indicate a network intrusion prevention system
            event for which the IPS disposition was to allow the connection to complete).
            You can further distinguish allowed operations using the ECS `event.action`
            field, populating with values of your choosing, such as "allow", "detect",
            or "pass".
          name: allowed
        - description: The change event type is used for the subset of events within
            a category that indicate that something has changed. If semantics best
            describe an event as modified, then include them in this subcategory.
            Common examples include `event.category:process AND event.type:change`,
            and `event.category:file AND event.type:change`. You can further distinguish
            change operations using the ECS `event.action` field.
          name: change
        - description: Used primarily with `event.category:network` this value is
            used for the subset of network traffic that includes sufficient information
            for the event to be included in flow or connection analysis. Events in
            this subcategory will contain at least source and destination IP addresses,
            source and destination TCP/UDP ports, and will usually contain counts
            of bytes and/or packets transferred. Events in this subcategory may contain
            unidirectional or bidirectional information, including summary information.
            Use this subcategory to visualize and analyze network connections. Flow
            analysis, including Netflow, IPFIX, and other flow-related events fit
            in this subcategory. Note that firewall events from many Next-Generation
            Firewall (NGFW) devices will also fit into this subcategory.  A common
            filter for flow/connection information would be `event.category:network
            AND event.type:connection AND event.type:end` (to view or analyze all
            completed network connections, ignoring mid-flow reports). You can further
            distinguish connection events using the ECS `event.action` field, populating
            with values of your choosing, such as "timeout", or "reset".
          name: connection
        - description: The "creation" event type is used for the subset of events
            within a category that indicate that something was created. A common example
            is `event.category:file AND event.type:creation`.
          name: creation
        - description: The deletion event type is used for the subset of events within
            a category that indicate that something was deleted. A common example
            is `event.category:file AND event.type:deletion` to indicate that a file
            has been deleted.
          name: deletion
        - description: The denied event type is used for the subset of events within
            a category that indicate that something was denied. Common examples include
            `event.category:network AND event.type:denied` (to indicate a network
            firewall event for which the firewall disposition was to deny the connection)
            and `event.category:intrusion_detection AND event.type:denied` (to indicate
            a network intrusion prevention system event for which the IPS disposition
            was to deny the connection to complete). You can further distinguish denied
            operations using the ECS `event.action` field, populating with values
            of your choosing, such as "blocked", "dropped", or "quarantined".
          name: denied
        - description: The end event type is used for the subset of events within
            a category that indicate something has ended. A common example is `event.category:process
            AND event.type:end`.
          name: end
        - description: The error event type is used for the subset of events within
            a category that indicate or describe an error. A common example is `event.category:database
            AND event.type:error`. Note that pipeline errors that occur during the
            event ingestion process should not use this `event.type` value. Instead,
            they should use `event.kind:pipeline_error`.
          name: error
        - description: 'The group event type is used for the subset of events within
            a category that are related to group objects. Common example: `event.category:iam
            AND event.type:creation AND event.type:group`. You can further distinguish
            group operations using the ECS `event.action` field.'
          name: group
        - description: 'The indicator event type is used for the subset of events
            within a category that contain details about indicators of compromise
            (IOCs).

            A common example is `event.category:threat AND event.type:indicator`.'
          name: indicator
        - description: The info event type is used for the subset of events within
            a category that indicate that they are purely informational, and don't
            report a state change, or any type of action. For example, an initial
            run of a file integrity monitoring system (FIM), where an agent reports
            all files under management, would fall into the "info" subcategory. Similarly,
            an event containing a dump of all currently running processes (as opposed
            to reporting that a process started/ended) would fall into the "info"
            subcategory. An additional common examples is `event.category:intrusion_detection
            AND event.type:info`.
          name: info
        - description: The installation event type is used for the subset of events
            within a category that indicate that something was installed. A common
            example is `event.category:package` AND `event.type:installation`.
          name: installation
        - description: The protocol event type is used for the subset of events within
            a category that indicate that they contain protocol details or analysis,
            beyond simply identifying the protocol. Generally, network events that
            contain specific protocol details will fall into this subcategory. A common
            example is `event.category:network AND event.type:protocol AND event.type:connection
            AND event.type:end` (to indicate that the event is a network connection
            event sent at the end of a connection that also includes a protocol detail
            breakdown). Note that events that only indicate the name or id of the
            protocol should not use the protocol value. Further note that when the
            protocol subcategory is used, the identified protocol is populated in
            the ECS `network.protocol` field.
          name: protocol
        - description: The start event type is used for the subset of events within
            a category that indicate something has started. A common example is `event.category:process
            AND event.type:start`.
          name: start
        - description: 'The user event type is used for the subset of events within
            a category that are related to user objects. Common example: `event.category:iam
            AND event.type:deletion AND event.type:user`. You can further distinguish
            user operations using the ECS `event.action` field.'
          name: user
        dashed_name: event-type
        description: 'This is one of four ECS Categorization Fields, and indicates
          the third level in the ECS category hierarchy.

          `event.type` represents a categorization "sub-bucket" that, when used along
          with the `event.category` field values, enables filtering events down to
          a level appropriate for single visualization.

          This field is an array. This will allow proper categorization of some events
          that fall in multiple event types.'
        flat_name: event.type
        ignore_above: 1024
        level: core
        name: type
        node_name: type
        normalize:
        - array
        short: Event type. The third categorization field in the hierarchy.
        type: keyword
    url:
      field_details:
        dashed_name: event-url
        description: 'URL linking to an external system to continue investigation
          of this event.

          This URL links to another system where in-depth investigation of the specific
          occurrence of this event can take place. Alert events, indicated by `event.kind:alert`,
          are a common use case for this field.'
        example: https://mysystem.example.com/alert/5271dedb-f5b0-4218-87f0-4ac4870a38fe
        flat_name: event.url
        ignore_above: 1024
        level: extended
        name: url
        node_name: url
        normalize: []
        short: Event investigation URL
        type: keyword
  schema_details:
    group: 2
    prefix: event.
    root: false
    title: Event
geo:
  field_details:
    dashed_name: geo
    description: 'Geo fields can carry data about a specific location related to an
      event.

      This geolocation information can be derived from techniques such as Geo IP,
      or be user-supplied.'
    flat_name: geo
    name: geo
    node_name: geo
    short: Fields describing a location.
    type: group
  fields:
    city_name:
      field_details:
        dashed_name: geo-city-name
        description: City name.
        example: Montreal
        flat_name: geo.city_name
        ignore_above: 1024
        level: core
        name: city_name
        node_name: city_name
        normalize: []
        short: City name.
        type: keyword
    continent_code:
      field_details:
        dashed_name: geo-continent-code
        description: Two-letter code representing continent's name.
        example: NA
        flat_name: geo.continent_code
        ignore_above: 1024
        level: core
        name: continent_code
        node_name: continent_code
        normalize: []
        short: Continent code.
        type: keyword
    continent_name:
      field_details:
        dashed_name: geo-continent-name
        description: Name of the continent.
        example: North America
        flat_name: geo.continent_name
        ignore_above: 1024
        level: core
        name: continent_name
        node_name: continent_name
        normalize: []
        short: Name of the continent.
        type: keyword
    country_iso_code:
      field_details:
        dashed_name: geo-country-iso-code
        description: Country ISO code.
        example: CA
        flat_name: geo.country_iso_code
        ignore_above: 1024
        level: core
        name: country_iso_code
        node_name: country_iso_code
        normalize: []
        short: Country ISO code.
        type: keyword
    country_name:
      field_details:
        dashed_name: geo-country-name
        description: Country name.
        example: Canada
        flat_name: geo.country_name
        ignore_above: 1024
        level: core
        name: country_name
        node_name: country_name
        normalize: []
        short: Country name.
        type: keyword
    location:
      field_details:
        dashed_name: geo-location
        description: Longitude and latitude.
        example: '{ "lon": -73.614830, "lat": 45.505918 }'
        flat_name: geo.location
        level: core
        name: location
        node_name: location
        normalize: []
        short: Longitude and latitude.
        type: geo_point
    name:
      field_details:
        dashed_name: geo-name
        description: 'User-defined description of a location, at the level of granularity
          they care about.

          Could be the name of their data centers, the floor number, if this describes
          a local physical entity, city names.

          Not typically used in automated geolocation.'
        example: boston-dc
        flat_name: geo.name
        ignore_above: 1024
        level: extended
        name: name
        node_name: name
        normalize: []
        short: User-defined description of a location.
        type: keyword
    postal_code:
      field_details:
        dashed_name: geo-postal-code
        description: 'Postal code associated with the location.

          Values appropriate for this field may also be known as a postcode or ZIP
          code and will vary widely from country to country.'
        example: 94040
        flat_name: geo.postal_code
        ignore_above: 1024
        level: core
        name: postal_code
        node_name: postal_code
        normalize: []
        short: Postal code.
        type: keyword
    region_iso_code:
      field_details:
        dashed_name: geo-region-iso-code
        description: Region ISO code.
        example: CA-QC
        flat_name: geo.region_iso_code
        ignore_above: 1024
        level: core
        name: region_iso_code
        node_name: region_iso_code
        normalize: []
        short: Region ISO code.
        type: keyword
    region_name:
      field_details:
        dashed_name: geo-region-name
        description: Region name.
        example: Quebec
        flat_name: geo.region_name
        ignore_above: 1024
        level: core
        name: region_name
        node_name: region_name
        normalize: []
        short: Region name.
        type: keyword
    timezone:
      field_details:
        dashed_name: geo-timezone
        description: The time zone of the location, such as IANA time zone name.
        example: America/Argentina/Buenos_Aires
        flat_name: geo.timezone
        ignore_above: 1024
        level: core
        name: timezone
        node_name: timezone
        normalize: []
        short: Time zone.
        type: keyword
  schema_details:
    group: 2
    prefix: geo.
    reusable:
      expected:
      - as: geo
        at: client
        full: client.geo
      - as: geo
        at: destination
        full: destination.geo
      - as: geo
        at: observer
        full: observer.geo
      - as: geo
        at: host
        full: host.geo
      - as: geo
        at: server
        full: server.geo
      - as: geo
        at: source
        full: source.geo
      - as: geo
        at: threat.indicator
        beta: Reusing the `geo` fields in this location is currently considered beta.
        full: threat.indicator.geo
      - as: geo
        at: threat.enrichments.indicator
        beta: Reusing the `geo` fields in this location is currently considered beta.
        full: threat.enrichments.indicator.geo
      order: 2
      top_level: false
    root: false
    title: Geo
git:
  field_details:
    dashed_name: git
    description: Fields related to git repositories
    flat_name: git
    name: git
    node_name: git
    short: Fields related to git repositories
    type: group
  fields:
    commit:
      field_details:
        dashed_name: git-commit
        flat_name: git.commit
        intermediate: true
        name: commit
        node_name: commit
        type: object
      fields:
        author:
          field_details:
            dashed_name: git-commit-author
            description: The author of the git commit
            flat_name: git.commit.author
            ignore_above: 1024
            level: custom
            name: commit.author
            node_name: author
            normalize: []
            short: The author of the git commit
            type: keyword
        hash:
          field_details:
            dashed_name: git-commit-hash
            flat_name: git.commit.hash
            intermediate: true
            name: commit.hash
            node_name: hash
            type: object
          fields:
            sha1:
              field_details:
                dashed_name: git-commit-hash-sha1
                flat_name: git.commit.hash.sha1
                intermediate: true
                name: commit.hash.sha1
                node_name: sha1
                type: object
              fields:
                full:
                  field_details:
                    dashed_name: git-commit-hash-sha1-full
                    description: The full sha1 hash of a git commit
                    flat_name: git.commit.hash.sha1.full
                    ignore_above: 1024
                    level: custom
                    name: commit.hash.sha1.full
                    node_name: full
                    normalize: []
                    short: The full sha1 hash of a git commit
                    type: keyword
                short:
                  field_details:
                    dashed_name: git-commit-hash-sha1-short
                    description: The short sha1 hash of a git commit
                    flat_name: git.commit.hash.sha1.short
                    ignore_above: 1024
                    level: custom
                    name: commit.hash.sha1.short
                    node_name: short
                    normalize: []
                    short: The short sha1 hash of a git commit
                    type: keyword
    repo:
      field_details:
        dashed_name: git-repo
        flat_name: git.repo
        intermediate: true
        name: repo
        node_name: repo
        type: object
      fields:
        name:
          field_details:
            dashed_name: git-repo-name
            description: The name of the git repo
            flat_name: git.repo.name
            ignore_above: 1024
            level: custom
            name: repo.name
            node_name: name
            normalize: []
            short: The name of the git repo
            type: keyword
        url:
          field_details:
            dashed_name: git-repo-url
            flat_name: git.repo.url
            intermediate: true
            name: repo.url
            node_name: url
            type: object
          fields:
            domain:
              field_details:
                dashed_name: git-repo-url-domain
                description: Domain of the url
                flat_name: git.repo.url.domain
                ignore_above: 1024
                level: custom
                name: repo.url.domain
                node_name: domain
                normalize: []
                short: Domain of the url
                type: keyword
            full:
              field_details:
                dashed_name: git-repo-url-full
                description: Unmodified original url as seen in the event source.
                flat_name: git.repo.url.full
                ignore_above: 1024
                level: custom
                name: repo.url.full
                node_name: full
                normalize: []
                short: The full url
                type: keyword
            original:
              field_details:
                dashed_name: git-repo-url-original
                description: Unmodified original url as seen in the event source.
                flat_name: git.repo.url.original
                ignore_above: 1024
                level: custom
                name: repo.url.original
                node_name: original
                normalize: []
                short: Unmodified original url as seen in the event source.
                type: keyword
            scheme:
              field_details:
                dashed_name: git-repo-url-scheme
                description: Scheme of the request, such as "https" or "ssh"
                flat_name: git.repo.url.scheme
                ignore_above: 1024
                level: custom
                name: repo.url.scheme
                node_name: scheme
                normalize: []
                short: Scheme of the request, such as "https" or "ssh"
                type: keyword
  schema_details:
    group: 2
    prefix: git.
    root: false
    title: Git
hash:
  field_details:
    dashed_name: hash
    description: 'The hash fields represent different bitwise hash algorithms and
      their values.

      Field names for common hashes (e.g. MD5, SHA1) are predefined. Add fields for
      other hashes by lowercasing the hash algorithm name and using underscore separators
      as appropriate (snake case, e.g. sha3_512).

      Note that this fieldset is used for common hashes that may be computed over
      a range of generic bytes. Entity-specific hashes such as ja3 or imphash are
      placed in the fieldsets to which they relate (tls and pe, respectively).'
    flat_name: hash
    name: hash
    node_name: hash
    short: Hashes, usually file hashes.
    type: group
  fields:
    md5:
      field_details:
        dashed_name: hash-md5
        description: MD5 hash.
        flat_name: hash.md5
        ignore_above: 1024
        level: extended
        name: md5
        node_name: md5
        normalize: []
        short: MD5 hash.
        type: keyword
    sha1:
      field_details:
        dashed_name: hash-sha1
        description: SHA1 hash.
        flat_name: hash.sha1
        ignore_above: 1024
        level: extended
        name: sha1
        node_name: sha1
        normalize: []
        short: SHA1 hash.
        type: keyword
    sha256:
      field_details:
        dashed_name: hash-sha256
        description: SHA256 hash.
        flat_name: hash.sha256
        ignore_above: 1024
        level: extended
        name: sha256
        node_name: sha256
        normalize: []
        short: SHA256 hash.
        type: keyword
    sha512:
      field_details:
        dashed_name: hash-sha512
        description: SHA512 hash.
        flat_name: hash.sha512
        ignore_above: 1024
        level: extended
        name: sha512
        node_name: sha512
        normalize: []
        short: SHA512 hash.
        type: keyword
    ssdeep:
      field_details:
        dashed_name: hash-ssdeep
        description: SSDEEP hash.
        flat_name: hash.ssdeep
        ignore_above: 1024
        level: extended
        name: ssdeep
        node_name: ssdeep
        normalize: []
        short: SSDEEP hash.
        type: keyword
  schema_details:
    group: 2
    prefix: hash.
    reusable:
      expected:
      - as: hash
        at: file
        full: file.hash
      - as: hash
        at: process
        full: process.hash
      - as: hash
        at: dll
        full: dll.hash
      - as: hash
        at: threat.indicator
        beta: Reusing the `hash` fields in this location is currently considered beta.
        full: threat.indicator.hash
      - as: hash
        at: threat.enrichments.indicator
        beta: Reusing the `hash` fields in this location is currently considered beta.
        full: threat.enrichments.indicator.hash
      order: 2
      top_level: false
    root: false
    title: Hash
host:
  field_details:
    dashed_name: host
    description: 'A host is defined as a general computing instance.

      ECS host.* fields should be populated with details about the host on which the
      event happened, or from which the measurement was taken. Host types include
      hardware, virtual machines, Docker containers, and Kubernetes nodes.'
    flat_name: host
    name: host
    node_name: host
    short: Fields describing the relevant computing instance.
    type: group
  fields:
    architecture:
      field_details:
        dashed_name: host-architecture
        description: Operating system architecture.
        example: x86_64
        flat_name: host.architecture
        ignore_above: 1024
        level: core
        name: architecture
        node_name: architecture
        normalize: []
        short: Operating system architecture.
        type: keyword
    cpu:
      field_details:
        dashed_name: host-cpu
        flat_name: host.cpu
        intermediate: true
        name: cpu
        node_name: cpu
        type: object
      fields:
        usage:
          field_details:
            dashed_name: host-cpu-usage
            description: 'Percent CPU used which is normalized by the number of CPU
              cores and it ranges from 0 to 1.

              Scaling factor: 1000.

              For example: For a two core host, this value should be the average of
              the two cores, between 0 and 1.'
            flat_name: host.cpu.usage
            level: extended
            name: cpu.usage
            node_name: usage
            normalize: []
            scaling_factor: 1000
            short: Percent CPU used, between 0 and 1.
            type: scaled_float
    disk:
      field_details:
        dashed_name: host-disk
        flat_name: host.disk
        intermediate: true
        name: disk
        node_name: disk
        type: object
      fields:
        read:
          field_details:
            dashed_name: host-disk-read
            flat_name: host.disk.read
            intermediate: true
            name: disk.read
            node_name: read
            type: object
          fields:
            bytes:
              field_details:
                dashed_name: host-disk-read-bytes
                description: The total number of bytes (gauge) read successfully (aggregated
                  from all disks) since the last metric collection.
                flat_name: host.disk.read.bytes
                level: extended
                name: disk.read.bytes
                node_name: bytes
                normalize: []
                short: The number of bytes read by all disks.
                type: long
        write:
          field_details:
            dashed_name: host-disk-write
            flat_name: host.disk.write
            intermediate: true
            name: disk.write
            node_name: write
            type: object
          fields:
            bytes:
              field_details:
                dashed_name: host-disk-write-bytes
                description: The total number of bytes (gauge) written successfully
                  (aggregated from all disks) since the last metric collection.
                flat_name: host.disk.write.bytes
                level: extended
                name: disk.write.bytes
                node_name: bytes
                normalize: []
                short: The number of bytes written on all disks.
                type: long
    domain:
      field_details:
        dashed_name: host-domain
        description: 'Name of the domain of which the host is a member.

          For example, on Windows this could be the host''s Active Directory domain
          or NetBIOS domain name. For Linux this could be the domain of the host''s
          LDAP provider.'
        example: CONTOSO
        flat_name: host.domain
        ignore_above: 1024
        level: extended
        name: domain
        node_name: domain
        normalize: []
        short: Name of the directory the group is a member of.
        type: keyword
    geo:
      field_details:
        dashed_name: host-geo
        description: 'Geo fields can carry data about a specific location related
          to an event.

          This geolocation information can be derived from techniques such as Geo
          IP, or be user-supplied.'
        flat_name: host.geo
        intermediate: true
        name: geo
        node_name: geo
        original_fieldset: geo
        short: Fields describing a location.
        type: group
      fields:
        city_name:
          field_details:
            dashed_name: host-geo-city-name
            description: City name.
            example: Montreal
            flat_name: host.geo.city_name
            ignore_above: 1024
            level: core
            name: city_name
            node_name: city_name
            normalize: []
            original_fieldset: geo
            short: City name.
            type: keyword
        continent_code:
          field_details:
            dashed_name: host-geo-continent-code
            description: Two-letter code representing continent's name.
            example: NA
            flat_name: host.geo.continent_code
            ignore_above: 1024
            level: core
            name: continent_code
            node_name: continent_code
            normalize: []
            original_fieldset: geo
            short: Continent code.
            type: keyword
        continent_name:
          field_details:
            dashed_name: host-geo-continent-name
            description: Name of the continent.
            example: North America
            flat_name: host.geo.continent_name
            ignore_above: 1024
            level: core
            name: continent_name
            node_name: continent_name
            normalize: []
            original_fieldset: geo
            short: Name of the continent.
            type: keyword
        country_iso_code:
          field_details:
            dashed_name: host-geo-country-iso-code
            description: Country ISO code.
            example: CA
            flat_name: host.geo.country_iso_code
            ignore_above: 1024
            level: core
            name: country_iso_code
            node_name: country_iso_code
            normalize: []
            original_fieldset: geo
            short: Country ISO code.
            type: keyword
        country_name:
          field_details:
            dashed_name: host-geo-country-name
            description: Country name.
            example: Canada
            flat_name: host.geo.country_name
            ignore_above: 1024
            level: core
            name: country_name
            node_name: country_name
            normalize: []
            original_fieldset: geo
            short: Country name.
            type: keyword
        location:
          field_details:
            dashed_name: host-geo-location
            description: Longitude and latitude.
            example: '{ "lon": -73.614830, "lat": 45.505918 }'
            flat_name: host.geo.location
            level: core
            name: location
            node_name: location
            normalize: []
            original_fieldset: geo
            short: Longitude and latitude.
            type: geo_point
        name:
          field_details:
            dashed_name: host-geo-name
            description: 'User-defined description of a location, at the level of
              granularity they care about.

              Could be the name of their data centers, the floor number, if this describes
              a local physical entity, city names.

              Not typically used in automated geolocation.'
            example: boston-dc
            flat_name: host.geo.name
            ignore_above: 1024
            level: extended
            name: name
            node_name: name
            normalize: []
            original_fieldset: geo
            short: User-defined description of a location.
            type: keyword
        postal_code:
          field_details:
            dashed_name: host-geo-postal-code
            description: 'Postal code associated with the location.

              Values appropriate for this field may also be known as a postcode or
              ZIP code and will vary widely from country to country.'
            example: 94040
            flat_name: host.geo.postal_code
            ignore_above: 1024
            level: core
            name: postal_code
            node_name: postal_code
            normalize: []
            original_fieldset: geo
            short: Postal code.
            type: keyword
        region_iso_code:
          field_details:
            dashed_name: host-geo-region-iso-code
            description: Region ISO code.
            example: CA-QC
            flat_name: host.geo.region_iso_code
            ignore_above: 1024
            level: core
            name: region_iso_code
            node_name: region_iso_code
            normalize: []
            original_fieldset: geo
            short: Region ISO code.
            type: keyword
        region_name:
          field_details:
            dashed_name: host-geo-region-name
            description: Region name.
            example: Quebec
            flat_name: host.geo.region_name
            ignore_above: 1024
            level: core
            name: region_name
            node_name: region_name
            normalize: []
            original_fieldset: geo
            short: Region name.
            type: keyword
        timezone:
          field_details:
            dashed_name: host-geo-timezone
            description: The time zone of the location, such as IANA time zone name.
            example: America/Argentina/Buenos_Aires
            flat_name: host.geo.timezone
            ignore_above: 1024
            level: core
            name: timezone
            node_name: timezone
            normalize: []
            original_fieldset: geo
            short: Time zone.
            type: keyword
    hostname:
      field_details:
        dashed_name: host-hostname
        description: 'Hostname of the host.

          It normally contains what the `hostname` command returns on the host machine.'
        flat_name: host.hostname
        ignore_above: 1024
        level: core
        name: hostname
        node_name: hostname
        normalize: []
        short: Hostname of the host.
        type: keyword
    id:
      field_details:
        dashed_name: host-id
        description: 'Unique host id.

          As hostname is not always unique, use values that are meaningful in your
          environment.

          Example: The current usage of `beat.name`.'
        flat_name: host.id
        ignore_above: 1024
        level: core
        name: id
        node_name: id
        normalize: []
        short: Unique host id.
        type: keyword
    ip:
      field_details:
        dashed_name: host-ip
        description: Host ip addresses.
        flat_name: host.ip
        level: core
        name: ip
        node_name: ip
        normalize:
        - array
        short: Host ip addresses.
        type: ip
    mac:
      field_details:
        dashed_name: host-mac
        description: 'Host MAC addresses.

          The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit
          byte) is represented by two [uppercase] hexadecimal digits giving the value
          of the octet as an unsigned integer. Successive octets are separated by
          a hyphen.'
        example: '["00-00-5E-00-53-23", "00-00-5E-00-53-24"]'
        flat_name: host.mac
        ignore_above: 1024
        level: core
        name: mac
        node_name: mac
        normalize:
        - array
        short: Host MAC addresses.
        type: keyword
    name:
      field_details:
        dashed_name: host-name
        description: 'Name of the host.

          It can contain what `hostname` returns on Unix systems, the fully qualified
          domain name, or a name specified by the user. The sender decides which value
          to use.'
        flat_name: host.name
        ignore_above: 1024
        level: core
        name: name
        node_name: name
        normalize: []
        short: Name of the host.
        type: keyword
    network:
      field_details:
        dashed_name: host-network
        flat_name: host.network
        intermediate: true
        name: network
        node_name: network
        type: object
      fields:
        egress:
          field_details:
            dashed_name: host-network-egress
            flat_name: host.network.egress
            intermediate: true
            name: network.egress
            node_name: egress
            type: object
          fields:
            bytes:
              field_details:
                dashed_name: host-network-egress-bytes
                description: The number of bytes (gauge) sent out on all network interfaces
                  by the host since the last metric collection.
                flat_name: host.network.egress.bytes
                level: extended
                name: network.egress.bytes
                node_name: bytes
                normalize: []
                short: The number of bytes sent on all network interfaces.
                type: long
            packets:
              field_details:
                dashed_name: host-network-egress-packets
                description: The number of packets (gauge) sent out on all network
                  interfaces by the host since the last metric collection.
                flat_name: host.network.egress.packets
                level: extended
                name: network.egress.packets
                node_name: packets
                normalize: []
                short: The number of packets sent on all network interfaces.
                type: long
        ingress:
          field_details:
            dashed_name: host-network-ingress
            flat_name: host.network.ingress
            intermediate: true
            name: network.ingress
            node_name: ingress
            type: object
          fields:
            bytes:
              field_details:
                dashed_name: host-network-ingress-bytes
                description: The number of bytes received (gauge) on all network interfaces
                  by the host since the last metric collection.
                flat_name: host.network.ingress.bytes
                level: extended
                name: network.ingress.bytes
                node_name: bytes
                normalize: []
                short: The number of bytes received on all network interfaces.
                type: long
            packets:
              field_details:
                dashed_name: host-network-ingress-packets
                description: The number of packets (gauge) received on all network
                  interfaces by the host since the last metric collection.
                flat_name: host.network.ingress.packets
                level: extended
                name: network.ingress.packets
                node_name: packets
                normalize: []
                short: The number of packets received on all network interfaces.
                type: long
    os:
      field_details:
        dashed_name: host-os
        description: The OS fields contain information about the operating system.
        flat_name: host.os
        intermediate: true
        name: os
        node_name: os
        original_fieldset: os
        short: OS fields contain information about the operating system.
        type: group
      fields:
        family:
          field_details:
            dashed_name: host-os-family
            description: OS family (such as redhat, debian, freebsd, windows).
            example: debian
            flat_name: host.os.family
            ignore_above: 1024
            level: extended
            name: family
            node_name: family
            normalize: []
            original_fieldset: os
            short: OS family (such as redhat, debian, freebsd, windows).
            type: keyword
        full:
          field_details:
            dashed_name: host-os-full
            description: Operating system name, including the version or code name.
            example: Mac OS Mojave
            flat_name: host.os.full
            ignore_above: 1024
            level: extended
            multi_fields:
            - flat_name: host.os.full.text
              name: text
              norms: false
              type: text
            name: full
            node_name: full
            normalize: []
            original_fieldset: os
            short: Operating system name, including the version or code name.
            type: keyword
        kernel:
          field_details:
            dashed_name: host-os-kernel
            description: Operating system kernel version as a raw string.
            example: 4.4.0-112-generic
            flat_name: host.os.kernel
            ignore_above: 1024
            level: extended
            name: kernel
            node_name: kernel
            normalize: []
            original_fieldset: os
            short: Operating system kernel version as a raw string.
            type: keyword
        name:
          field_details:
            dashed_name: host-os-name
            description: Operating system name, without the version.
            example: Mac OS X
            flat_name: host.os.name
            ignore_above: 1024
            level: extended
            multi_fields:
            - flat_name: host.os.name.text
              name: text
              norms: false
              type: text
            name: name
            node_name: name
            normalize: []
            original_fieldset: os
            short: Operating system name, without the version.
            type: keyword
        platform:
          field_details:
            dashed_name: host-os-platform
            description: Operating system platform (such centos, ubuntu, windows).
            example: darwin
            flat_name: host.os.platform
            ignore_above: 1024
            level: extended
            name: platform
            node_name: platform
            normalize: []
            original_fieldset: os
            short: Operating system platform (such centos, ubuntu, windows).
            type: keyword
        type:
          field_details:
            dashed_name: host-os-type
            description: 'Use the `os.type` field to categorize the operating system
              into one of the broad commercial families.

              One of these following values should be used (lowercase): linux, macos,
              unix, windows.

              If the OS you''re dealing with is not in the list, the field should
              not be populated. Please let us know by opening an issue with ECS, to
              propose its addition.'
            example: macos
            flat_name: host.os.type
            ignore_above: 1024
            level: extended
            name: type
            node_name: type
            normalize: []
            original_fieldset: os
            short: 'Which commercial OS family (one of: linux, macos, unix or windows).'
            type: keyword
        version:
          field_details:
            dashed_name: host-os-version
            description: Operating system version as a raw string.
            example: 10.14.1
            flat_name: host.os.version
            ignore_above: 1024
            level: extended
            name: version
            node_name: version
            normalize: []
            original_fieldset: os
            short: Operating system version as a raw string.
            type: keyword
    type:
      field_details:
        dashed_name: host-type
        description: 'Type of host.

          For Cloud providers this can be the machine type like `t2.medium`. If vm,
          this could be the container, for example, or other information meaningful
          in your environment.'
        flat_name: host.type
        ignore_above: 1024
        level: core
        name: type
        node_name: type
        normalize: []
        short: Type of host.
        type: keyword
    uptime:
      field_details:
        dashed_name: host-uptime
        description: Seconds the host has been up.
        example: 1325
        flat_name: host.uptime
        level: extended
        name: uptime
        node_name: uptime
        normalize: []
        short: Seconds the host has been up.
        type: long
    user:
      field_details:
        dashed_name: host-user
        description: 'The user fields describe information about the user that is
          relevant to the event.

          Fields can have one entry or multiple entries. If a user has more than one
          id, provide an array that includes all of them.'
        flat_name: host.user
        intermediate: true
        name: user
        node_name: user
        original_fieldset: user
        short: Fields to describe the user relevant to the event.
        type: group
      fields:
        domain:
          field_details:
            dashed_name: host-user-domain
            description: 'Name of the directory the user is a member of.

              For example, an LDAP or Active Directory domain name.'
            flat_name: host.user.domain
            ignore_above: 1024
            level: extended
            name: domain
            node_name: domain
            normalize: []
            original_fieldset: user
            short: Name of the directory the user is a member of.
            type: keyword
        email:
          field_details:
            dashed_name: host-user-email
            description: User email address.
            flat_name: host.user.email
            ignore_above: 1024
            level: extended
            name: email
            node_name: email
            normalize: []
            original_fieldset: user
            short: User email address.
            type: keyword
        extra:
          field_details:
            dashed_name: host-user-extra
            description: 'Additional information in key/value pairs.

              For additional information provided by the authenticator to events.

              Note: Not searchable or filterable.'
            enabled: false
            example: '{"authenticator": "ldap", "cipher": "argon2"}'
            flat_name: host.user.extra
            level: custom
            name: extra
            node_name: extra
            normalize: []
            object_type: keyword
            original_fieldset: user
            short: Custom key/value pairs.
            type: object
        full_name:
          field_details:
            dashed_name: host-user-full-name
            description: User's full name, if available.
            example: Albert Einstein
            flat_name: host.user.full_name
            ignore_above: 1024
            level: extended
            multi_fields:
            - flat_name: host.user.full_name.text
              name: text
              norms: false
              type: text
            name: full_name
            node_name: full_name
            normalize: []
            original_fieldset: user
            short: User's full name, if available.
            type: keyword
        group:
          field_details:
            dashed_name: host-user-group
            description: The group fields are meant to represent groups that are relevant
              to the event.
            flat_name: host.user.group
            intermediate: true
            name: group
            node_name: group
            original_fieldset: group
            short: User's group relevant to the event.
            type: group
          fields:
            domain:
              field_details:
                dashed_name: host-user-group-domain
                description: 'Name of the directory the group is a member of.

                  For example, an LDAP or Active Directory domain name.'
                flat_name: host.user.group.domain
                ignore_above: 1024
                level: extended
                name: domain
                node_name: domain
                normalize: []
                original_fieldset: group
                short: Name of the directory the group is a member of.
                type: keyword
            id:
              field_details:
                dashed_name: host-user-group-id
                description: Unique identifier for the group on the system/platform.
                flat_name: host.user.group.id
                ignore_above: 1024
                level: extended
                name: id
                node_name: id
                normalize: []
                original_fieldset: group
                short: Unique identifier for the group on the system/platform.
                type: keyword
            name:
              field_details:
                dashed_name: host-user-group-name
                description: Name of the group.
                flat_name: host.user.group.name
                ignore_above: 1024
                level: extended
                name: name
                node_name: name
                normalize: []
                original_fieldset: group
                short: Name of the group.
                type: keyword
        hash:
          field_details:
            dashed_name: host-user-hash
            description: 'Unique user hash to correlate information for a user in
              anonymized form.

              Useful if `user.id` or `user.name` contain confidential information
              and cannot be used.'
            flat_name: host.user.hash
            ignore_above: 1024
            level: extended
            name: hash
            node_name: hash
            normalize: []
            original_fieldset: user
            short: Unique user hash to correlate information for a user in anonymized
              form.
            type: keyword
        id:
          field_details:
            dashed_name: host-user-id
            description: Unique identifier of the user.
            flat_name: host.user.id
            ignore_above: 1024
            level: core
            name: id
            node_name: id
            normalize: []
            original_fieldset: user
            short: Unique identifier of the user.
            type: keyword
        name:
          field_details:
            dashed_name: host-user-name
            description: Short name or login of the user.
            example: albert
            flat_name: host.user.name
            ignore_above: 1024
            level: core
            multi_fields:
            - flat_name: host.user.name.text
              name: text
              norms: false
              type: text
            name: name
            node_name: name
            normalize: []
            original_fieldset: user
            short: Short name or login of the user.
            type: keyword
        roles:
          field_details:
            dashed_name: host-user-roles
            description: Array of user roles at the time of the event.
            example: '["kibana_admin", "reporting_user"]'
            flat_name: host.user.roles
            ignore_above: 1024
            level: extended
            name: roles
            node_name: roles
            normalize:
            - array
            original_fieldset: user
            short: Array of user roles at the time of the event.
            type: keyword
  schema_details:
    group: 2
    nestings:
    - host.geo
    - host.os
    - host.user
    prefix: host.
    reused_here:
    - full: host.geo
      schema_name: geo
      short: Fields describing a location.
    - full: host.os
      schema_name: os
      short: OS fields contain information about the operating system.
    - full: host.user
      schema_name: user
      short: This reuse is deprecated and will be removed in the next major ECS version.
    root: false
    title: Host
http:
  field_details:
    dashed_name: http
    description: Fields related to HTTP activity. Use the `url` field set to store
      the url of the request.
    flat_name: http
    name: http
    node_name: http
    short: Fields describing an HTTP request.
    type: group
  fields:
    request:
      field_details:
        dashed_name: http-request
        flat_name: http.request
        intermediate: true
        name: request
        node_name: request
        type: object
      fields:
        body:
          field_details:
            dashed_name: http-request-body
            flat_name: http.request.body
            intermediate: true
            name: request.body
            node_name: body
            type: object
          fields:
            bytes:
              field_details:
                dashed_name: http-request-body-bytes
                description: Size in bytes of the request body.
                example: 887
                flat_name: http.request.body.bytes
                format: bytes
                level: extended
                name: request.body.bytes
                node_name: bytes
                normalize: []
                short: Size in bytes of the request body.
                type: long
            content:
              field_details:
                dashed_name: http-request-body-content
                description: The full HTTP request body.
                example: Hello world
                flat_name: http.request.body.content
                ignore_above: 1024
                level: extended
                multi_fields:
                - flat_name: http.request.body.content.text
                  name: text
                  norms: false
                  type: text
                name: request.body.content
                node_name: content
                normalize: []
                short: The full HTTP request body.
                type: keyword
        bytes:
          field_details:
            dashed_name: http-request-bytes
            description: Total size in bytes of the request (body and headers).
            example: 1437
            flat_name: http.request.bytes
            format: bytes
            level: extended
            name: request.bytes
            node_name: bytes
            normalize: []
            short: Total size in bytes of the request (body and headers).
            type: long
        headers:
          field_details:
            dashed_name: http-request-headers
            description: 'Request headers in key/value pairs.

              Can be used add request header information to events. Should not contain
              nested objects. All values are stored as keyword.'
            example: '{"content-type": "application/json", "cache-status": "Miss"}'
            flat_name: http.request.headers
            level: custom
            name: request.headers
            node_name: headers
            normalize: []
            object_type: keyword
            short: Custom key/value pairs.
            type: object
        id:
          field_details:
            dashed_name: http-request-id
            description: 'A unique identifier for each HTTP request to correlate logs
              between clients and servers in transactions.

              The id may be contained in a non-standard HTTP header, such as `X-Request-ID`
              or `X-Correlation-ID`.'
            example: 123e4567-e89b-12d3-a456-426614174000
            flat_name: http.request.id
            ignore_above: 1024
            level: extended
            name: request.id
            node_name: id
            normalize: []
            short: HTTP request ID.
            type: keyword
        method:
          field_details:
            dashed_name: http-request-method
            description: 'HTTP request method.

              Prior to ECS 1.6.0 the following guidance was provided:

              "The field value must be normalized to lowercase for querying."

              As of ECS 1.6.0, the guidance is deprecated because the original case
              of the method may be useful in anomaly detection.  Original case will
              be mandated in ECS 2.0.0'
            example: GET, POST, PUT, PoST
            flat_name: http.request.method
            ignore_above: 1024
            level: extended
            name: request.method
            node_name: method
            normalize: []
            short: HTTP request method.
            type: keyword
        mime_type:
          field_details:
            dashed_name: http-request-mime-type
            description: 'Mime type of the body of the request.

              This value must only be populated based on the content of the request
              body, not on the `Content-Type` header. Comparing the mime type of a
              request with the request''s Content-Type header can be helpful in detecting
              threats or misconfigured clients.'
            example: image/gif
            flat_name: http.request.mime_type
            ignore_above: 1024
            level: extended
            name: request.mime_type
            node_name: mime_type
            normalize: []
            short: Mime type of the body of the request.
            type: keyword
        referrer:
          field_details:
            dashed_name: http-request-referrer
            description: Referrer for this HTTP request.
            example: https://blog.example.com/
            flat_name: http.request.referrer
            ignore_above: 1024
            level: extended
            name: request.referrer
            node_name: referrer
            normalize: []
            short: Referrer for this HTTP request.
            type: keyword
    response:
      field_details:
        dashed_name: http-response
        flat_name: http.response
        intermediate: true
        name: response
        node_name: response
        type: object
      fields:
        body:
          field_details:
            dashed_name: http-response-body
            flat_name: http.response.body
            intermediate: true
            name: response.body
            node_name: body
            type: object
          fields:
            bytes:
              field_details:
                dashed_name: http-response-body-bytes
                description: Size in bytes of the response body.
                example: 887
                flat_name: http.response.body.bytes
                format: bytes
                level: extended
                name: response.body.bytes
                node_name: bytes
                normalize: []
                short: Size in bytes of the response body.
                type: long
            content:
              field_details:
                dashed_name: http-response-body-content
                description: The full HTTP response body.
                example: Hello world
                flat_name: http.response.body.content
                ignore_above: 1024
                level: extended
                multi_fields:
                - flat_name: http.response.body.content.text
                  name: text
                  norms: false
                  type: text
                name: response.body.content
                node_name: content
                normalize: []
                short: The full HTTP response body.
                type: keyword
        bytes:
          field_details:
            dashed_name: http-response-bytes
            description: Total size in bytes of the response (body and headers).
            example: 1437
            flat_name: http.response.bytes
            format: bytes
            level: extended
            name: response.bytes
            node_name: bytes
            normalize: []
            short: Total size in bytes of the response (body and headers).
            type: long
        headers:
          field_details:
            dashed_name: http-response-headers
            description: 'Response headers in key/value pairs.

              Can be used add response header information to events. Should not contain
              nested objects. All values are stored as keyword.'
            example: '{"content-type": "application/json", "cache-status": "Miss"}'
            flat_name: http.response.headers
            level: custom
            name: response.headers
            node_name: headers
            normalize: []
            object_type: keyword
            short: Custom key/value pairs.
            type: object
        mime_type:
          field_details:
            dashed_name: http-response-mime-type
            description: 'Mime type of the body of the response.

              This value must only be populated based on the content of the response
              body, not on the `Content-Type` header. Comparing the mime type of a
              response with the response''s Content-Type header can be helpful in
              detecting misconfigured servers.'
            example: image/gif
            flat_name: http.response.mime_type
            ignore_above: 1024
            level: extended
            name: response.mime_type
            node_name: mime_type
            normalize: []
            short: Mime type of the body of the response.
            type: keyword
        status_code:
          field_details:
            dashed_name: http-response-status-code
            description: HTTP response status code.
            example: 404
            flat_name: http.response.status_code
            format: string
            level: extended
            name: response.status_code
            node_name: status_code
            normalize: []
            short: HTTP response status code.
            type: long
    version:
      field_details:
        dashed_name: http-version
        description: HTTP version.
        example: 1.1
        flat_name: http.version
        ignore_above: 1024
        level: extended
        name: version
        node_name: version
        normalize: []
        short: HTTP version.
        type: keyword
  schema_details:
    group: 2
    prefix: http.
    root: false
    title: HTTP
interface:
  field_details:
    dashed_name: interface
    description: The interface fields are used to record ingress and egress interface
      information when reported by an observer (e.g. firewall, router, load balancer)
      in the context of the observer handling a network connection.  In the case of
      a single observer interface (e.g. network sensor on a span port) only the observer.ingress
      information should be populated.
    flat_name: interface
    name: interface
    node_name: interface
    short: Fields to describe observer interface information.
    type: group
  fields:
    alias:
      field_details:
        dashed_name: interface-alias
        description: Interface alias as reported by the system, typically used in
          firewall implementations for e.g. inside, outside, or dmz logical interface
          naming.
        example: outside
        flat_name: interface.alias
        ignore_above: 1024
        level: extended
        name: alias
        node_name: alias
        normalize: []
        short: Interface alias
        type: keyword
    id:
      field_details:
        dashed_name: interface-id
        description: Interface ID as reported by an observer (typically SNMP interface
          ID).
        example: 10
        flat_name: interface.id
        ignore_above: 1024
        level: extended
        name: id
        node_name: id
        normalize: []
        short: Interface ID
        type: keyword
    name:
      field_details:
        dashed_name: interface-name
        description: Interface name as reported by the system.
        example: eth0
        flat_name: interface.name
        ignore_above: 1024
        level: extended
        name: name
        node_name: name
        normalize: []
        short: Interface name
        type: keyword
  schema_details:
    group: 2
    prefix: interface.
    reusable:
      expected:
      - as: interface
        at: observer.ingress
        full: observer.ingress.interface
      - as: interface
        at: observer.egress
        full: observer.egress.interface
      order: 2
      top_level: false
    root: false
    title: Interface
log:
  field_details:
    dashed_name: log
    description: 'Details about the event''s logging mechanism or logging transport.

      The log.* fields are typically populated with details about the logging mechanism
      used to create and/or transport the event. For example, syslog details belong
      under `log.syslog.*`.

      The details specific to your event source are typically not logged under `log.*`,
      but rather in `event.*` or in other ECS fields.'
    flat_name: log
    name: log
    node_name: log
    short: Details about the event's logging mechanism.
    type: group
  fields:
    file:
      field_details:
        dashed_name: log-file
        flat_name: log.file
        intermediate: true
        name: file
        node_name: file
        type: object
      fields:
        path:
          field_details:
            dashed_name: log-file-path
            description: 'Full path to the log file this event came from, including
              the file name. It should include the drive letter, when appropriate.

              If the event wasn''t read from a log file, do not populate this field.'
            example: /var/log/fun-times.log
            flat_name: log.file.path
            ignore_above: 1024
            level: extended
            name: file.path
            node_name: path
            normalize: []
            short: Full path to the log file this event came from.
            type: keyword
    level:
      field_details:
        dashed_name: log-level
        description: 'Original log level of the log event.

          If the source of the event provides a log level or textual severity, this
          is the one that goes in `log.level`. If your source doesn''t specify one,
          you may put your event transport''s severity here (e.g. Syslog severity).

          Some examples are `warn`, `err`, `i`, `informational`.'
        example: error
        flat_name: log.level
        ignore_above: 1024
        level: core
        name: level
        node_name: level
        normalize: []
        short: Log level of the log event.
        type: keyword
    logger:
      field_details:
        dashed_name: log-logger
        description: The name of the logger inside an application. This is usually
          the name of the class which initialized the logger, or can be a custom name.
        example: org.elasticsearch.bootstrap.Bootstrap
        flat_name: log.logger
        ignore_above: 1024
        level: core
        name: logger
        node_name: logger
        normalize: []
        short: Name of the logger.
        type: keyword
    origin:
      field_details:
        dashed_name: log-origin
        flat_name: log.origin
        intermediate: true
        name: origin
        node_name: origin
        type: object
      fields:
        file:
          field_details:
            dashed_name: log-origin-file
            flat_name: log.origin.file
            intermediate: true
            name: origin.file
            node_name: file
            type: object
          fields:
            line:
              field_details:
                dashed_name: log-origin-file-line
                description: The line number of the file containing the source code
                  which originated the log event.
                example: 42
                flat_name: log.origin.file.line
                level: extended
                name: origin.file.line
                node_name: line
                normalize: []
                short: The line number of the file which originated the log event.
                type: integer
            name:
              field_details:
                dashed_name: log-origin-file-name
                description: 'The name of the file containing the source code which
                  originated the log event.

                  Note that this field is not meant to capture the log file. The correct
                  field to capture the log file is `log.file.path`.'
                example: Bootstrap.java
                flat_name: log.origin.file.name
                ignore_above: 1024
                level: extended
                name: origin.file.name
                node_name: name
                normalize: []
                short: The code file which originated the log event.
                type: keyword
        function:
          field_details:
            dashed_name: log-origin-function
            description: The name of the function or method which originated the log
              event.
            example: init
            flat_name: log.origin.function
            ignore_above: 1024
            level: extended
            name: origin.function
            node_name: function
            normalize: []
            short: The function which originated the log event.
            type: keyword
    original:
      field_details:
        dashed_name: log-original
        description: 'Deprecated for removal in next major version release. This field
          is superseded by  `event.original`.

          This is the original log message and contains the full log message before
          splitting it up in multiple parts.

          In contrast to the `message` field which can contain an extracted part of
          the log message, this field contains the original, full log message. It
          can have already some modifications applied like encoding or new lines removed
          to clean up the log message.

          This field is not indexed and doc_values are disabled so it can''t be queried
          but the value can be retrieved from `_source`.'
        doc_values: false
        example: Sep 19 08:26:10 localhost My log
        flat_name: log.original
        index: false
        level: core
        name: original
        node_name: original
        normalize: []
        short: Deprecated original log message with light interpretation only (encoding,
          newlines).
        type: keyword
    syslog:
      field_details:
        dashed_name: log-syslog
        description: The Syslog metadata of the event, if the event was transmitted
          via Syslog. Please see RFCs 5424 or 3164.
        flat_name: log.syslog
        intermediate: false
        level: extended
        name: syslog
        node_name: syslog
        normalize: []
        short: Syslog metadata
        type: object
      fields:
        facility:
          field_details:
            dashed_name: log-syslog-facility
            flat_name: log.syslog.facility
            intermediate: true
            name: syslog.facility
            node_name: facility
            type: object
          fields:
            code:
              field_details:
                dashed_name: log-syslog-facility-code
                description: 'The Syslog numeric facility of the log event, if available.

                  According to RFCs 5424 and 3164, this value should be an integer
                  between 0 and 23.'
                example: 23
                flat_name: log.syslog.facility.code
                format: string
                level: extended
                name: syslog.facility.code
                node_name: code
                normalize: []
                short: Syslog numeric facility of the event.
                type: long
            name:
              field_details:
                dashed_name: log-syslog-facility-name
                description: The Syslog text-based facility of the log event, if available.
                example: local7
                flat_name: log.syslog.facility.name
                ignore_above: 1024
                level: extended
                name: syslog.facility.name
                node_name: name
                normalize: []
                short: Syslog text-based facility of the event.
                type: keyword
        priority:
          field_details:
            dashed_name: log-syslog-priority
            description: 'Syslog numeric priority of the event, if available.

              According to RFCs 5424 and 3164, the priority is 8 * facility + severity.
              This number is therefore expected to contain a value between 0 and 191.'
            example: 135
            flat_name: log.syslog.priority
            format: string
            level: extended
            name: syslog.priority
            node_name: priority
            normalize: []
            short: Syslog priority of the event.
            type: long
        severity:
          field_details:
            dashed_name: log-syslog-severity
            flat_name: log.syslog.severity
            intermediate: true
            name: syslog.severity
            node_name: severity
            type: object
          fields:
            code:
              field_details:
                dashed_name: log-syslog-severity-code
                description: 'The Syslog numeric severity of the log event, if available.

                  If the event source publishing via Syslog provides a different numeric
                  severity value (e.g. firewall, IDS), your source''s numeric severity
                  should go to `event.severity`. If the event source does not specify
                  a distinct severity, you can optionally copy the Syslog severity
                  to `event.severity`.'
                example: 3
                flat_name: log.syslog.severity.code
                level: extended
                name: syslog.severity.code
                node_name: code
                normalize: []
                short: Syslog numeric severity of the event.
                type: long
            name:
              field_details:
                dashed_name: log-syslog-severity-name
                description: 'The Syslog numeric severity of the log event, if available.

                  If the event source publishing via Syslog provides a different severity
                  value (e.g. firewall, IDS), your source''s text severity should
                  go to `log.level`. If the event source does not specify a distinct
                  severity, you can optionally copy the Syslog severity to `log.level`.'
                example: Error
                flat_name: log.syslog.severity.name
                ignore_above: 1024
                level: extended
                name: syslog.severity.name
                node_name: name
                normalize: []
                short: Syslog text-based severity of the event.
                type: keyword
  schema_details:
    group: 2
    prefix: log.
    root: false
    title: Log
metrics:
  field_details:
    dashed_name: metrics
    description: 'Fields for metrics generated from logs.

      Subkeys of this field should generally follow Prometheus naming convention,
      paying particular attention to the suffix.

      "A metric name should have a suffix indicating the unit, in plural form."  e.g.
      ttfb.seconds, heap.bytes, size.megabytes etc.

      https://prometheus.io/docs/practices/naming/'
    flat_name: metrics
    name: metrics
    node_name: metrics
    short: Fields for metrics generated from logs.
    type: group
  fields:
    puppet:
      field_details:
        dashed_name: metrics-puppet
        flat_name: metrics.puppet
        intermediate: true
        name: puppet
        node_name: puppet
        type: object
      fields:
        changes:
          field_details:
            dashed_name: metrics-puppet-changes
            flat_name: metrics.puppet.changes
            intermediate: true
            name: puppet.changes
            node_name: changes
            type: object
          fields:
            total:
              field_details:
                dashed_name: metrics-puppet-changes-total
                description: total number of changes performed in a puppet run
                flat_name: metrics.puppet.changes.total
                level: custom
                name: puppet.changes.total
                node_name: total
                normalize: []
                short: total number of changes performed in a puppet run
                type: long
        resources:
          field_details:
            dashed_name: metrics-puppet-resources
            flat_name: metrics.puppet.resources
            intermediate: true
            name: puppet.resources
            node_name: resources
            type: object
          fields:
            changed:
              field_details:
                dashed_name: metrics-puppet-resources-changed
                flat_name: metrics.puppet.resources.changed
                intermediate: true
                name: puppet.resources.changed
                node_name: changed
                type: object
              fields:
                total:
                  field_details:
                    dashed_name: metrics-puppet-resources-changed-total
                    description: number of resources puppet changed
                    flat_name: metrics.puppet.resources.changed.total
                    level: custom
                    name: puppet.resources.changed.total
                    node_name: total
                    normalize: []
                    short: number of resources puppet changed
                    type: long
            corrective_change:
              field_details:
                dashed_name: metrics-puppet-resources-corrective-change
                flat_name: metrics.puppet.resources.corrective_change
                intermediate: true
                name: puppet.resources.corrective_change
                node_name: corrective_change
                type: object
              fields:
                total:
                  field_details:
                    dashed_name: metrics-puppet-resources-corrective-change-total
                    description: number of resources puppet corrective changes made
                    flat_name: metrics.puppet.resources.corrective_change.total
                    level: custom
                    name: puppet.resources.corrective_change.total
                    node_name: total
                    normalize: []
                    short: number of resources puppet corrective changes made
                    type: long
            failed:
              field_details:
                dashed_name: metrics-puppet-resources-failed
                flat_name: metrics.puppet.resources.failed
                intermediate: true
                name: puppet.resources.failed
                node_name: failed
                type: object
              fields:
                total:
                  field_details:
                    dashed_name: metrics-puppet-resources-failed-total
                    description: number of resources puppet failed to manage
                    flat_name: metrics.puppet.resources.failed.total
                    level: custom
                    name: puppet.resources.failed.total
                    node_name: total
                    normalize: []
                    short: number of resources puppet failed to manage
                    type: long
            failed_to_restart:
              field_details:
                dashed_name: metrics-puppet-resources-failed-to-restart
                flat_name: metrics.puppet.resources.failed_to_restart
                intermediate: true
                name: puppet.resources.failed_to_restart
                node_name: failed_to_restart
                type: object
              fields:
                total:
                  field_details:
                    dashed_name: metrics-puppet-resources-failed-to-restart-total
                    description: number of resources puppet failed to restart
                    flat_name: metrics.puppet.resources.failed_to_restart.total
                    level: custom
                    name: puppet.resources.failed_to_restart.total
                    node_name: total
                    normalize: []
                    short: number of resources puppet failed to restart
                    type: long
            out_of_sync:
              field_details:
                dashed_name: metrics-puppet-resources-out-of-sync
                flat_name: metrics.puppet.resources.out_of_sync
                intermediate: true
                name: puppet.resources.out_of_sync
                node_name: out_of_sync
                type: object
              fields:
                total:
                  field_details:
                    dashed_name: metrics-puppet-resources-out-of-sync-total
                    description: number of resources puppet found to be out_of_sync
                    flat_name: metrics.puppet.resources.out_of_sync.total
                    level: custom
                    name: puppet.resources.out_of_sync.total
                    node_name: total
                    normalize: []
                    short: number of resources puppet found to be out_of_sync
                    type: long
            restarted:
              field_details:
                dashed_name: metrics-puppet-resources-restarted
                flat_name: metrics.puppet.resources.restarted
                intermediate: true
                name: puppet.resources.restarted
                node_name: restarted
                type: object
              fields:
                total:
                  field_details:
                    dashed_name: metrics-puppet-resources-restarted-total
                    description: number of resources puppet restarted
                    flat_name: metrics.puppet.resources.restarted.total
                    level: custom
                    name: puppet.resources.restarted.total
                    node_name: total
                    normalize: []
                    short: number of resources puppet restarted
                    type: long
            scheduled:
              field_details:
                dashed_name: metrics-puppet-resources-scheduled
                flat_name: metrics.puppet.resources.scheduled
                intermediate: true
                name: puppet.resources.scheduled
                node_name: scheduled
                type: object
              fields:
                total:
                  field_details:
                    dashed_name: metrics-puppet-resources-scheduled-total
                    description: number of resources puppet scheduled
                    flat_name: metrics.puppet.resources.scheduled.total
                    level: custom
                    name: puppet.resources.scheduled.total
                    node_name: total
                    normalize: []
                    short: number of resources puppet scheduled
                    type: long
            skipped:
              field_details:
                dashed_name: metrics-puppet-resources-skipped
                flat_name: metrics.puppet.resources.skipped
                intermediate: true
                name: puppet.resources.skipped
                node_name: skipped
                type: object
              fields:
                total:
                  field_details:
                    dashed_name: metrics-puppet-resources-skipped-total
                    description: number of resources puppet skipped
                    flat_name: metrics.puppet.resources.skipped.total
                    level: custom
                    name: puppet.resources.skipped.total
                    node_name: total
                    normalize: []
                    short: number of resources puppet skipped
                    type: long
            total:
              field_details:
                dashed_name: metrics-puppet-resources-total
                description: Total number of resources affected
                flat_name: metrics.puppet.resources.total
                level: custom
                name: puppet.resources.total
                node_name: total
                normalize: []
                short: Total number of resources affected
                type: long
        runtime:
          field_details:
            dashed_name: metrics-puppet-runtime
            description: total seconds spent executing a specific resource
            example: '{"schedule": {"seconds": 0.25}}'
            flat_name: metrics.puppet.runtime
            level: custom
            name: puppet.runtime
            node_name: runtime
            normalize: []
            short: total number of seconds spent executing a specific resource
            type: object
    ttfb:
      field_details:
        dashed_name: metrics-ttfb
        flat_name: metrics.ttfb
        intermediate: true
        name: ttfb
        node_name: ttfb
        type: object
      fields:
        seconds:
          field_details:
            dashed_name: metrics-ttfb-seconds
            description: Time to first byte in seconds.
            flat_name: metrics.ttfb.seconds
            level: custom
            name: ttfb.seconds
            node_name: seconds
            normalize: []
            short: Time to first byte in seconds.
            type: half_float
  schema_details:
    group: 2
    prefix: metrics.
    root: false
    title: Metrics
network:
  field_details:
    dashed_name: network
    description: 'The network is defined as the communication path over which a host
      or network event happens.

      The network.* fields should be populated with details about the network activity
      associated with an event.'
    flat_name: network
    name: network
    node_name: network
    short: Fields describing the communication path over which the event happened.
    type: group
  fields:
    application:
      field_details:
        dashed_name: network-application
        description: 'A name given to an application level protocol. This can be arbitrarily
          assigned for things like microservices, but also apply to things like skype,
          icq, facebook, twitter. This would be used in situations where the vendor
          or service can be decoded such as from the source/dest IP owners, ports,
          or wire format.

          The field value must be normalized to lowercase for querying. See the documentation
          section "Implementing ECS".'
        example: aim
        flat_name: network.application
        ignore_above: 1024
        level: extended
        name: application
        node_name: application
        normalize: []
        short: Application level protocol name.
        type: keyword
    bytes:
      field_details:
        dashed_name: network-bytes
        description: 'Total bytes transferred in both directions.

          If `source.bytes` and `destination.bytes` are known, `network.bytes` is
          their sum.'
        example: 368
        flat_name: network.bytes
        format: bytes
        level: core
        name: bytes
        node_name: bytes
        normalize: []
        short: Total bytes transferred in both directions.
        type: long
    community_id:
      field_details:
        dashed_name: network-community-id
        description: 'A hash of source and destination IPs and ports, as well as the
          protocol used in a communication. This is a tool-agnostic standard to identify
          flows.

          Learn more at https://github.com/corelight/community-id-spec.'
        example: 1:hO+sN4H+MG5MY/8hIrXPqc4ZQz0=
        flat_name: network.community_id
        ignore_above: 1024
        level: extended
        name: community_id
        node_name: community_id
        normalize: []
        short: A hash of source and destination IPs and ports.
        type: keyword
    direction:
      field_details:
        dashed_name: network-direction
        description: "Direction of the network traffic.\nRecommended values are:\n\
          \  * ingress\n  * egress\n  * inbound\n  * outbound\n  * internal\n  * external\n\
          \  * unknown\n\nWhen mapping events from a host-based monitoring context,\
          \ populate this field from the host's point of view, using the values \"\
          ingress\" or \"egress\".\nWhen mapping events from a network or perimeter-based\
          \ monitoring context, populate this field from the point of view of the\
          \ network perimeter, using the values \"inbound\", \"outbound\", \"internal\"\
          \ or \"external\".\nNote that \"internal\" is not crossing perimeter boundaries,\
          \ and is meant to describe communication between two hosts within the perimeter.\
          \ Note also that \"external\" is meant to describe traffic between two hosts\
          \ that are external to the perimeter. This could for example be useful for\
          \ ISPs or VPN service providers."
        example: inbound
        flat_name: network.direction
        ignore_above: 1024
        level: core
        name: direction
        node_name: direction
        normalize: []
        short: Direction of the network traffic.
        type: keyword
    forwarded_ip:
      field_details:
        dashed_name: network-forwarded-ip
        description: Host IP address when the source IP address is the proxy.
        example: 192.1.1.2
        flat_name: network.forwarded_ip
        level: core
        name: forwarded_ip
        node_name: forwarded_ip
        normalize: []
        short: Host IP address when the source IP address is the proxy.
        type: ip
    iana_number:
      field_details:
        dashed_name: network-iana-number
        description: IANA Protocol Number (https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml).
          Standardized list of protocols. This aligns well with NetFlow and sFlow
          related logs which use the IANA Protocol Number.
        example: 6
        flat_name: network.iana_number
        ignore_above: 1024
        level: extended
        name: iana_number
        node_name: iana_number
        normalize: []
        short: IANA Protocol Number.
        type: keyword
    inner:
      field_details:
        dashed_name: network-inner
        description: Network.inner fields are added in addition to network.vlan fields
          to describe the innermost VLAN when q-in-q VLAN tagging is present. Allowed
          fields include vlan.id and vlan.name. Inner vlan fields are typically used
          when sending traffic with multiple 802.1q encapsulations to a network sensor
          (e.g. Zeek, Wireshark.)
        flat_name: network.inner
        level: extended
        name: inner
        node_name: inner
        normalize: []
        short: Inner VLAN tag information
        type: object
      fields:
        vlan:
          field_details:
            dashed_name: network-inner-vlan
            description: 'The VLAN fields are used to identify 802.1q tag(s) of a
              packet, as well as ingress and egress VLAN associations of an observer
              in relation to a specific packet or connection.

              Network.vlan fields are used to record a single VLAN tag, or the outer
              tag in the case of q-in-q encapsulations, for a packet or connection
              as observed, typically provided by a network sensor (e.g. Zeek, Wireshark)
              passively reporting on traffic.

              Network.inner VLAN fields are used to report inner q-in-q 802.1q tags
              (multiple 802.1q encapsulations) as observed, typically provided by
              a network sensor  (e.g. Zeek, Wireshark) passively reporting on traffic.
              Network.inner VLAN fields should only be used in addition to network.vlan
              fields to indicate q-in-q tagging.

              Observer.ingress and observer.egress VLAN values are used to record
              observer specific information when observer events contain discrete
              ingress and egress VLAN information, typically provided by firewalls,
              routers, or load balancers.'
            flat_name: network.inner.vlan
            intermediate: true
            name: vlan
            node_name: vlan
            original_fieldset: vlan
            short: Fields to describe observed VLAN information.
            type: group
          fields:
            id:
              field_details:
                dashed_name: network-inner-vlan-id
                description: VLAN ID as reported by the observer.
                example: 10
                flat_name: network.inner.vlan.id
                ignore_above: 1024
                level: extended
                name: id
                node_name: id
                normalize: []
                original_fieldset: vlan
                short: VLAN ID as reported by the observer.
                type: keyword
            name:
              field_details:
                dashed_name: network-inner-vlan-name
                description: Optional VLAN name as reported by the observer.
                example: outside
                flat_name: network.inner.vlan.name
                ignore_above: 1024
                level: extended
                name: name
                node_name: name
                normalize: []
                original_fieldset: vlan
                short: Optional VLAN name as reported by the observer.
                type: keyword
    name:
      field_details:
        dashed_name: network-name
        description: Name given by operators to sections of their network.
        example: Guest Wifi
        flat_name: network.name
        ignore_above: 1024
        level: extended
        name: name
        node_name: name
        normalize: []
        short: Name given by operators to sections of their network.
        type: keyword
    packets:
      field_details:
        dashed_name: network-packets
        description: 'Total packets transferred in both directions.

          If `source.packets` and `destination.packets` are known, `network.packets`
          is their sum.'
        example: 24
        flat_name: network.packets
        level: core
        name: packets
        node_name: packets
        normalize: []
        short: Total packets transferred in both directions.
        type: long
    protocol:
      field_details:
        dashed_name: network-protocol
        description: 'L7 Network protocol name. ex. http, lumberjack, transport protocol.

          The field value must be normalized to lowercase for querying. See the documentation
          section "Implementing ECS".'
        example: http
        flat_name: network.protocol
        ignore_above: 1024
        level: core
        name: protocol
        node_name: protocol
        normalize: []
        short: L7 Network protocol name.
        type: keyword
    tcp_flags:
      field_details:
        dashed_name: network-tcp-flags
        description: 'Array of TCP Flags found in the packet.

          The field value must be normalized to lowercase for querying.'
        example: '["ack", "fin"]'
        flat_name: network.tcp_flags
        ignore_above: 1024
        level: custom
        name: tcp_flags
        node_name: tcp_flags
        normalize:
        - array
        short: Array of TCP Flags found in the packet.
        type: keyword
    transport:
      field_details:
        dashed_name: network-transport
        description: 'Same as network.iana_number, but instead using the Keyword name
          of the transport layer (udp, tcp, ipv6-icmp, etc.)

          The field value must be normalized to lowercase for querying. See the documentation
          section "Implementing ECS".'
        example: tcp
        flat_name: network.transport
        ignore_above: 1024
        level: core
        name: transport
        node_name: transport
        normalize: []
        short: Protocol Name corresponding to the field `iana_number`.
        type: keyword
    type:
      field_details:
        dashed_name: network-type
        description: 'In the OSI Model this would be the Network Layer. ipv4, ipv6,
          ipsec, pim, etc

          The field value must be normalized to lowercase for querying. See the documentation
          section "Implementing ECS".'
        example: ipv4
        flat_name: network.type
        ignore_above: 1024
        level: core
        name: type
        node_name: type
        normalize: []
        short: In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec,
          pim, etc
        type: keyword
    vlan:
      field_details:
        dashed_name: network-vlan
        description: 'The VLAN fields are used to identify 802.1q tag(s) of a packet,
          as well as ingress and egress VLAN associations of an observer in relation
          to a specific packet or connection.

          Network.vlan fields are used to record a single VLAN tag, or the outer tag
          in the case of q-in-q encapsulations, for a packet or connection as observed,
          typically provided by a network sensor (e.g. Zeek, Wireshark) passively
          reporting on traffic.

          Network.inner VLAN fields are used to report inner q-in-q 802.1q tags (multiple
          802.1q encapsulations) as observed, typically provided by a network sensor  (e.g.
          Zeek, Wireshark) passively reporting on traffic. Network.inner VLAN fields
          should only be used in addition to network.vlan fields to indicate q-in-q
          tagging.

          Observer.ingress and observer.egress VLAN values are used to record observer
          specific information when observer events contain discrete ingress and egress
          VLAN information, typically provided by firewalls, routers, or load balancers.'
        flat_name: network.vlan
        intermediate: true
        name: vlan
        node_name: vlan
        original_fieldset: vlan
        short: Fields to describe observed VLAN information.
        type: group
      fields:
        id:
          field_details:
            dashed_name: network-vlan-id
            description: VLAN ID as reported by the observer.
            example: 10
            flat_name: network.vlan.id
            ignore_above: 1024
            level: extended
            name: id
            node_name: id
            normalize: []
            original_fieldset: vlan
            short: VLAN ID as reported by the observer.
            type: keyword
        name:
          field_details:
            dashed_name: network-vlan-name
            description: Optional VLAN name as reported by the observer.
            example: outside
            flat_name: network.vlan.name
            ignore_above: 1024
            level: extended
            name: name
            node_name: name
            normalize: []
            original_fieldset: vlan
            short: Optional VLAN name as reported by the observer.
            type: keyword
  schema_details:
    group: 2
    nestings:
    - network.inner.vlan
    - network.vlan
    prefix: network.
    reused_here:
    - full: network.vlan
      schema_name: vlan
      short: Fields to describe observed VLAN information.
    - full: network.inner.vlan
      schema_name: vlan
      short: Fields to describe observed VLAN information.
    root: false
    title: Network
normalized:
  field_details:
    dashed_name: normalized
    description: 'Fields generated and normalized by the logging pipeline, but normally
      hidden from view in the Kibana Discover app and saved search results in the
      Dashboard app.

      This field is intended to contain fields that generally duplicate other fields
      and clutter the view.

      This field is hidden superficially by an entry in the index pattern source filters.'
    flat_name: normalized
    name: normalized
    node_name: normalized
    short: Fields generated and normalized by the logging pipeline.
    type: group
  fields:
    dropped:
      field_details:
        dashed_name: normalized-dropped
        flat_name: normalized.dropped
        intermediate: true
        name: dropped
        node_name: dropped
        type: object
      fields:
        field_type_mismatch:
          field_details:
            dashed_name: normalized-dropped-field-type-mismatch
            description: 'Array of dropped field names due to a type conflict.

              Values in this field are the equivalent of those in error type `mapper_parsing_exception`.'
            flat_name: normalized.dropped.field_type_mismatch
            ignore_above: 1024
            level: custom
            name: dropped.field_type_mismatch
            node_name: field_type_mismatch
            normalize: []
            short: Array of field names dropped due to a type conflict.
            type: keyword
        no_such_field:
          field_details:
            dashed_name: normalized-dropped-no-such-field
            description: 'Array of dropped field names due to no available field definition.

              Values in this field would normally be dropped silently by ElasticSearch.'
            flat_name: normalized.dropped.no_such_field
            ignore_above: 1024
            level: custom
            name: dropped.no_such_field
            node_name: no_such_field
            normalize: []
            short: Array of field names dropped due to having no field definition.
            type: keyword
    message:
      field_details:
        dashed_name: normalized-message
        description: 'The message field downcased, truncated to 256 characters, and
          indexed in an aggregatable form.

          The downcasing and truncation is handled by the Logstash pipeline.

          Ideally, this should be a multi-field of the message field, but lacking
          a truncation feature, this behavior is currently impossible.  For more information,
          see: https://github.com/elastic/elasticsearch/issues/60329'
        example: Hello World
        flat_name: normalized.message
        ignore_above: 256
        level: custom
        name: message
        node_name: message
        normalize: []
        short: Log message optimized for aggregations.
        type: keyword
  schema_details:
    group: 2
    prefix: normalized.
    root: false
    title: Normalized
observer:
  field_details:
    dashed_name: observer
    description: 'An observer is defined as a special network, security, or application
      device used to detect, observe, or create network, security, or application-related
      events and metrics.

      This could be a custom hardware appliance or a server that has been configured
      to run special network, security, or application software. Examples include
      firewalls, web proxies, intrusion detection/prevention systems, network monitoring
      sensors, web application firewalls, data loss prevention systems, and APM servers.
      The observer.* fields shall be populated with details of the system, if any,
      that detects, observes and/or creates a network, security, or application event
      or metric. Message queues and ETL components used in processing events or metrics
      are not considered observers in ECS.'
    flat_name: observer
    name: observer
    node_name: observer
    short: Fields describing an entity observing the event from outside the host.
    type: group
  fields:
    egress:
      field_details:
        dashed_name: observer-egress
        description: Observer.egress holds information like interface number and name,
          vlan, and zone information to classify egress traffic.  Single armed monitoring
          such as a network sensor on a span port should only use observer.ingress
          to categorize traffic.
        flat_name: observer.egress
        intermediate: false
        level: extended
        name: egress
        node_name: egress
        normalize: []
        short: Object field for egress information
        type: object
      fields:
        interface:
          field_details:
            dashed_name: observer-egress-interface
            description: The interface fields are used to record ingress and egress
              interface information when reported by an observer (e.g. firewall, router,
              load balancer) in the context of the observer handling a network connection.  In
              the case of a single observer interface (e.g. network sensor on a span
              port) only the observer.ingress information should be populated.
            flat_name: observer.egress.interface
            intermediate: true
            name: interface
            node_name: interface
            original_fieldset: interface
            short: Fields to describe observer interface information.
            type: group
          fields:
            alias:
              field_details:
                dashed_name: observer-egress-interface-alias
                description: Interface alias as reported by the system, typically
                  used in firewall implementations for e.g. inside, outside, or dmz
                  logical interface naming.
                example: outside
                flat_name: observer.egress.interface.alias
                ignore_above: 1024
                level: extended
                name: alias
                node_name: alias
                normalize: []
                original_fieldset: interface
                short: Interface alias
                type: keyword
            id:
              field_details:
                dashed_name: observer-egress-interface-id
                description: Interface ID as reported by an observer (typically SNMP
                  interface ID).
                example: 10
                flat_name: observer.egress.interface.id
                ignore_above: 1024
                level: extended
                name: id
                node_name: id
                normalize: []
                original_fieldset: interface
                short: Interface ID
                type: keyword
            name:
              field_details:
                dashed_name: observer-egress-interface-name
                description: Interface name as reported by the system.
                example: eth0
                flat_name: observer.egress.interface.name
                ignore_above: 1024
                level: extended
                name: name
                node_name: name
                normalize: []
                original_fieldset: interface
                short: Interface name
                type: keyword
        vlan:
          field_details:
            dashed_name: observer-egress-vlan
            description: 'The VLAN fields are used to identify 802.1q tag(s) of a
              packet, as well as ingress and egress VLAN associations of an observer
              in relation to a specific packet or connection.

              Network.vlan fields are used to record a single VLAN tag, or the outer
              tag in the case of q-in-q encapsulations, for a packet or connection
              as observed, typically provided by a network sensor (e.g. Zeek, Wireshark)
              passively reporting on traffic.

              Network.inner VLAN fields are used to report inner q-in-q 802.1q tags
              (multiple 802.1q encapsulations) as observed, typically provided by
              a network sensor  (e.g. Zeek, Wireshark) passively reporting on traffic.
              Network.inner VLAN fields should only be used in addition to network.vlan
              fields to indicate q-in-q tagging.

              Observer.ingress and observer.egress VLAN values are used to record
              observer specific information when observer events contain discrete
              ingress and egress VLAN information, typically provided by firewalls,
              routers, or load balancers.'
            flat_name: observer.egress.vlan
            intermediate: true
            name: vlan
            node_name: vlan
            original_fieldset: vlan
            short: Fields to describe observed VLAN information.
            type: group
          fields:
            id:
              field_details:
                dashed_name: observer-egress-vlan-id
                description: VLAN ID as reported by the observer.
                example: 10
                flat_name: observer.egress.vlan.id
                ignore_above: 1024
                level: extended
                name: id
                node_name: id
                normalize: []
                original_fieldset: vlan
                short: VLAN ID as reported by the observer.
                type: keyword
            name:
              field_details:
                dashed_name: observer-egress-vlan-name
                description: Optional VLAN name as reported by the observer.
                example: outside
                flat_name: observer.egress.vlan.name
                ignore_above: 1024
                level: extended
                name: name
                node_name: name
                normalize: []
                original_fieldset: vlan
                short: Optional VLAN name as reported by the observer.
                type: keyword
        zone:
          field_details:
            dashed_name: observer-egress-zone
            description: Network zone of outbound traffic as reported by the observer
              to categorize the destination area of egress traffic, e.g. Internal,
              External, DMZ, HR, Legal, etc.
            example: Public_Internet
            flat_name: observer.egress.zone
            ignore_above: 1024
            level: extended
            name: egress.zone
            node_name: zone
            normalize: []
            short: Observer Egress zone
            type: keyword
    geo:
      field_details:
        dashed_name: observer-geo
        description: 'Geo fields can carry data about a specific location related
          to an event.

          This geolocation information can be derived from techniques such as Geo
          IP, or be user-supplied.'
        flat_name: observer.geo
        intermediate: true
        name: geo
        node_name: geo
        original_fieldset: geo
        short: Fields describing a location.
        type: group
      fields:
        city_name:
          field_details:
            dashed_name: observer-geo-city-name
            description: City name.
            example: Montreal
            flat_name: observer.geo.city_name
            ignore_above: 1024
            level: core
            name: city_name
            node_name: city_name
            normalize: []
            original_fieldset: geo
            short: City name.
            type: keyword
        continent_code:
          field_details:
            dashed_name: observer-geo-continent-code
            description: Two-letter code representing continent's name.
            example: NA
            flat_name: observer.geo.continent_code
            ignore_above: 1024
            level: core
            name: continent_code
            node_name: continent_code
            normalize: []
            original_fieldset: geo
            short: Continent code.
            type: keyword
        continent_name:
          field_details:
            dashed_name: observer-geo-continent-name
            description: Name of the continent.
            example: North America
            flat_name: observer.geo.continent_name
            ignore_above: 1024
            level: core
            name: continent_name
            node_name: continent_name
            normalize: []
            original_fieldset: geo
            short: Name of the continent.
            type: keyword
        country_iso_code:
          field_details:
            dashed_name: observer-geo-country-iso-code
            description: Country ISO code.
            example: CA
            flat_name: observer.geo.country_iso_code
            ignore_above: 1024
            level: core
            name: country_iso_code
            node_name: country_iso_code
            normalize: []
            original_fieldset: geo
            short: Country ISO code.
            type: keyword
        country_name:
          field_details:
            dashed_name: observer-geo-country-name
            description: Country name.
            example: Canada
            flat_name: observer.geo.country_name
            ignore_above: 1024
            level: core
            name: country_name
            node_name: country_name
            normalize: []
            original_fieldset: geo
            short: Country name.
            type: keyword
        location:
          field_details:
            dashed_name: observer-geo-location
            description: Longitude and latitude.
            example: '{ "lon": -73.614830, "lat": 45.505918 }'
            flat_name: observer.geo.location
            level: core
            name: location
            node_name: location
            normalize: []
            original_fieldset: geo
            short: Longitude and latitude.
            type: geo_point
        name:
          field_details:
            dashed_name: observer-geo-name
            description: 'User-defined description of a location, at the level of
              granularity they care about.

              Could be the name of their data centers, the floor number, if this describes
              a local physical entity, city names.

              Not typically used in automated geolocation.'
            example: boston-dc
            flat_name: observer.geo.name
            ignore_above: 1024
            level: extended
            name: name
            node_name: name
            normalize: []
            original_fieldset: geo
            short: User-defined description of a location.
            type: keyword
        postal_code:
          field_details:
            dashed_name: observer-geo-postal-code
            description: 'Postal code associated with the location.

              Values appropriate for this field may also be known as a postcode or
              ZIP code and will vary widely from country to country.'
            example: 94040
            flat_name: observer.geo.postal_code
            ignore_above: 1024
            level: core
            name: postal_code
            node_name: postal_code
            normalize: []
            original_fieldset: geo
            short: Postal code.
            type: keyword
        region_iso_code:
          field_details:
            dashed_name: observer-geo-region-iso-code
            description: Region ISO code.
            example: CA-QC
            flat_name: observer.geo.region_iso_code
            ignore_above: 1024
            level: core
            name: region_iso_code
            node_name: region_iso_code
            normalize: []
            original_fieldset: geo
            short: Region ISO code.
            type: keyword
        region_name:
          field_details:
            dashed_name: observer-geo-region-name
            description: Region name.
            example: Quebec
            flat_name: observer.geo.region_name
            ignore_above: 1024
            level: core
            name: region_name
            node_name: region_name
            normalize: []
            original_fieldset: geo
            short: Region name.
            type: keyword
        timezone:
          field_details:
            dashed_name: observer-geo-timezone
            description: The time zone of the location, such as IANA time zone name.
            example: America/Argentina/Buenos_Aires
            flat_name: observer.geo.timezone
            ignore_above: 1024
            level: core
            name: timezone
            node_name: timezone
            normalize: []
            original_fieldset: geo
            short: Time zone.
            type: keyword
    hostname:
      field_details:
        dashed_name: observer-hostname
        description: Hostname of the observer.
        flat_name: observer.hostname
        ignore_above: 1024
        level: core
        name: hostname
        node_name: hostname
        normalize: []
        short: Hostname of the observer.
        type: keyword
    ingress:
      field_details:
        dashed_name: observer-ingress
        description: Observer.ingress holds information like interface number and
          name, vlan, and zone information to classify ingress traffic.  Single armed
          monitoring such as a network sensor on a span port should only use observer.ingress
          to categorize traffic.
        flat_name: observer.ingress
        intermediate: false
        level: extended
        name: ingress
        node_name: ingress
        normalize: []
        short: Object field for ingress information
        type: object
      fields:
        interface:
          field_details:
            dashed_name: observer-ingress-interface
            description: The interface fields are used to record ingress and egress
              interface information when reported by an observer (e.g. firewall, router,
              load balancer) in the context of the observer handling a network connection.  In
              the case of a single observer interface (e.g. network sensor on a span
              port) only the observer.ingress information should be populated.
            flat_name: observer.ingress.interface
            intermediate: true
            name: interface
            node_name: interface
            original_fieldset: interface
            short: Fields to describe observer interface information.
            type: group
          fields:
            alias:
              field_details:
                dashed_name: observer-ingress-interface-alias
                description: Interface alias as reported by the system, typically
                  used in firewall implementations for e.g. inside, outside, or dmz
                  logical interface naming.
                example: outside
                flat_name: observer.ingress.interface.alias
                ignore_above: 1024
                level: extended
                name: alias
                node_name: alias
                normalize: []
                original_fieldset: interface
                short: Interface alias
                type: keyword
            id:
              field_details:
                dashed_name: observer-ingress-interface-id
                description: Interface ID as reported by an observer (typically SNMP
                  interface ID).
                example: 10
                flat_name: observer.ingress.interface.id
                ignore_above: 1024
                level: extended
                name: id
                node_name: id
                normalize: []
                original_fieldset: interface
                short: Interface ID
                type: keyword
            name:
              field_details:
                dashed_name: observer-ingress-interface-name
                description: Interface name as reported by the system.
                example: eth0
                flat_name: observer.ingress.interface.name
                ignore_above: 1024
                level: extended
                name: name
                node_name: name
                normalize: []
                original_fieldset: interface
                short: Interface name
                type: keyword
        vlan:
          field_details:
            dashed_name: observer-ingress-vlan
            description: 'The VLAN fields are used to identify 802.1q tag(s) of a
              packet, as well as ingress and egress VLAN associations of an observer
              in relation to a specific packet or connection.

              Network.vlan fields are used to record a single VLAN tag, or the outer
              tag in the case of q-in-q encapsulations, for a packet or connection
              as observed, typically provided by a network sensor (e.g. Zeek, Wireshark)
              passively reporting on traffic.

              Network.inner VLAN fields are used to report inner q-in-q 802.1q tags
              (multiple 802.1q encapsulations) as observed, typically provided by
              a network sensor  (e.g. Zeek, Wireshark) passively reporting on traffic.
              Network.inner VLAN fields should only be used in addition to network.vlan
              fields to indicate q-in-q tagging.

              Observer.ingress and observer.egress VLAN values are used to record
              observer specific information when observer events contain discrete
              ingress and egress VLAN information, typically provided by firewalls,
              routers, or load balancers.'
            flat_name: observer.ingress.vlan
            intermediate: true
            name: vlan
            node_name: vlan
            original_fieldset: vlan
            short: Fields to describe observed VLAN information.
            type: group
          fields:
            id:
              field_details:
                dashed_name: observer-ingress-vlan-id
                description: VLAN ID as reported by the observer.
                example: 10
                flat_name: observer.ingress.vlan.id
                ignore_above: 1024
                level: extended
                name: id
                node_name: id
                normalize: []
                original_fieldset: vlan
                short: VLAN ID as reported by the observer.
                type: keyword
            name:
              field_details:
                dashed_name: observer-ingress-vlan-name
                description: Optional VLAN name as reported by the observer.
                example: outside
                flat_name: observer.ingress.vlan.name
                ignore_above: 1024
                level: extended
                name: name
                node_name: name
                normalize: []
                original_fieldset: vlan
                short: Optional VLAN name as reported by the observer.
                type: keyword
        zone:
          field_details:
            dashed_name: observer-ingress-zone
            description: Network zone of incoming traffic as reported by the observer
              to categorize the source area of ingress traffic. e.g. internal, External,
              DMZ, HR, Legal, etc.
            example: DMZ
            flat_name: observer.ingress.zone
            ignore_above: 1024
            level: extended
            name: ingress.zone
            node_name: zone
            normalize: []
            short: Observer ingress zone
            type: keyword
    ip:
      field_details:
        dashed_name: observer-ip
        description: IP addresses of the observer.
        flat_name: observer.ip
        level: core
        name: ip
        node_name: ip
        normalize:
        - array
        short: IP addresses of the observer.
        type: ip
    mac:
      field_details:
        dashed_name: observer-mac
        description: 'MAC addresses of the observer.

          The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit
          byte) is represented by two [uppercase] hexadecimal digits giving the value
          of the octet as an unsigned integer. Successive octets are separated by
          a hyphen.'
        example: '["00-00-5E-00-53-23", "00-00-5E-00-53-24"]'
        flat_name: observer.mac
        ignore_above: 1024
        level: core
        name: mac
        node_name: mac
        normalize:
        - array
        short: MAC addresses of the observer.
        type: keyword
    name:
      field_details:
        dashed_name: observer-name
        description: 'Custom name of the observer.

          This is a name that can be given to an observer. This can be helpful for
          example if multiple firewalls of the same model are used in an organization.

          If no custom name is needed, the field can be left empty.'
        example: 1_proxySG
        flat_name: observer.name
        ignore_above: 1024
        level: extended
        name: name
        node_name: name
        normalize: []
        short: Custom name of the observer.
        type: keyword
    os:
      field_details:
        dashed_name: observer-os
        description: The OS fields contain information about the operating system.
        flat_name: observer.os
        intermediate: true
        name: os
        node_name: os
        original_fieldset: os
        short: OS fields contain information about the operating system.
        type: group
      fields:
        family:
          field_details:
            dashed_name: observer-os-family
            description: OS family (such as redhat, debian, freebsd, windows).
            example: debian
            flat_name: observer.os.family
            ignore_above: 1024
            level: extended
            name: family
            node_name: family
            normalize: []
            original_fieldset: os
            short: OS family (such as redhat, debian, freebsd, windows).
            type: keyword
        full:
          field_details:
            dashed_name: observer-os-full
            description: Operating system name, including the version or code name.
            example: Mac OS Mojave
            flat_name: observer.os.full
            ignore_above: 1024
            level: extended
            multi_fields:
            - flat_name: observer.os.full.text
              name: text
              norms: false
              type: text
            name: full
            node_name: full
            normalize: []
            original_fieldset: os
            short: Operating system name, including the version or code name.
            type: keyword
        kernel:
          field_details:
            dashed_name: observer-os-kernel
            description: Operating system kernel version as a raw string.
            example: 4.4.0-112-generic
            flat_name: observer.os.kernel
            ignore_above: 1024
            level: extended
            name: kernel
            node_name: kernel
            normalize: []
            original_fieldset: os
            short: Operating system kernel version as a raw string.
            type: keyword
        name:
          field_details:
            dashed_name: observer-os-name
            description: Operating system name, without the version.
            example: Mac OS X
            flat_name: observer.os.name
            ignore_above: 1024
            level: extended
            multi_fields:
            - flat_name: observer.os.name.text
              name: text
              norms: false
              type: text
            name: name
            node_name: name
            normalize: []
            original_fieldset: os
            short: Operating system name, without the version.
            type: keyword
        platform:
          field_details:
            dashed_name: observer-os-platform
            description: Operating system platform (such centos, ubuntu, windows).
            example: darwin
            flat_name: observer.os.platform
            ignore_above: 1024
            level: extended
            name: platform
            node_name: platform
            normalize: []
            original_fieldset: os
            short: Operating system platform (such centos, ubuntu, windows).
            type: keyword
        type:
          field_details:
            dashed_name: observer-os-type
            description: 'Use the `os.type` field to categorize the operating system
              into one of the broad commercial families.

              One of these following values should be used (lowercase): linux, macos,
              unix, windows.

              If the OS you''re dealing with is not in the list, the field should
              not be populated. Please let us know by opening an issue with ECS, to
              propose its addition.'
            example: macos
            flat_name: observer.os.type
            ignore_above: 1024
            level: extended
            name: type
            node_name: type
            normalize: []
            original_fieldset: os
            short: 'Which commercial OS family (one of: linux, macos, unix or windows).'
            type: keyword
        version:
          field_details:
            dashed_name: observer-os-version
            description: Operating system version as a raw string.
            example: 10.14.1
            flat_name: observer.os.version
            ignore_above: 1024
            level: extended
            name: version
            node_name: version
            normalize: []
            original_fieldset: os
            short: Operating system version as a raw string.
            type: keyword
    product:
      field_details:
        dashed_name: observer-product
        description: The product name of the observer.
        example: s200
        flat_name: observer.product
        ignore_above: 1024
        level: extended
        name: product
        node_name: product
        normalize: []
        short: The product name of the observer.
        type: keyword
    serial_number:
      field_details:
        dashed_name: observer-serial-number
        description: Observer serial number.
        flat_name: observer.serial_number
        ignore_above: 1024
        level: extended
        name: serial_number
        node_name: serial_number
        normalize: []
        short: Observer serial number.
        type: keyword
    type:
      field_details:
        dashed_name: observer-type
        description: 'The type of the observer the data is coming from.

          There is no predefined list of observer types. Some examples are `forwarder`,
          `firewall`, `ids`, `ips`, `proxy`, `poller`, `sensor`, `APM server`.'
        example: firewall
        flat_name: observer.type
        ignore_above: 1024
        level: core
        name: type
        node_name: type
        normalize: []
        short: The type of the observer the data is coming from.
        type: keyword
    vendor:
      field_details:
        dashed_name: observer-vendor
        description: Vendor name of the observer.
        example: Symantec
        flat_name: observer.vendor
        ignore_above: 1024
        level: core
        name: vendor
        node_name: vendor
        normalize: []
        short: Vendor name of the observer.
        type: keyword
    version:
      field_details:
        dashed_name: observer-version
        description: Observer version.
        flat_name: observer.version
        ignore_above: 1024
        level: core
        name: version
        node_name: version
        normalize: []
        short: Observer version.
        type: keyword
  schema_details:
    group: 2
    nestings:
    - observer.egress.interface
    - observer.egress.vlan
    - observer.geo
    - observer.ingress.interface
    - observer.ingress.vlan
    - observer.os
    prefix: observer.
    reused_here:
    - full: observer.geo
      schema_name: geo
      short: Fields describing a location.
    - full: observer.ingress.interface
      schema_name: interface
      short: Fields to describe observer interface information.
    - full: observer.egress.interface
      schema_name: interface
      short: Fields to describe observer interface information.
    - full: observer.os
      schema_name: os
      short: OS fields contain information about the operating system.
    - full: observer.ingress.vlan
      schema_name: vlan
      short: Fields to describe observed VLAN information.
    - full: observer.egress.vlan
      schema_name: vlan
      short: Fields to describe observed VLAN information.
    root: false
    title: Observer
orchestrator:
  field_details:
    dashed_name: orchestrator
    description: Fields that describe the resources which container orchestrators
      manage or act upon.
    flat_name: orchestrator
    name: orchestrator
    node_name: orchestrator
    short: Fields relevant to container orchestrators.
    type: group
  fields:
    api_version:
      field_details:
        dashed_name: orchestrator-api-version
        description: API version being used to carry out the action
        example: v1beta1
        flat_name: orchestrator.api_version
        ignore_above: 1024
        level: extended
        name: api_version
        node_name: api_version
        normalize: []
        short: API version being used to carry out the action
        type: keyword
    cluster:
      field_details:
        dashed_name: orchestrator-cluster
        flat_name: orchestrator.cluster
        intermediate: true
        name: cluster
        node_name: cluster
        type: object
      fields:
        name:
          field_details:
            dashed_name: orchestrator-cluster-name
            description: Name of the cluster.
            flat_name: orchestrator.cluster.name
            ignore_above: 1024
            level: extended
            name: cluster.name
            node_name: name
            normalize: []
            short: Name of the cluster.
            type: keyword
        url:
          field_details:
            dashed_name: orchestrator-cluster-url
            description: URL of the API used to manage the cluster.
            flat_name: orchestrator.cluster.url
            ignore_above: 1024
            level: extended
            name: cluster.url
            node_name: url
            normalize: []
            short: URL of the API used to manage the cluster.
            type: keyword
        version:
          field_details:
            dashed_name: orchestrator-cluster-version
            description: The version of the cluster.
            flat_name: orchestrator.cluster.version
            ignore_above: 1024
            level: extended
            name: cluster.version
            node_name: version
            normalize: []
            short: The version of the cluster.
            type: keyword
    namespace:
      field_details:
        dashed_name: orchestrator-namespace
        description: Namespace in which the action is taking place.
        example: kube-system
        flat_name: orchestrator.namespace
        ignore_above: 1024
        level: extended
        name: namespace
        node_name: namespace
        normalize: []
        short: Namespace in which the action is taking place.
        type: keyword
    organization:
      field_details:
        dashed_name: orchestrator-organization
        description: Organization affected by the event (for multi-tenant orchestrator
          setups).
        example: elastic
        flat_name: orchestrator.organization
        ignore_above: 1024
        level: extended
        name: organization
        node_name: organization
        normalize: []
        short: Organization affected by the event (for multi-tenant orchestrator setups).
        type: keyword
    resource:
      field_details:
        dashed_name: orchestrator-resource
        flat_name: orchestrator.resource
        intermediate: true
        name: resource
        node_name: resource
        type: object
      fields:
        annotation:
          field_details:
            dashed_name: orchestrator-resource-annotation
            description: The list of annotations added to the resource.
            example: '[''key1:value1'', ''key2:value2'', ''key3:value3'']'
            flat_name: orchestrator.resource.annotation
            ignore_above: 1024
            level: extended
            name: resource.annotation
            node_name: annotation
            normalize:
            - array
            short: The list of annotations added to the resource.
            type: keyword
        id:
          field_details:
            dashed_name: orchestrator-resource-id
            description: Unique ID of the resource being acted upon.
            flat_name: orchestrator.resource.id
            ignore_above: 1024
            level: extended
            name: resource.id
            node_name: id
            normalize: []
            short: Unique ID of the resource being acted upon.
            type: keyword
        label:
          field_details:
            dashed_name: orchestrator-resource-label
            description: The list of labels added to the resource.
            example: '[''key1:value1'', ''key2:value2'', ''key3:value3'']'
            flat_name: orchestrator.resource.label
            ignore_above: 1024
            level: extended
            name: resource.label
            node_name: label
            normalize:
            - array
            short: The list of labels added to the resource.
            type: keyword
        name:
          field_details:
            dashed_name: orchestrator-resource-name
            description: Name of the resource being acted upon.
            example: test-pod-cdcws
            flat_name: orchestrator.resource.name
            ignore_above: 1024
            level: extended
            name: resource.name
            node_name: name
            normalize: []
            short: Name of the resource being acted upon.
            type: keyword
        type:
          field_details:
            dashed_name: orchestrator-resource-type
            description: Type of resource being acted upon.
            example: service
            flat_name: orchestrator.resource.type
            ignore_above: 1024
            level: extended
            name: resource.type
            node_name: type
            normalize: []
            short: Type of resource being acted upon.
            type: keyword
    type:
      field_details:
        dashed_name: orchestrator-type
        description: Orchestrator cluster type (e.g. kubernetes, nomad or cloudfoundry).
        example: kubernetes
        flat_name: orchestrator.type
        ignore_above: 1024
        level: extended
        name: type
        node_name: type
        normalize: []
        short: Orchestrator cluster type (e.g. kubernetes, nomad or cloudfoundry).
        type: keyword
  schema_details:
    group: 2
    prefix: orchestrator.
    root: false
    title: Orchestrator
os:
  field_details:
    dashed_name: os
    description: The OS fields contain information about the operating system.
    flat_name: os
    name: os
    node_name: os
    short: OS fields contain information about the operating system.
    type: group
  fields:
    family:
      field_details:
        dashed_name: os-family
        description: OS family (such as redhat, debian, freebsd, windows).
        example: debian
        flat_name: os.family
        ignore_above: 1024
        level: extended
        name: family
        node_name: family
        normalize: []
        short: OS family (such as redhat, debian, freebsd, windows).
        type: keyword
    full:
      field_details:
        dashed_name: os-full
        description: Operating system name, including the version or code name.
        example: Mac OS Mojave
        flat_name: os.full
        ignore_above: 1024
        level: extended
        multi_fields:
        - flat_name: os.full.text
          name: text
          norms: false
          type: text
        name: full
        node_name: full
        normalize: []
        short: Operating system name, including the version or code name.
        type: keyword
    kernel:
      field_details:
        dashed_name: os-kernel
        description: Operating system kernel version as a raw string.
        example: 4.4.0-112-generic
        flat_name: os.kernel
        ignore_above: 1024
        level: extended
        name: kernel
        node_name: kernel
        normalize: []
        short: Operating system kernel version as a raw string.
        type: keyword
    name:
      field_details:
        dashed_name: os-name
        description: Operating system name, without the version.
        example: Mac OS X
        flat_name: os.name
        ignore_above: 1024
        level: extended
        multi_fields:
        - flat_name: os.name.text
          name: text
          norms: false
          type: text
        name: name
        node_name: name
        normalize: []
        short: Operating system name, without the version.
        type: keyword
    platform:
      field_details:
        dashed_name: os-platform
        description: Operating system platform (such centos, ubuntu, windows).
        example: darwin
        flat_name: os.platform
        ignore_above: 1024
        level: extended
        name: platform
        node_name: platform
        normalize: []
        short: Operating system platform (such centos, ubuntu, windows).
        type: keyword
    type:
      field_details:
        dashed_name: os-type
        description: 'Use the `os.type` field to categorize the operating system into
          one of the broad commercial families.

          One of these following values should be used (lowercase): linux, macos,
          unix, windows.

          If the OS you''re dealing with is not in the list, the field should not
          be populated. Please let us know by opening an issue with ECS, to propose
          its addition.'
        example: macos
        flat_name: os.type
        ignore_above: 1024
        level: extended
        name: type
        node_name: type
        normalize: []
        short: 'Which commercial OS family (one of: linux, macos, unix or windows).'
        type: keyword
    version:
      field_details:
        dashed_name: os-version
        description: Operating system version as a raw string.
        example: 10.14.1
        flat_name: os.version
        ignore_above: 1024
        level: extended
        name: version
        node_name: version
        normalize: []
        short: Operating system version as a raw string.
        type: keyword
  schema_details:
    group: 2
    prefix: os.
    reusable:
      expected:
      - as: os
        at: observer
        full: observer.os
      - as: os
        at: host
        full: host.os
      - as: os
        at: user_agent
        full: user_agent.os
      order: 2
      top_level: false
    root: false
    title: Operating System
package:
  field_details:
    dashed_name: package
    description: These fields contain information about an installed software package.
      It contains general information about a package, such as name, version or size.
      It also contains installation details, such as time or location.
    flat_name: package
    name: package
    node_name: package
    short: These fields contain information about an installed software package.
    type: group
  fields:
    architecture:
      field_details:
        dashed_name: package-architecture
        description: Package architecture.
        example: x86_64
        flat_name: package.architecture
        ignore_above: 1024
        level: extended
        name: architecture
        node_name: architecture
        normalize: []
        short: Package architecture.
        type: keyword
    build_version:
      field_details:
        dashed_name: package-build-version
        description: 'Additional information about the build version of the installed
          package.

          For example use the commit SHA of a non-released package.'
        example: 36f4f7e89dd61b0988b12ee000b98966867710cd
        flat_name: package.build_version
        ignore_above: 1024
        level: extended
        name: build_version
        node_name: build_version
        normalize: []
        short: Build version information
        type: keyword
    checksum:
      field_details:
        dashed_name: package-checksum
        description: Checksum of the installed package for verification.
        example: 68b329da9893e34099c7d8ad5cb9c940
        flat_name: package.checksum
        ignore_above: 1024
        level: extended
        name: checksum
        node_name: checksum
        normalize: []
        short: Checksum of the installed package for verification.
        type: keyword
    description:
      field_details:
        dashed_name: package-description
        description: Description of the package.
        example: Open source programming language to build simple/reliable/efficient
          software.
        flat_name: package.description
        ignore_above: 1024
        level: extended
        name: description
        node_name: description
        normalize: []
        short: Description of the package.
        type: keyword
    install_scope:
      field_details:
        dashed_name: package-install-scope
        description: Indicating how the package was installed, e.g. user-local, global.
        example: global
        flat_name: package.install_scope
        ignore_above: 1024
        level: extended
        name: install_scope
        node_name: install_scope
        normalize: []
        short: Indicating how the package was installed, e.g. user-local, global.
        type: keyword
    installed:
      field_details:
        dashed_name: package-installed
        description: Time when package was installed.
        flat_name: package.installed
        level: extended
        name: installed
        node_name: installed
        normalize: []
        short: Time when package was installed.
        type: date
    license:
      field_details:
        dashed_name: package-license
        description: 'License under which the package was released.

          Use a short name, e.g. the license identifier from SPDX License List where
          possible (https://spdx.org/licenses/).'
        example: Apache License 2.0
        flat_name: package.license
        ignore_above: 1024
        level: extended
        name: license
        node_name: license
        normalize: []
        short: Package license
        type: keyword
    name:
      field_details:
        dashed_name: package-name
        description: Package name
        example: go
        flat_name: package.name
        ignore_above: 1024
        level: extended
        name: name
        node_name: name
        normalize: []
        short: Package name
        type: keyword
    path:
      field_details:
        dashed_name: package-path
        description: Path where the package is installed.
        example: /usr/local/Cellar/go/1.12.9/
        flat_name: package.path
        ignore_above: 1024
        level: extended
        name: path
        node_name: path
        normalize: []
        short: Path where the package is installed.
        type: keyword
    reference:
      field_details:
        dashed_name: package-reference
        description: Home page or reference URL of the software in this package, if
          available.
        example: https://golang.org
        flat_name: package.reference
        ignore_above: 1024
        level: extended
        name: reference
        node_name: reference
        normalize: []
        short: Package home page or reference URL
        type: keyword
    size:
      field_details:
        dashed_name: package-size
        description: Package size in bytes.
        example: 62231
        flat_name: package.size
        format: string
        level: extended
        name: size
        node_name: size
        normalize: []
        short: Package size in bytes.
        type: long
    type:
      field_details:
        dashed_name: package-type
        description: 'Type of package.

          This should contain the package file type, rather than the package manager
          name. Examples: rpm, dpkg, brew, npm, gem, nupkg, jar.'
        example: rpm
        flat_name: package.type
        ignore_above: 1024
        level: extended
        name: type
        node_name: type
        normalize: []
        short: Package type
        type: keyword
    version:
      field_details:
        dashed_name: package-version
        description: Package version
        example: 1.12.9
        flat_name: package.version
        ignore_above: 1024
        level: extended
        name: version
        node_name: version
        normalize: []
        short: Package version
        type: keyword
  schema_details:
    group: 2
    prefix: package.
    root: false
    title: Package
process:
  field_details:
    dashed_name: process
    description: 'These fields contain information about a process.

      These fields can help you correlate metrics information with a process id/name
      from a log message.  The `process.pid` often stays in the metric itself and
      is copied to the global field for correlation.'
    flat_name: process
    name: process
    node_name: process
    short: These fields contain information about a process.
    type: group
  fields:
    args:
      field_details:
        dashed_name: process-args
        description: 'Array of process arguments, starting with the absolute path
          to the executable.

          May be filtered to protect sensitive information.'
        example: '["/usr/bin/ssh", "-l", "user", "10.0.0.16"]'
        flat_name: process.args
        ignore_above: 1024
        level: extended
        name: args
        node_name: args
        normalize:
        - array
        short: Array of process arguments.
        type: keyword
    args_count:
      field_details:
        dashed_name: process-args-count
        description: 'Length of the process.args array.

          This field can be useful for querying or performing bucket analysis on how
          many arguments were provided to start a process. More arguments may be an
          indication of suspicious activity.'
        example: 4
        flat_name: process.args_count
        level: extended
        name: args_count
        node_name: args_count
        normalize: []
        short: Length of the process.args array.
        type: long
    command_line:
      field_details:
        dashed_name: process-command-line
        description: 'Full command line that started the process, including the absolute
          path to the executable, and all arguments.

          Some arguments may be filtered to protect sensitive information.'
        example: /usr/bin/ssh -l user 10.0.0.16
        flat_name: process.command_line
        ignore_above: 1024
        level: extended
        multi_fields:
        - flat_name: process.command_line.text
          name: text
          norms: false
          type: text
        name: command_line
        node_name: command_line
        normalize: []
        short: Full command line that started the process.
        type: keyword
    entity_id:
      field_details:
        dashed_name: process-entity-id
        description: 'Unique identifier for the process.

          The implementation of this is specified by the data source, but some examples
          of what could be used here are a process-generated UUID, Sysmon Process
          GUIDs, or a hash of some uniquely identifying components of a process.

          Constructing a globally unique identifier is a common practice to mitigate
          PID reuse as well as to identify a specific process over time, across multiple
          monitored hosts.'
        example: c2c455d9f99375d
        flat_name: process.entity_id
        ignore_above: 1024
        level: extended
        name: entity_id
        node_name: entity_id
        normalize: []
        short: Unique identifier for the process.
        type: keyword
    executable:
      field_details:
        dashed_name: process-executable
        description: Absolute path to the process executable.
        example: /usr/bin/ssh
        flat_name: process.executable
        ignore_above: 1024
        level: extended
        multi_fields:
        - flat_name: process.executable.text
          name: text
          norms: false
          type: text
        name: executable
        node_name: executable
        normalize: []
        short: Absolute path to the process executable.
        type: keyword
    exit_code:
      field_details:
        dashed_name: process-exit-code
        description: 'The exit code of the process, if this is a termination event.

          The field should be absent if there is no exit code for the event (e.g.
          process start).'
        example: 137
        flat_name: process.exit_code
        level: extended
        name: exit_code
        node_name: exit_code
        normalize: []
        short: The exit code of the process.
        type: long
    name:
      field_details:
        dashed_name: process-name
        description: 'Process name.

          Sometimes called program name or similar.'
        example: ssh
        flat_name: process.name
        ignore_above: 1024
        level: extended
        multi_fields:
        - flat_name: process.name.text
          name: text
          norms: false
          type: text
        name: name
        node_name: name
        normalize: []
        short: Process name.
        type: keyword
    pgid:
      field_details:
        dashed_name: process-pgid
        description: Identifier of the group of processes the process belongs to.
        flat_name: process.pgid
        format: string
        level: extended
        name: pgid
        node_name: pgid
        normalize: []
        short: Identifier of the group of processes the process belongs to.
        type: long
    pid:
      field_details:
        dashed_name: process-pid
        description: Process id.
        example: 4242
        flat_name: process.pid
        format: string
        level: core
        name: pid
        node_name: pid
        normalize: []
        short: Process id.
        type: long
    ppid:
      field_details:
        dashed_name: process-ppid
        description: Parent process' pid.
        example: 4241
        flat_name: process.ppid
        format: string
        level: extended
        name: ppid
        node_name: ppid
        normalize: []
        short: Parent process' pid.
        type: long
    start:
      field_details:
        dashed_name: process-start
        description: The time the process started.
        example: '2016-05-23T08:05:34.853Z'
        flat_name: process.start
        level: extended
        name: start
        node_name: start
        normalize: []
        short: The time the process started.
        type: date
    thread:
      field_details:
        dashed_name: process-thread
        flat_name: process.thread
        intermediate: true
        name: thread
        node_name: thread
        type: object
      fields:
        id:
          field_details:
            dashed_name: process-thread-id
            description: Thread ID.
            example: 4242
            flat_name: process.thread.id
            format: string
            level: extended
            name: thread.id
            node_name: id
            normalize: []
            short: Thread ID.
            type: long
        name:
          field_details:
            dashed_name: process-thread-name
            description: Thread name.
            example: thread-0
            flat_name: process.thread.name
            ignore_above: 1024
            level: extended
            name: thread.name
            node_name: name
            normalize: []
            short: Thread name.
            type: keyword
    title:
      field_details:
        dashed_name: process-title
        description: 'Process title.

          The proctitle, some times the same as process name. Can also be different:
          for example a browser setting its title to the web page currently opened.'
        flat_name: process.title
        ignore_above: 1024
        level: extended
        multi_fields:
        - flat_name: process.title.text
          name: text
          norms: false
          type: text
        name: title
        node_name: title
        normalize: []
        short: Process title.
        type: keyword
    uptime:
      field_details:
        dashed_name: process-uptime
        description: Seconds the process has been up.
        example: 1325
        flat_name: process.uptime
        level: extended
        name: uptime
        node_name: uptime
        normalize: []
        short: Seconds the process has been up.
        type: long
    working_directory:
      field_details:
        dashed_name: process-working-directory
        description: The working directory of the process.
        example: /home/alice
        flat_name: process.working_directory
        ignore_above: 1024
        level: extended
        multi_fields:
        - flat_name: process.working_directory.text
          name: text
          norms: false
          type: text
        name: working_directory
        node_name: working_directory
        normalize: []
        short: The working directory of the process.
        type: keyword
  schema_details:
    group: 2
    nestings:
    - process.code_signature
    - process.elf
    - process.hash
    - process.parent
    - process.pe
    prefix: process.
    reusable:
      expected:
      - as: parent
        at: process
        full: process.parent
        short_override: Information about the parent process.
      order: 2
      top_level: true
    reused_here:
    - full: process.code_signature
      schema_name: code_signature
      short: These fields contain information about binary code signatures.
    - beta: This field reuse is beta and subject to change.
      full: process.elf
      schema_name: elf
      short: These fields contain Linux Executable Linkable Format (ELF) metadata.
    - full: process.hash
      schema_name: hash
      short: Hashes, usually file hashes.
    - full: process.pe
      schema_name: pe
      short: These fields contain Windows Portable Executable (PE) metadata.
    - full: process.parent
      schema_name: process
      short: Information about the parent process.
    root: false
    title: Process
rule:
  field_details:
    dashed_name: rule
    description: 'Rule fields are used to capture the specifics of any observer or
      agent rules that generate alerts or other notable events.

      Examples of data sources that would populate the rule fields include: network
      admission control platforms, network or host IDS/IPS, network firewalls, web
      application firewalls, url filters, endpoint detection and response (EDR) systems,
      etc.'
    flat_name: rule
    name: rule
    node_name: rule
    short: Fields to capture details about rules used to generate alerts or other
      notable events.
    type: group
  fields:
    author:
      field_details:
        dashed_name: rule-author
        description: Name, organization, or pseudonym of the author or authors who
          created the rule used to generate this event.
        example: '["Star-Lord"]'
        flat_name: rule.author
        ignore_above: 1024
        level: extended
        name: author
        node_name: author
        normalize:
        - array
        short: Rule author
        type: keyword
    category:
      field_details:
        dashed_name: rule-category
        description: A categorization value keyword used by the entity using the rule
          for detection of this event.
        example: Attempted Information Leak
        flat_name: rule.category
        ignore_above: 1024
        level: extended
        name: category
        node_name: category
        normalize: []
        short: Rule category
        type: keyword
    description:
      field_details:
        dashed_name: rule-description
        description: The description of the rule generating the event.
        example: Block requests to public DNS over HTTPS / TLS protocols
        flat_name: rule.description
        ignore_above: 1024
        level: extended
        name: description
        node_name: description
        normalize: []
        short: Rule description
        type: keyword
    id:
      field_details:
        dashed_name: rule-id
        description: A rule ID that is unique within the scope of an agent, observer,
          or other entity using the rule for detection of this event.
        example: 101
        flat_name: rule.id
        ignore_above: 1024
        level: extended
        name: id
        node_name: id
        normalize: []
        short: Rule ID
        type: keyword
    license:
      field_details:
        dashed_name: rule-license
        description: Name of the license under which the rule used to generate this
          event is made available.
        example: Apache 2.0
        flat_name: rule.license
        ignore_above: 1024
        level: extended
        name: license
        node_name: license
        normalize: []
        short: Rule license
        type: keyword
    name:
      field_details:
        dashed_name: rule-name
        description: The name of the rule or signature generating the event.
        example: BLOCK_DNS_over_TLS
        flat_name: rule.name
        ignore_above: 1024
        level: extended
        name: name
        node_name: name
        normalize: []
        short: Rule name
        type: keyword
    reference:
      field_details:
        dashed_name: rule-reference
        description: 'Reference URL to additional information about the rule used
          to generate this event.

          The URL can point to the vendor''s documentation about the rule. If that''s
          not available, it can also be a link to a more general page describing this
          type of alert.'
        example: https://en.wikipedia.org/wiki/DNS_over_TLS
        flat_name: rule.reference
        ignore_above: 1024
        level: extended
        name: reference
        node_name: reference
        normalize: []
        short: Rule reference URL
        type: keyword
    ruleset:
      field_details:
        dashed_name: rule-ruleset
        description: Name of the ruleset, policy, group, or parent category in which
          the rule used to generate this event is a member.
        example: Standard_Protocol_Filters
        flat_name: rule.ruleset
        ignore_above: 1024
        level: extended
        name: ruleset
        node_name: ruleset
        normalize: []
        short: Rule ruleset
        type: keyword
    uuid:
      field_details:
        dashed_name: rule-uuid
        description: A rule ID that is unique within the scope of a set or group of
          agents, observers, or other entities using the rule for detection of this
          event.
        example: 1100110011
        flat_name: rule.uuid
        ignore_above: 1024
        level: extended
        name: uuid
        node_name: uuid
        normalize: []
        short: Rule UUID
        type: keyword
    version:
      field_details:
        dashed_name: rule-version
        description: The version / revision of the rule being used for analysis.
        example: 1.1
        flat_name: rule.version
        ignore_above: 1024
        level: extended
        name: version
        node_name: version
        normalize: []
        short: Rule version
        type: keyword
  schema_details:
    group: 2
    prefix: rule.
    root: false
    title: Rule
server:
  field_details:
    dashed_name: server
    description: 'A Server is defined as the responder in a network connection for
      events regarding sessions, connections, or bidirectional flow records.

      For TCP events, the server is the receiver of the initial SYN packet(s) of the
      TCP connection. For other protocols, the server is generally the responder in
      the network transaction. Some systems actually use the term "responder" to refer
      the server in TCP connections. The server fields describe details about the
      system acting as the server in the network event. Server fields are usually
      populated in conjunction with client fields. Server fields are generally not
      populated for packet-level events.

      Client / server representations can add semantic context to an exchange, which
      is helpful to visualize the data in certain situations. If your context falls
      in that category, you should still ensure that source and destination are filled
      appropriately.'
    flat_name: server
    name: server
    node_name: server
    short: Fields about the server side of a network connection, used with client.
    type: group
  fields:
    address:
      field_details:
        dashed_name: server-address
        description: 'Some event server addresses are defined ambiguously. The event
          will sometimes list an IP, a domain or a unix socket.  You should always
          store the raw address in the `.address` field.

          Then it should be duplicated to `.ip` or `.domain`, depending on which one
          it is.'
        flat_name: server.address
        ignore_above: 1024
        level: extended
        name: address
        node_name: address
        normalize: []
        short: Server network address.
        type: keyword
    as:
      field_details:
        dashed_name: server-as
        description: An autonomous system (AS) is a collection of connected Internet
          Protocol (IP) routing prefixes under the control of one or more network
          operators on behalf of a single administrative entity or domain that presents
          a common, clearly defined routing policy to the internet.
        flat_name: server.as
        intermediate: true
        name: as
        node_name: as
        original_fieldset: as
        short: Fields describing an Autonomous System (Internet routing prefix).
        type: group
      fields:
        number:
          field_details:
            dashed_name: server-as-number
            description: Unique number allocated to the autonomous system. The autonomous
              system number (ASN) uniquely identifies each network on the Internet.
            example: 15169
            flat_name: server.as.number
            level: extended
            name: number
            node_name: number
            normalize: []
            original_fieldset: as
            short: Unique number allocated to the autonomous system.
            type: long
        organization:
          field_details:
            dashed_name: server-as-organization
            flat_name: server.as.organization
            intermediate: true
            name: organization
            node_name: organization
            original_fieldset: as
            type: object
          fields:
            name:
              field_details:
                dashed_name: server-as-organization-name
                description: Organization name.
                example: Google LLC
                flat_name: server.as.organization.name
                ignore_above: 1024
                level: extended
                multi_fields:
                - flat_name: server.as.organization.name.text
                  name: text
                  norms: false
                  type: text
                name: organization.name
                node_name: name
                normalize: []
                original_fieldset: as
                short: Organization name.
                type: keyword
    bytes:
      field_details:
        dashed_name: server-bytes
        description: Bytes sent from the server to the client.
        example: 184
        flat_name: server.bytes
        format: bytes
        level: core
        name: bytes
        node_name: bytes
        normalize: []
        short: Bytes sent from the server to the client.
        type: long
    domain:
      field_details:
        dashed_name: server-domain
        description: Server domain.
        flat_name: server.domain
        ignore_above: 1024
        level: core
        name: domain
        node_name: domain
        normalize: []
        short: Server domain.
        type: keyword
    geo:
      field_details:
        dashed_name: server-geo
        description: 'Geo fields can carry data about a specific location related
          to an event.

          This geolocation information can be derived from techniques such as Geo
          IP, or be user-supplied.'
        flat_name: server.geo
        intermediate: true
        name: geo
        node_name: geo
        original_fieldset: geo
        short: Fields describing a location.
        type: group
      fields:
        city_name:
          field_details:
            dashed_name: server-geo-city-name
            description: City name.
            example: Montreal
            flat_name: server.geo.city_name
            ignore_above: 1024
            level: core
            name: city_name
            node_name: city_name
            normalize: []
            original_fieldset: geo
            short: City name.
            type: keyword
        continent_code:
          field_details:
            dashed_name: server-geo-continent-code
            description: Two-letter code representing continent's name.
            example: NA
            flat_name: server.geo.continent_code
            ignore_above: 1024
            level: core
            name: continent_code
            node_name: continent_code
            normalize: []
            original_fieldset: geo
            short: Continent code.
            type: keyword
        continent_name:
          field_details:
            dashed_name: server-geo-continent-name
            description: Name of the continent.
            example: North America
            flat_name: server.geo.continent_name
            ignore_above: 1024
            level: core
            name: continent_name
            node_name: continent_name
            normalize: []
            original_fieldset: geo
            short: Name of the continent.
            type: keyword
        country_iso_code:
          field_details:
            dashed_name: server-geo-country-iso-code
            description: Country ISO code.
            example: CA
            flat_name: server.geo.country_iso_code
            ignore_above: 1024
            level: core
            name: country_iso_code
            node_name: country_iso_code
            normalize: []
            original_fieldset: geo
            short: Country ISO code.
            type: keyword
        country_name:
          field_details:
            dashed_name: server-geo-country-name
            description: Country name.
            example: Canada
            flat_name: server.geo.country_name
            ignore_above: 1024
            level: core
            name: country_name
            node_name: country_name
            normalize: []
            original_fieldset: geo
            short: Country name.
            type: keyword
        location:
          field_details:
            dashed_name: server-geo-location
            description: Longitude and latitude.
            example: '{ "lon": -73.614830, "lat": 45.505918 }'
            flat_name: server.geo.location
            level: core
            name: location
            node_name: location
            normalize: []
            original_fieldset: geo
            short: Longitude and latitude.
            type: geo_point
        name:
          field_details:
            dashed_name: server-geo-name
            description: 'User-defined description of a location, at the level of
              granularity they care about.

              Could be the name of their data centers, the floor number, if this describes
              a local physical entity, city names.

              Not typically used in automated geolocation.'
            example: boston-dc
            flat_name: server.geo.name
            ignore_above: 1024
            level: extended
            name: name
            node_name: name
            normalize: []
            original_fieldset: geo
            short: User-defined description of a location.
            type: keyword
        postal_code:
          field_details:
            dashed_name: server-geo-postal-code
            description: 'Postal code associated with the location.

              Values appropriate for this field may also be known as a postcode or
              ZIP code and will vary widely from country to country.'
            example: 94040
            flat_name: server.geo.postal_code
            ignore_above: 1024
            level: core
            name: postal_code
            node_name: postal_code
            normalize: []
            original_fieldset: geo
            short: Postal code.
            type: keyword
        region_iso_code:
          field_details:
            dashed_name: server-geo-region-iso-code
            description: Region ISO code.
            example: CA-QC
            flat_name: server.geo.region_iso_code
            ignore_above: 1024
            level: core
            name: region_iso_code
            node_name: region_iso_code
            normalize: []
            original_fieldset: geo
            short: Region ISO code.
            type: keyword
        region_name:
          field_details:
            dashed_name: server-geo-region-name
            description: Region name.
            example: Quebec
            flat_name: server.geo.region_name
            ignore_above: 1024
            level: core
            name: region_name
            node_name: region_name
            normalize: []
            original_fieldset: geo
            short: Region name.
            type: keyword
        timezone:
          field_details:
            dashed_name: server-geo-timezone
            description: The time zone of the location, such as IANA time zone name.
            example: America/Argentina/Buenos_Aires
            flat_name: server.geo.timezone
            ignore_above: 1024
            level: core
            name: timezone
            node_name: timezone
            normalize: []
            original_fieldset: geo
            short: Time zone.
            type: keyword
    ip:
      field_details:
        dashed_name: server-ip
        description: IP address of the server (IPv4 or IPv6).
        flat_name: server.ip
        level: core
        name: ip
        node_name: ip
        normalize: []
        short: IP address of the server.
        type: ip
    mac:
      field_details:
        dashed_name: server-mac
        description: 'MAC address of the server.

          The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit
          byte) is represented by two [uppercase] hexadecimal digits giving the value
          of the octet as an unsigned integer. Successive octets are separated by
          a hyphen.'
        example: 00-00-5E-00-53-23
        flat_name: server.mac
        ignore_above: 1024
        level: core
        name: mac
        node_name: mac
        normalize: []
        short: MAC address of the server.
        type: keyword
    nat:
      field_details:
        dashed_name: server-nat
        flat_name: server.nat
        intermediate: true
        name: nat
        node_name: nat
        type: object
      fields:
        ip:
          field_details:
            dashed_name: server-nat-ip
            description: 'Translated ip of destination based NAT sessions (e.g. internet
              to private DMZ)

              Typically used with load balancers, firewalls, or routers.'
            flat_name: server.nat.ip
            level: extended
            name: nat.ip
            node_name: ip
            normalize: []
            short: Server NAT ip
            type: ip
        port:
          field_details:
            dashed_name: server-nat-port
            description: 'Translated port of destination based NAT sessions (e.g.
              internet to private DMZ)

              Typically used with load balancers, firewalls, or routers.'
            flat_name: server.nat.port
            format: string
            level: extended
            name: nat.port
            node_name: port
            normalize: []
            short: Server NAT port
            type: long
    packets:
      field_details:
        dashed_name: server-packets
        description: Packets sent from the server to the client.
        example: 12
        flat_name: server.packets
        level: core
        name: packets
        node_name: packets
        normalize: []
        short: Packets sent from the server to the client.
        type: long
    port:
      field_details:
        dashed_name: server-port
        description: Port of the server.
        flat_name: server.port
        format: string
        level: core
        name: port
        node_name: port
        normalize: []
        short: Port of the server.
        type: long
    registered_domain:
      field_details:
        dashed_name: server-registered-domain
        description: 'The highest registered server domain, stripped of the subdomain.

          For example, the registered domain for "foo.example.com" is "example.com".

          This value can be determined precisely with a list like the public suffix
          list (http://publicsuffix.org). Trying to approximate this by simply taking
          the last two labels will not work well for TLDs such as "co.uk".'
        example: example.com
        flat_name: server.registered_domain
        ignore_above: 1024
        level: extended
        name: registered_domain
        node_name: registered_domain
        normalize: []
        short: The highest registered server domain, stripped of the subdomain.
        type: keyword
    subdomain:
      field_details:
        dashed_name: server-subdomain
        description: 'The subdomain portion of a fully qualified domain name includes
          all of the names except the host name under the registered_domain.  In a
          partially qualified domain, or if the the qualification level of the full
          name cannot be determined, subdomain contains all of the names below the
          registered domain.

          For example the subdomain portion of "www.east.mydomain.co.uk" is "east".
          If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com",
          the subdomain field should contain "sub2.sub1", with no trailing period.'
        example: east
        flat_name: server.subdomain
        ignore_above: 1024
        level: extended
        name: subdomain
        node_name: subdomain
        normalize: []
        short: The subdomain of the domain.
        type: keyword
    top_level_domain:
      field_details:
        dashed_name: server-top-level-domain
        description: 'The effective top level domain (eTLD), also known as the domain
          suffix, is the last part of the domain name. For example, the top level
          domain for example.com is "com".

          This value can be determined precisely with a list like the public suffix
          list (http://publicsuffix.org). Trying to approximate this by simply taking
          the last label will not work well for effective TLDs such as "co.uk".'
        example: co.uk
        flat_name: server.top_level_domain
        ignore_above: 1024
        level: extended
        name: top_level_domain
        node_name: top_level_domain
        normalize: []
        short: The effective top level domain (com, org, net, co.uk).
        type: keyword
    user:
      field_details:
        dashed_name: server-user
        description: 'The user fields describe information about the user that is
          relevant to the event.

          Fields can have one entry or multiple entries. If a user has more than one
          id, provide an array that includes all of them.'
        flat_name: server.user
        intermediate: true
        name: user
        node_name: user
        original_fieldset: user
        short: Fields to describe the user relevant to the event.
        type: group
      fields:
        domain:
          field_details:
            dashed_name: server-user-domain
            description: 'Name of the directory the user is a member of.

              For example, an LDAP or Active Directory domain name.'
            flat_name: server.user.domain
            ignore_above: 1024
            level: extended
            name: domain
            node_name: domain
            normalize: []
            original_fieldset: user
            short: Name of the directory the user is a member of.
            type: keyword
        email:
          field_details:
            dashed_name: server-user-email
            description: User email address.
            flat_name: server.user.email
            ignore_above: 1024
            level: extended
            name: email
            node_name: email
            normalize: []
            original_fieldset: user
            short: User email address.
            type: keyword
        extra:
          field_details:
            dashed_name: server-user-extra
            description: 'Additional information in key/value pairs.

              For additional information provided by the authenticator to events.

              Note: Not searchable or filterable.'
            enabled: false
            example: '{"authenticator": "ldap", "cipher": "argon2"}'
            flat_name: server.user.extra
            level: custom
            name: extra
            node_name: extra
            normalize: []
            object_type: keyword
            original_fieldset: user
            short: Custom key/value pairs.
            type: object
        full_name:
          field_details:
            dashed_name: server-user-full-name
            description: User's full name, if available.
            example: Albert Einstein
            flat_name: server.user.full_name
            ignore_above: 1024
            level: extended
            multi_fields:
            - flat_name: server.user.full_name.text
              name: text
              norms: false
              type: text
            name: full_name
            node_name: full_name
            normalize: []
            original_fieldset: user
            short: User's full name, if available.
            type: keyword
        group:
          field_details:
            dashed_name: server-user-group
            description: The group fields are meant to represent groups that are relevant
              to the event.
            flat_name: server.user.group
            intermediate: true
            name: group
            node_name: group
            original_fieldset: group
            short: User's group relevant to the event.
            type: group
          fields:
            domain:
              field_details:
                dashed_name: server-user-group-domain
                description: 'Name of the directory the group is a member of.

                  For example, an LDAP or Active Directory domain name.'
                flat_name: server.user.group.domain
                ignore_above: 1024
                level: extended
                name: domain
                node_name: domain
                normalize: []
                original_fieldset: group
                short: Name of the directory the group is a member of.
                type: keyword
            id:
              field_details:
                dashed_name: server-user-group-id
                description: Unique identifier for the group on the system/platform.
                flat_name: server.user.group.id
                ignore_above: 1024
                level: extended
                name: id
                node_name: id
                normalize: []
                original_fieldset: group
                short: Unique identifier for the group on the system/platform.
                type: keyword
            name:
              field_details:
                dashed_name: server-user-group-name
                description: Name of the group.
                flat_name: server.user.group.name
                ignore_above: 1024
                level: extended
                name: name
                node_name: name
                normalize: []
                original_fieldset: group
                short: Name of the group.
                type: keyword
        hash:
          field_details:
            dashed_name: server-user-hash
            description: 'Unique user hash to correlate information for a user in
              anonymized form.

              Useful if `user.id` or `user.name` contain confidential information
              and cannot be used.'
            flat_name: server.user.hash
            ignore_above: 1024
            level: extended
            name: hash
            node_name: hash
            normalize: []
            original_fieldset: user
            short: Unique user hash to correlate information for a user in anonymized
              form.
            type: keyword
        id:
          field_details:
            dashed_name: server-user-id
            description: Unique identifier of the user.
            flat_name: server.user.id
            ignore_above: 1024
            level: core
            name: id
            node_name: id
            normalize: []
            original_fieldset: user
            short: Unique identifier of the user.
            type: keyword
        name:
          field_details:
            dashed_name: server-user-name
            description: Short name or login of the user.
            example: albert
            flat_name: server.user.name
            ignore_above: 1024
            level: core
            multi_fields:
            - flat_name: server.user.name.text
              name: text
              norms: false
              type: text
            name: name
            node_name: name
            normalize: []
            original_fieldset: user
            short: Short name or login of the user.
            type: keyword
        roles:
          field_details:
            dashed_name: server-user-roles
            description: Array of user roles at the time of the event.
            example: '["kibana_admin", "reporting_user"]'
            flat_name: server.user.roles
            ignore_above: 1024
            level: extended
            name: roles
            node_name: roles
            normalize:
            - array
            original_fieldset: user
            short: Array of user roles at the time of the event.
            type: keyword
  schema_details:
    group: 2
    nestings:
    - server.as
    - server.geo
    - server.user
    prefix: server.
    reused_here:
    - full: server.as
      schema_name: as
      short: Fields describing an Autonomous System (Internet routing prefix).
    - full: server.geo
      schema_name: geo
      short: Fields describing a location.
    - full: server.user
      schema_name: user
      short: Fields to describe the user relevant to the event.
    root: false
    title: Server
service:
  field_details:
    dashed_name: service
    description: 'The service fields describe the service for or from which the data
      was collected.

      These fields help you find and correlate logs for a specific service and version.'
    flat_name: service
    name: service
    node_name: service
    short: Fields describing the service for or from which the data was collected.
    type: group
  fields:
    ephemeral_id:
      field_details:
        dashed_name: service-ephemeral-id
        description: 'Ephemeral identifier of this service (if one exists).

          This id normally changes across restarts, but `service.id` does not.'
        example: 8a4f500f
        flat_name: service.ephemeral_id
        ignore_above: 1024
        level: extended
        name: ephemeral_id
        node_name: ephemeral_id
        normalize: []
        short: Ephemeral identifier of this service.
        type: keyword
    id:
      field_details:
        dashed_name: service-id
        description: 'Unique identifier of the running service. If the service is
          comprised of many nodes, the `service.id` should be the same for all nodes.

          This id should uniquely identify the service. This makes it possible to
          correlate logs and metrics for one specific service, no matter which particular
          node emitted the event.

          Note that if you need to see the events from one specific host of the service,
          you should filter on that `host.name` or `host.id` instead.'
        example: d37e5ebfe0ae6c4972dbe9f0174a1637bb8247f6
        flat_name: service.id
        ignore_above: 1024
        level: core
        name: id
        node_name: id
        normalize: []
        short: Unique identifier of the running service.
        type: keyword
    name:
      field_details:
        dashed_name: service-name
        description: 'Name of the service data is collected from.

          The name of the service is normally user given. This allows for distributed
          services that run on multiple hosts to correlate the related instances based
          on the name.

          In the case of Elasticsearch the `service.name` could contain the cluster
          name. For Beats the `service.name` is by default a copy of the `service.type`
          field if no name is specified.'
        example: elasticsearch-metrics
        flat_name: service.name
        ignore_above: 1024
        level: core
        name: name
        node_name: name
        normalize: []
        short: Name of the service.
        type: keyword
    node:
      field_details:
        dashed_name: service-node
        flat_name: service.node
        intermediate: true
        name: node
        node_name: node
        type: object
      fields:
        name:
          field_details:
            dashed_name: service-node-name
            description: 'Name of a service node.

              This allows for two nodes of the same service running on the same host
              to be differentiated. Therefore, `service.node.name` should typically
              be unique across nodes of a given service.

              In the case of Elasticsearch, the `service.node.name` could contain
              the unique node name within the Elasticsearch cluster. In cases where
              the service doesn''t have the concept of a node name, the host name
              or container name can be used to distinguish running instances that
              make up this service. If those do not provide uniqueness (e.g. multiple
              instances of the service running on the same host) - the node name can
              be manually set.'
            example: instance-0000000016
            flat_name: service.node.name
            ignore_above: 1024
            level: extended
            name: node.name
            node_name: name
            normalize: []
            short: Name of the service node.
            type: keyword
    state:
      field_details:
        dashed_name: service-state
        description: Current state of the service.
        flat_name: service.state
        ignore_above: 1024
        level: core
        name: state
        node_name: state
        normalize: []
        short: Current state of the service.
        type: keyword
    type:
      field_details:
        dashed_name: service-type
        description: 'The type of the service data is collected from.

          The type can be used to group and correlate logs and metrics from one service
          type.

          Example: If logs or metrics are collected from Elasticsearch, `service.type`
          would be `elasticsearch`.'
        example: elasticsearch
        flat_name: service.type
        ignore_above: 1024
        level: core
        name: type
        node_name: type
        normalize: []
        short: The type of the service.
        type: keyword
    version:
      field_details:
        dashed_name: service-version
        description: 'Version of the service the data was collected from.

          This allows to look at a data set only for a specific version of a service.'
        example: 3.2.4
        flat_name: service.version
        ignore_above: 1024
        level: core
        name: version
        node_name: version
        normalize: []
        short: Version of the service.
        type: keyword
  schema_details:
    group: 2
    prefix: service.
    root: false
    title: Service
source:
  field_details:
    dashed_name: source
    description: 'Source fields capture details about the sender of a network exchange/packet.
      These fields are populated from a network event, packet, or other event containing
      details of a network transaction.

      Source fields are usually populated in conjunction with destination fields.
      The source and destination fields are considered the baseline and should always
      be filled if an event contains source and destination details from a network
      transaction. If the event also contains identification of the client and server
      roles, then the client and server fields should also be populated.'
    flat_name: source
    name: source
    node_name: source
    short: Fields about the source side of a network connection, used with destination.
    type: group
  fields:
    address:
      field_details:
        dashed_name: source-address
        description: 'Some event source addresses are defined ambiguously. The event
          will sometimes list an IP, a domain or a unix socket.  You should always
          store the raw address in the `.address` field.

          Then it should be duplicated to `.ip` or `.domain`, depending on which one
          it is.'
        flat_name: source.address
        ignore_above: 1024
        level: extended
        name: address
        node_name: address
        normalize: []
        short: Source network address.
        type: keyword
    as:
      field_details:
        dashed_name: source-as
        description: An autonomous system (AS) is a collection of connected Internet
          Protocol (IP) routing prefixes under the control of one or more network
          operators on behalf of a single administrative entity or domain that presents
          a common, clearly defined routing policy to the internet.
        flat_name: source.as
        intermediate: true
        name: as
        node_name: as
        original_fieldset: as
        short: Fields describing an Autonomous System (Internet routing prefix).
        type: group
      fields:
        number:
          field_details:
            dashed_name: source-as-number
            description: Unique number allocated to the autonomous system. The autonomous
              system number (ASN) uniquely identifies each network on the Internet.
            example: 15169
            flat_name: source.as.number
            level: extended
            name: number
            node_name: number
            normalize: []
            original_fieldset: as
            short: Unique number allocated to the autonomous system.
            type: long
        organization:
          field_details:
            dashed_name: source-as-organization
            flat_name: source.as.organization
            intermediate: true
            name: organization
            node_name: organization
            original_fieldset: as
            type: object
          fields:
            name:
              field_details:
                dashed_name: source-as-organization-name
                description: Organization name.
                example: Google LLC
                flat_name: source.as.organization.name
                ignore_above: 1024
                level: extended
                multi_fields:
                - flat_name: source.as.organization.name.text
                  name: text
                  norms: false
                  type: text
                name: organization.name
                node_name: name
                normalize: []
                original_fieldset: as
                short: Organization name.
                type: keyword
    bytes:
      field_details:
        dashed_name: source-bytes
        description: Bytes sent from the source to the destination.
        example: 184
        flat_name: source.bytes
        format: bytes
        level: core
        name: bytes
        node_name: bytes
        normalize: []
        short: Bytes sent from the source to the destination.
        type: long
    domain:
      field_details:
        dashed_name: source-domain
        description: Source domain.
        flat_name: source.domain
        ignore_above: 1024
        level: core
        name: domain
        node_name: domain
        normalize: []
        short: Source domain.
        type: keyword
    geo:
      field_details:
        dashed_name: source-geo
        description: 'Geo fields can carry data about a specific location related
          to an event.

          This geolocation information can be derived from techniques such as Geo
          IP, or be user-supplied.'
        flat_name: source.geo
        intermediate: true
        name: geo
        node_name: geo
        original_fieldset: geo
        short: Fields describing a location.
        type: group
      fields:
        city_name:
          field_details:
            dashed_name: source-geo-city-name
            description: City name.
            example: Montreal
            flat_name: source.geo.city_name
            ignore_above: 1024
            level: core
            name: city_name
            node_name: city_name
            normalize: []
            original_fieldset: geo
            short: City name.
            type: keyword
        continent_code:
          field_details:
            dashed_name: source-geo-continent-code
            description: Two-letter code representing continent's name.
            example: NA
            flat_name: source.geo.continent_code
            ignore_above: 1024
            level: core
            name: continent_code
            node_name: continent_code
            normalize: []
            original_fieldset: geo
            short: Continent code.
            type: keyword
        continent_name:
          field_details:
            dashed_name: source-geo-continent-name
            description: Name of the continent.
            example: North America
            flat_name: source.geo.continent_name
            ignore_above: 1024
            level: core
            name: continent_name
            node_name: continent_name
            normalize: []
            original_fieldset: geo
            short: Name of the continent.
            type: keyword
        country_iso_code:
          field_details:
            dashed_name: source-geo-country-iso-code
            description: Country ISO code.
            example: CA
            flat_name: source.geo.country_iso_code
            ignore_above: 1024
            level: core
            name: country_iso_code
            node_name: country_iso_code
            normalize: []
            original_fieldset: geo
            short: Country ISO code.
            type: keyword
        country_name:
          field_details:
            dashed_name: source-geo-country-name
            description: Country name.
            example: Canada
            flat_name: source.geo.country_name
            ignore_above: 1024
            level: core
            name: country_name
            node_name: country_name
            normalize: []
            original_fieldset: geo
            short: Country name.
            type: keyword
        location:
          field_details:
            dashed_name: source-geo-location
            description: Longitude and latitude.
            example: '{ "lon": -73.614830, "lat": 45.505918 }'
            flat_name: source.geo.location
            level: core
            name: location
            node_name: location
            normalize: []
            original_fieldset: geo
            short: Longitude and latitude.
            type: geo_point
        name:
          field_details:
            dashed_name: source-geo-name
            description: 'User-defined description of a location, at the level of
              granularity they care about.

              Could be the name of their data centers, the floor number, if this describes
              a local physical entity, city names.

              Not typically used in automated geolocation.'
            example: boston-dc
            flat_name: source.geo.name
            ignore_above: 1024
            level: extended
            name: name
            node_name: name
            normalize: []
            original_fieldset: geo
            short: User-defined description of a location.
            type: keyword
        postal_code:
          field_details:
            dashed_name: source-geo-postal-code
            description: 'Postal code associated with the location.

              Values appropriate for this field may also be known as a postcode or
              ZIP code and will vary widely from country to country.'
            example: 94040
            flat_name: source.geo.postal_code
            ignore_above: 1024
            level: core
            name: postal_code
            node_name: postal_code
            normalize: []
            original_fieldset: geo
            short: Postal code.
            type: keyword
        region_iso_code:
          field_details:
            dashed_name: source-geo-region-iso-code
            description: Region ISO code.
            example: CA-QC
            flat_name: source.geo.region_iso_code
            ignore_above: 1024
            level: core
            name: region_iso_code
            node_name: region_iso_code
            normalize: []
            original_fieldset: geo
            short: Region ISO code.
            type: keyword
        region_name:
          field_details:
            dashed_name: source-geo-region-name
            description: Region name.
            example: Quebec
            flat_name: source.geo.region_name
            ignore_above: 1024
            level: core
            name: region_name
            node_name: region_name
            normalize: []
            original_fieldset: geo
            short: Region name.
            type: keyword
        timezone:
          field_details:
            dashed_name: source-geo-timezone
            description: The time zone of the location, such as IANA time zone name.
            example: America/Argentina/Buenos_Aires
            flat_name: source.geo.timezone
            ignore_above: 1024
            level: core
            name: timezone
            node_name: timezone
            normalize: []
            original_fieldset: geo
            short: Time zone.
            type: keyword
    ip:
      field_details:
        dashed_name: source-ip
        description: IP address of the source (IPv4 or IPv6).
        flat_name: source.ip
        level: core
        name: ip
        node_name: ip
        normalize: []
        short: IP address of the source.
        type: ip
    mac:
      field_details:
        dashed_name: source-mac
        description: 'MAC address of the source.

          The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit
          byte) is represented by two [uppercase] hexadecimal digits giving the value
          of the octet as an unsigned integer. Successive octets are separated by
          a hyphen.'
        example: 00-00-5E-00-53-23
        flat_name: source.mac
        ignore_above: 1024
        level: core
        name: mac
        node_name: mac
        normalize: []
        short: MAC address of the source.
        type: keyword
    nat:
      field_details:
        dashed_name: source-nat
        flat_name: source.nat
        intermediate: true
        name: nat
        node_name: nat
        type: object
      fields:
        ip:
          field_details:
            dashed_name: source-nat-ip
            description: 'Translated ip of source based NAT sessions (e.g. internal
              client to internet)

              Typically connections traversing load balancers, firewalls, or routers.'
            flat_name: source.nat.ip
            level: extended
            name: nat.ip
            node_name: ip
            normalize: []
            short: Source NAT ip
            type: ip
        port:
          field_details:
            dashed_name: source-nat-port
            description: 'Translated port of source based NAT sessions. (e.g. internal
              client to internet)

              Typically used with load balancers, firewalls, or routers.'
            flat_name: source.nat.port
            format: string
            level: extended
            name: nat.port
            node_name: port
            normalize: []
            short: Source NAT port
            type: long
    packets:
      field_details:
        dashed_name: source-packets
        description: Packets sent from the source to the destination.
        example: 12
        flat_name: source.packets
        level: core
        name: packets
        node_name: packets
        normalize: []
        short: Packets sent from the source to the destination.
        type: long
    port:
      field_details:
        dashed_name: source-port
        description: Port of the source.
        flat_name: source.port
        format: string
        level: core
        name: port
        node_name: port
        normalize: []
        short: Port of the source.
        type: long
    registered_domain:
      field_details:
        dashed_name: source-registered-domain
        description: 'The highest registered source domain, stripped of the subdomain.

          For example, the registered domain for "foo.example.com" is "example.com".

          This value can be determined precisely with a list like the public suffix
          list (http://publicsuffix.org). Trying to approximate this by simply taking
          the last two labels will not work well for TLDs such as "co.uk".'
        example: example.com
        flat_name: source.registered_domain
        ignore_above: 1024
        level: extended
        name: registered_domain
        node_name: registered_domain
        normalize: []
        short: The highest registered source domain, stripped of the subdomain.
        type: keyword
    subdomain:
      field_details:
        dashed_name: source-subdomain
        description: 'The subdomain portion of a fully qualified domain name includes
          all of the names except the host name under the registered_domain.  In a
          partially qualified domain, or if the the qualification level of the full
          name cannot be determined, subdomain contains all of the names below the
          registered domain.

          For example the subdomain portion of "www.east.mydomain.co.uk" is "east".
          If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com",
          the subdomain field should contain "sub2.sub1", with no trailing period.'
        example: east
        flat_name: source.subdomain
        ignore_above: 1024
        level: extended
        name: subdomain
        node_name: subdomain
        normalize: []
        short: The subdomain of the domain.
        type: keyword
    top_level_domain:
      field_details:
        dashed_name: source-top-level-domain
        description: 'The effective top level domain (eTLD), also known as the domain
          suffix, is the last part of the domain name. For example, the top level
          domain for example.com is "com".

          This value can be determined precisely with a list like the public suffix
          list (http://publicsuffix.org). Trying to approximate this by simply taking
          the last label will not work well for effective TLDs such as "co.uk".'
        example: co.uk
        flat_name: source.top_level_domain
        ignore_above: 1024
        level: extended
        name: top_level_domain
        node_name: top_level_domain
        normalize: []
        short: The effective top level domain (com, org, net, co.uk).
        type: keyword
    user:
      field_details:
        dashed_name: source-user
        description: 'The user fields describe information about the user that is
          relevant to the event.

          Fields can have one entry or multiple entries. If a user has more than one
          id, provide an array that includes all of them.'
        flat_name: source.user
        intermediate: true
        name: user
        node_name: user
        original_fieldset: user
        short: Fields to describe the user relevant to the event.
        type: group
      fields:
        domain:
          field_details:
            dashed_name: source-user-domain
            description: 'Name of the directory the user is a member of.

              For example, an LDAP or Active Directory domain name.'
            flat_name: source.user.domain
            ignore_above: 1024
            level: extended
            name: domain
            node_name: domain
            normalize: []
            original_fieldset: user
            short: Name of the directory the user is a member of.
            type: keyword
        email:
          field_details:
            dashed_name: source-user-email
            description: User email address.
            flat_name: source.user.email
            ignore_above: 1024
            level: extended
            name: email
            node_name: email
            normalize: []
            original_fieldset: user
            short: User email address.
            type: keyword
        extra:
          field_details:
            dashed_name: source-user-extra
            description: 'Additional information in key/value pairs.

              For additional information provided by the authenticator to events.

              Note: Not searchable or filterable.'
            enabled: false
            example: '{"authenticator": "ldap", "cipher": "argon2"}'
            flat_name: source.user.extra
            level: custom
            name: extra
            node_name: extra
            normalize: []
            object_type: keyword
            original_fieldset: user
            short: Custom key/value pairs.
            type: object
        full_name:
          field_details:
            dashed_name: source-user-full-name
            description: User's full name, if available.
            example: Albert Einstein
            flat_name: source.user.full_name
            ignore_above: 1024
            level: extended
            multi_fields:
            - flat_name: source.user.full_name.text
              name: text
              norms: false
              type: text
            name: full_name
            node_name: full_name
            normalize: []
            original_fieldset: user
            short: User's full name, if available.
            type: keyword
        group:
          field_details:
            dashed_name: source-user-group
            description: The group fields are meant to represent groups that are relevant
              to the event.
            flat_name: source.user.group
            intermediate: true
            name: group
            node_name: group
            original_fieldset: group
            short: User's group relevant to the event.
            type: group
          fields:
            domain:
              field_details:
                dashed_name: source-user-group-domain
                description: 'Name of the directory the group is a member of.

                  For example, an LDAP or Active Directory domain name.'
                flat_name: source.user.group.domain
                ignore_above: 1024
                level: extended
                name: domain
                node_name: domain
                normalize: []
                original_fieldset: group
                short: Name of the directory the group is a member of.
                type: keyword
            id:
              field_details:
                dashed_name: source-user-group-id
                description: Unique identifier for the group on the system/platform.
                flat_name: source.user.group.id
                ignore_above: 1024
                level: extended
                name: id
                node_name: id
                normalize: []
                original_fieldset: group
                short: Unique identifier for the group on the system/platform.
                type: keyword
            name:
              field_details:
                dashed_name: source-user-group-name
                description: Name of the group.
                flat_name: source.user.group.name
                ignore_above: 1024
                level: extended
                name: name
                node_name: name
                normalize: []
                original_fieldset: group
                short: Name of the group.
                type: keyword
        hash:
          field_details:
            dashed_name: source-user-hash
            description: 'Unique user hash to correlate information for a user in
              anonymized form.

              Useful if `user.id` or `user.name` contain confidential information
              and cannot be used.'
            flat_name: source.user.hash
            ignore_above: 1024
            level: extended
            name: hash
            node_name: hash
            normalize: []
            original_fieldset: user
            short: Unique user hash to correlate information for a user in anonymized
              form.
            type: keyword
        id:
          field_details:
            dashed_name: source-user-id
            description: Unique identifier of the user.
            flat_name: source.user.id
            ignore_above: 1024
            level: core
            name: id
            node_name: id
            normalize: []
            original_fieldset: user
            short: Unique identifier of the user.
            type: keyword
        name:
          field_details:
            dashed_name: source-user-name
            description: Short name or login of the user.
            example: albert
            flat_name: source.user.name
            ignore_above: 1024
            level: core
            multi_fields:
            - flat_name: source.user.name.text
              name: text
              norms: false
              type: text
            name: name
            node_name: name
            normalize: []
            original_fieldset: user
            short: Short name or login of the user.
            type: keyword
        roles:
          field_details:
            dashed_name: source-user-roles
            description: Array of user roles at the time of the event.
            example: '["kibana_admin", "reporting_user"]'
            flat_name: source.user.roles
            ignore_above: 1024
            level: extended
            name: roles
            node_name: roles
            normalize:
            - array
            original_fieldset: user
            short: Array of user roles at the time of the event.
            type: keyword
  schema_details:
    group: 2
    nestings:
    - source.as
    - source.geo
    - source.user
    prefix: source.
    reused_here:
    - full: source.as
      schema_name: as
      short: Fields describing an Autonomous System (Internet routing prefix).
    - full: source.geo
      schema_name: geo
      short: Fields describing a location.
    - full: source.user
      schema_name: user
      short: Fields to describe the user relevant to the event.
    root: false
    title: Source
tls:
  field_details:
    dashed_name: tls
    description: Fields related to a TLS connection. These fields focus on the TLS
      protocol itself and intentionally avoids in-depth analysis of the related x.509
      certificate files.
    flat_name: tls
    name: tls
    node_name: tls
    short: Fields describing a TLS connection.
    type: group
  fields:
    cipher:
      field_details:
        dashed_name: tls-cipher
        description: String indicating the cipher used during the current connection.
        example: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
        flat_name: tls.cipher
        ignore_above: 1024
        level: extended
        name: cipher
        node_name: cipher
        normalize: []
        short: String indicating the cipher used during the current connection.
        type: keyword
    client:
      field_details:
        dashed_name: tls-client
        flat_name: tls.client
        intermediate: true
        name: client
        node_name: client
        type: object
      fields:
        certificate:
          field_details:
            dashed_name: tls-client-certificate
            description: PEM-encoded stand-alone certificate offered by the client.
              This is usually mutually-exclusive of `client.certificate_chain` since
              this value also exists in that list.
            example: MII...
            flat_name: tls.client.certificate
            ignore_above: 1024
            level: extended
            name: client.certificate
            node_name: certificate
            normalize: []
            short: PEM-encoded stand-alone certificate offered by the client.
            type: keyword
        certificate_chain:
          field_details:
            dashed_name: tls-client-certificate-chain
            description: Array of PEM-encoded certificates that make up the certificate
              chain offered by the client. This is usually mutually-exclusive of `client.certificate`
              since that value should be the first certificate in the chain.
            example: '["MII...", "MII..."]'
            flat_name: tls.client.certificate_chain
            ignore_above: 1024
            level: extended
            name: client.certificate_chain
            node_name: certificate_chain
            normalize:
            - array
            short: Array of PEM-encoded certificates that make up the certificate
              chain offered by the client.
            type: keyword
        hash:
          field_details:
            dashed_name: tls-client-hash
            flat_name: tls.client.hash
            intermediate: true
            name: client.hash
            node_name: hash
            type: object
          fields:
            md5:
              field_details:
                dashed_name: tls-client-hash-md5
                description: Certificate fingerprint using the MD5 digest of DER-encoded
                  version of certificate offered by the client. For consistency with
                  other hash values, this value should be formatted as an uppercase
                  hash.
                example: 0F76C7F2C55BFD7D8E8B8F4BFBF0C9EC
                flat_name: tls.client.hash.md5
                ignore_above: 1024
                level: extended
                name: client.hash.md5
                node_name: md5
                normalize: []
                short: Certificate fingerprint using the MD5 digest of DER-encoded
                  version of certificate offered by the client.
                type: keyword
            sha1:
              field_details:
                dashed_name: tls-client-hash-sha1
                description: Certificate fingerprint using the SHA1 digest of DER-encoded
                  version of certificate offered by the client. For consistency with
                  other hash values, this value should be formatted as an uppercase
                  hash.
                example: 9E393D93138888D288266C2D915214D1D1CCEB2A
                flat_name: tls.client.hash.sha1
                ignore_above: 1024
                level: extended
                name: client.hash.sha1
                node_name: sha1
                normalize: []
                short: Certificate fingerprint using the SHA1 digest of DER-encoded
                  version of certificate offered by the client.
                type: keyword
            sha256:
              field_details:
                dashed_name: tls-client-hash-sha256
                description: Certificate fingerprint using the SHA256 digest of DER-encoded
                  version of certificate offered by the client. For consistency with
                  other hash values, this value should be formatted as an uppercase
                  hash.
                example: 0687F666A054EF17A08E2F2162EAB4CBC0D265E1D7875BE74BF3C712CA92DAF0
                flat_name: tls.client.hash.sha256
                ignore_above: 1024
                level: extended
                name: client.hash.sha256
                node_name: sha256
                normalize: []
                short: Certificate fingerprint using the SHA256 digest of DER-encoded
                  version of certificate offered by the client.
                type: keyword
        issuer:
          field_details:
            dashed_name: tls-client-issuer
            description: Distinguished name of subject of the issuer of the x.509
              certificate presented by the client.
            example: CN=Example Root CA, OU=Infrastructure Team, DC=example, DC=com
            flat_name: tls.client.issuer
            ignore_above: 1024
            level: extended
            name: client.issuer
            node_name: issuer
            normalize: []
            short: Distinguished name of subject of the issuer of the x.509 certificate
              presented by the client.
            type: keyword
        ja3:
          field_details:
            dashed_name: tls-client-ja3
            description: A hash that identifies clients based on how they perform
              an SSL/TLS handshake.
            example: d4e5b18d6b55c71272893221c96ba240
            flat_name: tls.client.ja3
            ignore_above: 1024
            level: extended
            name: client.ja3
            node_name: ja3
            normalize: []
            short: A hash that identifies clients based on how they perform an SSL/TLS
              handshake.
            type: keyword
        not_after:
          field_details:
            dashed_name: tls-client-not-after
            description: Date/Time indicating when client certificate is no longer
              considered valid.
            example: '2021-01-01T00:00:00.000Z'
            flat_name: tls.client.not_after
            level: extended
            name: client.not_after
            node_name: not_after
            normalize: []
            short: Date/Time indicating when client certificate is no longer considered
              valid.
            type: date
        not_before:
          field_details:
            dashed_name: tls-client-not-before
            description: Date/Time indicating when client certificate is first considered
              valid.
            example: '1970-01-01T00:00:00.000Z'
            flat_name: tls.client.not_before
            level: extended
            name: client.not_before
            node_name: not_before
            normalize: []
            short: Date/Time indicating when client certificate is first considered
              valid.
            type: date
        server_name:
          field_details:
            dashed_name: tls-client-server-name
            description: Also called an SNI, this tells the server which hostname
              to which the client is attempting to connect to. When this value is
              available, it should get copied to `destination.domain`.
            example: www.elastic.co
            flat_name: tls.client.server_name
            ignore_above: 1024
            level: extended
            name: client.server_name
            node_name: server_name
            normalize: []
            short: Hostname the client is trying to connect to. Also called the SNI.
            type: keyword
        subject:
          field_details:
            dashed_name: tls-client-subject
            description: Distinguished name of subject of the x.509 certificate presented
              by the client.
            example: CN=myclient, OU=Documentation Team, DC=example, DC=com
            flat_name: tls.client.subject
            ignore_above: 1024
            level: extended
            name: client.subject
            node_name: subject
            normalize: []
            short: Distinguished name of subject of the x.509 certificate presented
              by the client.
            type: keyword
        supported_ciphers:
          field_details:
            dashed_name: tls-client-supported-ciphers
            description: Array of ciphers offered by the client during the client
              hello.
            example: '["TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
              "..."]'
            flat_name: tls.client.supported_ciphers
            ignore_above: 1024
            level: extended
            name: client.supported_ciphers
            node_name: supported_ciphers
            normalize:
            - array
            short: Array of ciphers offered by the client during the client hello.
            type: keyword
        x509:
          field_details:
            dashed_name: tls-client-x509
            description: 'This implements the common core fields for x509 certificates.
              This information is likely logged with TLS sessions, digital signatures
              found in executable binaries, S/MIME information in email bodies, or
              analysis of files on disk.

              When the certificate relates to a file, use the fields at `file.x509`.
              When hashes of the DER-encoded certificate are available, the `hash`
              data set should be populated as well (e.g. `file.hash.sha256`).

              Events that contain certificate information about network connections,
              should use the x509 fields under the relevant TLS fields: `tls.server.x509`
              and/or `tls.client.x509`.'
            flat_name: tls.client.x509
            intermediate: true
            name: x509
            node_name: x509
            original_fieldset: x509
            short: These fields contain x509 certificate metadata.
            type: group
          fields:
            alternative_names:
              field_details:
                dashed_name: tls-client-x509-alternative-names
                description: List of subject alternative names (SAN). Name types vary
                  by certificate authority and certificate type but commonly contain
                  IP addresses, DNS names (and wildcards), and email addresses.
                example: '*.elastic.co'
                flat_name: tls.client.x509.alternative_names
                ignore_above: 1024
                level: extended
                name: alternative_names
                node_name: alternative_names
                normalize:
                - array
                original_fieldset: x509
                short: List of subject alternative names (SAN).
                type: keyword
            issuer:
              field_details:
                dashed_name: tls-client-x509-issuer
                flat_name: tls.client.x509.issuer
                intermediate: true
                name: issuer
                node_name: issuer
                original_fieldset: x509
                type: object
              fields:
                common_name:
                  field_details:
                    dashed_name: tls-client-x509-issuer-common-name
                    description: List of common name (CN) of issuing certificate authority.
                    example: Example SHA2 High Assurance Server CA
                    flat_name: tls.client.x509.issuer.common_name
                    ignore_above: 1024
                    level: extended
                    name: issuer.common_name
                    node_name: common_name
                    normalize:
                    - array
                    original_fieldset: x509
                    short: List of common name (CN) of issuing certificate authority.
                    type: keyword
                country:
                  field_details:
                    dashed_name: tls-client-x509-issuer-country
                    description: List of country (C) codes
                    example: US
                    flat_name: tls.client.x509.issuer.country
                    ignore_above: 1024
                    level: extended
                    name: issuer.country
                    node_name: country
                    normalize:
                    - array
                    original_fieldset: x509
                    short: List of country (C) codes
                    type: keyword
                distinguished_name:
                  field_details:
                    dashed_name: tls-client-x509-issuer-distinguished-name
                    description: Distinguished name (DN) of issuing certificate authority.
                    example: C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2
                      High Assurance Server CA
                    flat_name: tls.client.x509.issuer.distinguished_name
                    ignore_above: 1024
                    level: extended
                    name: issuer.distinguished_name
                    node_name: distinguished_name
                    normalize: []
                    original_fieldset: x509
                    short: Distinguished name (DN) of issuing certificate authority.
                    type: keyword
                locality:
                  field_details:
                    dashed_name: tls-client-x509-issuer-locality
                    description: List of locality names (L)
                    example: Mountain View
                    flat_name: tls.client.x509.issuer.locality
                    ignore_above: 1024
                    level: extended
                    name: issuer.locality
                    node_name: locality
                    normalize:
                    - array
                    original_fieldset: x509
                    short: List of locality names (L)
                    type: keyword
                organization:
                  field_details:
                    dashed_name: tls-client-x509-issuer-organization
                    description: List of organizations (O) of issuing certificate
                      authority.
                    example: Example Inc
                    flat_name: tls.client.x509.issuer.organization
                    ignore_above: 1024
                    level: extended
                    name: issuer.organization
                    node_name: organization
                    normalize:
                    - array
                    original_fieldset: x509
                    short: List of organizations (O) of issuing certificate authority.
                    type: keyword
                organizational_unit:
                  field_details:
                    dashed_name: tls-client-x509-issuer-organizational-unit
                    description: List of organizational units (OU) of issuing certificate
                      authority.
                    example: www.example.com
                    flat_name: tls.client.x509.issuer.organizational_unit
                    ignore_above: 1024
                    level: extended
                    name: issuer.organizational_unit
                    node_name: organizational_unit
                    normalize:
                    - array
                    original_fieldset: x509
                    short: List of organizational units (OU) of issuing certificate
                      authority.
                    type: keyword
                state_or_province:
                  field_details:
                    dashed_name: tls-client-x509-issuer-state-or-province
                    description: List of state or province names (ST, S, or P)
                    example: California
                    flat_name: tls.client.x509.issuer.state_or_province
                    ignore_above: 1024
                    level: extended
                    name: issuer.state_or_province
                    node_name: state_or_province
                    normalize:
                    - array
                    original_fieldset: x509
                    short: List of state or province names (ST, S, or P)
                    type: keyword
            not_after:
              field_details:
                dashed_name: tls-client-x509-not-after
                description: Time at which the certificate is no longer considered
                  valid.
                example: 2020-07-16 03:15:39
                flat_name: tls.client.x509.not_after
                level: extended
                name: not_after
                node_name: not_after
                normalize: []
                original_fieldset: x509
                short: Time at which the certificate is no longer considered valid.
                type: date
            not_before:
              field_details:
                dashed_name: tls-client-x509-not-before
                description: Time at which the certificate is first considered valid.
                example: 2019-08-16 01:40:25
                flat_name: tls.client.x509.not_before
                level: extended
                name: not_before
                node_name: not_before
                normalize: []
                original_fieldset: x509
                short: Time at which the certificate is first considered valid.
                type: date
            public_key_algorithm:
              field_details:
                dashed_name: tls-client-x509-public-key-algorithm
                description: Algorithm used to generate the public key.
                example: RSA
                flat_name: tls.client.x509.public_key_algorithm
                ignore_above: 1024
                level: extended
                name: public_key_algorithm
                node_name: public_key_algorithm
                normalize: []
                original_fieldset: x509
                short: Algorithm used to generate the public key.
                type: keyword
            public_key_curve:
              field_details:
                dashed_name: tls-client-x509-public-key-curve
                description: The curve used by the elliptic curve public key algorithm.
                  This is algorithm specific.
                example: nistp521
                flat_name: tls.client.x509.public_key_curve
                ignore_above: 1024
                level: extended
                name: public_key_curve
                node_name: public_key_curve
                normalize: []
                original_fieldset: x509
                short: The curve used by the elliptic curve public key algorithm.
                  This is algorithm specific.
                type: keyword
            public_key_exponent:
              field_details:
                dashed_name: tls-client-x509-public-key-exponent
                description: Exponent used to derive the public key. This is algorithm
                  specific.
                doc_values: false
                example: 65537
                flat_name: tls.client.x509.public_key_exponent
                index: false
                level: extended
                name: public_key_exponent
                node_name: public_key_exponent
                normalize: []
                original_fieldset: x509
                short: Exponent used to derive the public key. This is algorithm specific.
                type: long
            public_key_size:
              field_details:
                dashed_name: tls-client-x509-public-key-size
                description: The size of the public key space in bits.
                example: 2048
                flat_name: tls.client.x509.public_key_size
                level: extended
                name: public_key_size
                node_name: public_key_size
                normalize: []
                original_fieldset: x509
                short: The size of the public key space in bits.
                type: long
            serial_number:
              field_details:
                dashed_name: tls-client-x509-serial-number
                description: Unique serial number issued by the certificate authority.
                  For consistency, if this value is alphanumeric, it should be formatted
                  without colons and uppercase characters.
                example: 55FBB9C7DEBF09809D12CCAA
                flat_name: tls.client.x509.serial_number
                ignore_above: 1024
                level: extended
                name: serial_number
                node_name: serial_number
                normalize: []
                original_fieldset: x509
                short: Unique serial number issued by the certificate authority.
                type: keyword
            signature_algorithm:
              field_details:
                dashed_name: tls-client-x509-signature-algorithm
                description: Identifier for certificate signature algorithm. We recommend
                  using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353.
                example: SHA256-RSA
                flat_name: tls.client.x509.signature_algorithm
                ignore_above: 1024
                level: extended
                name: signature_algorithm
                node_name: signature_algorithm
                normalize: []
                original_fieldset: x509
                short: Identifier for certificate signature algorithm.
                type: keyword
            subject:
              field_details:
                dashed_name: tls-client-x509-subject
                flat_name: tls.client.x509.subject
                intermediate: true
                name: subject
                node_name: subject
                original_fieldset: x509
                type: object
              fields:
                common_name:
                  field_details:
                    dashed_name: tls-client-x509-subject-common-name
                    description: List of common names (CN) of subject.
                    example: shared.global.example.net
                    flat_name: tls.client.x509.subject.common_name
                    ignore_above: 1024
                    level: extended
                    name: subject.common_name
                    node_name: common_name
                    normalize:
                    - array
                    original_fieldset: x509
                    short: List of common names (CN) of subject.
                    type: keyword
                country:
                  field_details:
                    dashed_name: tls-client-x509-subject-country
                    description: List of country (C) code
                    example: US
                    flat_name: tls.client.x509.subject.country
                    ignore_above: 1024
                    level: extended
                    name: subject.country
                    node_name: country
                    normalize:
                    - array
                    original_fieldset: x509
                    short: List of country (C) code
                    type: keyword
                distinguished_name:
                  field_details:
                    dashed_name: tls-client-x509-subject-distinguished-name
                    description: Distinguished name (DN) of the certificate subject
                      entity.
                    example: C=US, ST=California, L=San Francisco, O=Example, Inc.,
                      CN=shared.global.example.net
                    flat_name: tls.client.x509.subject.distinguished_name
                    ignore_above: 1024
                    level: extended
                    name: subject.distinguished_name
                    node_name: distinguished_name
                    normalize: []
                    original_fieldset: x509
                    short: Distinguished name (DN) of the certificate subject entity.
                    type: keyword
                locality:
                  field_details:
                    dashed_name: tls-client-x509-subject-locality
                    description: List of locality names (L)
                    example: San Francisco
                    flat_name: tls.client.x509.subject.locality
                    ignore_above: 1024
                    level: extended
                    name: subject.locality
                    node_name: locality
                    normalize:
                    - array
                    original_fieldset: x509
                    short: List of locality names (L)
                    type: keyword
                organization:
                  field_details:
                    dashed_name: tls-client-x509-subject-organization
                    description: List of organizations (O) of subject.
                    example: Example, Inc.
                    flat_name: tls.client.x509.subject.organization
                    ignore_above: 1024
                    level: extended
                    name: subject.organization
                    node_name: organization
                    normalize:
                    - array
                    original_fieldset: x509
                    short: List of organizations (O) of subject.
                    type: keyword
                organizational_unit:
                  field_details:
                    dashed_name: tls-client-x509-subject-organizational-unit
                    description: List of organizational units (OU) of subject.
                    flat_name: tls.client.x509.subject.organizational_unit
                    ignore_above: 1024
                    level: extended
                    name: subject.organizational_unit
                    node_name: organizational_unit
                    normalize:
                    - array
                    original_fieldset: x509
                    short: List of organizational units (OU) of subject.
                    type: keyword
                state_or_province:
                  field_details:
                    dashed_name: tls-client-x509-subject-state-or-province
                    description: List of state or province names (ST, S, or P)
                    example: California
                    flat_name: tls.client.x509.subject.state_or_province
                    ignore_above: 1024
                    level: extended
                    name: subject.state_or_province
                    node_name: state_or_province
                    normalize:
                    - array
                    original_fieldset: x509
                    short: List of state or province names (ST, S, or P)
                    type: keyword
            version_number:
              field_details:
                dashed_name: tls-client-x509-version-number
                description: Version of x509 format.
                example: 3
                flat_name: tls.client.x509.version_number
                ignore_above: 1024
                level: extended
                name: version_number
                node_name: version_number
                normalize: []
                original_fieldset: x509
                short: Version of x509 format.
                type: keyword
    curve:
      field_details:
        dashed_name: tls-curve
        description: String indicating the curve used for the given cipher, when applicable.
        example: secp256r1
        flat_name: tls.curve
        ignore_above: 1024
        level: extended
        name: curve
        node_name: curve
        normalize: []
        short: String indicating the curve used for the given cipher, when applicable.
        type: keyword
    established:
      field_details:
        dashed_name: tls-established
        description: Boolean flag indicating if the TLS negotiation was successful
          and transitioned to an encrypted tunnel.
        flat_name: tls.established
        level: extended
        name: established
        node_name: established
        normalize: []
        short: Boolean flag indicating if the TLS negotiation was successful and transitioned
          to an encrypted tunnel.
        type: boolean
    next_protocol:
      field_details:
        dashed_name: tls-next-protocol
        description: String indicating the protocol being tunneled. Per the values
          in the IANA registry (https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml#alpn-protocol-ids),
          this string should be lower case.
        example: http/1.1
        flat_name: tls.next_protocol
        ignore_above: 1024
        level: extended
        name: next_protocol
        node_name: next_protocol
        normalize: []
        short: String indicating the protocol being tunneled.
        type: keyword
    resumed:
      field_details:
        dashed_name: tls-resumed
        description: Boolean flag indicating if this TLS connection was resumed from
          an existing TLS negotiation.
        flat_name: tls.resumed
        level: extended
        name: resumed
        node_name: resumed
        normalize: []
        short: Boolean flag indicating if this TLS connection was resumed from an
          existing TLS negotiation.
        type: boolean
    server:
      field_details:
        dashed_name: tls-server
        flat_name: tls.server
        intermediate: true
        name: server
        node_name: server
        type: object
      fields:
        certificate:
          field_details:
            dashed_name: tls-server-certificate
            description: PEM-encoded stand-alone certificate offered by the server.
              This is usually mutually-exclusive of `server.certificate_chain` since
              this value also exists in that list.
            example: MII...
            flat_name: tls.server.certificate
            ignore_above: 1024
            level: extended
            name: server.certificate
            node_name: certificate
            normalize: []
            short: PEM-encoded stand-alone certificate offered by the server.
            type: keyword
        certificate_chain:
          field_details:
            dashed_name: tls-server-certificate-chain
            description: Array of PEM-encoded certificates that make up the certificate
              chain offered by the server. This is usually mutually-exclusive of `server.certificate`
              since that value should be the first certificate in the chain.
            example: '["MII...", "MII..."]'
            flat_name: tls.server.certificate_chain
            ignore_above: 1024
            level: extended
            name: server.certificate_chain
            node_name: certificate_chain
            normalize:
            - array
            short: Array of PEM-encoded certificates that make up the certificate
              chain offered by the server.
            type: keyword
        hash:
          field_details:
            dashed_name: tls-server-hash
            flat_name: tls.server.hash
            intermediate: true
            name: server.hash
            node_name: hash
            type: object
          fields:
            md5:
              field_details:
                dashed_name: tls-server-hash-md5
                description: Certificate fingerprint using the MD5 digest of DER-encoded
                  version of certificate offered by the server. For consistency with
                  other hash values, this value should be formatted as an uppercase
                  hash.
                example: 0F76C7F2C55BFD7D8E8B8F4BFBF0C9EC
                flat_name: tls.server.hash.md5
                ignore_above: 1024
                level: extended
                name: server.hash.md5
                node_name: md5
                normalize: []
                short: Certificate fingerprint using the MD5 digest of DER-encoded
                  version of certificate offered by the server.
                type: keyword
            sha1:
              field_details:
                dashed_name: tls-server-hash-sha1
                description: Certificate fingerprint using the SHA1 digest of DER-encoded
                  version of certificate offered by the server. For consistency with
                  other hash values, this value should be formatted as an uppercase
                  hash.
                example: 9E393D93138888D288266C2D915214D1D1CCEB2A
                flat_name: tls.server.hash.sha1
                ignore_above: 1024
                level: extended
                name: server.hash.sha1
                node_name: sha1
                normalize: []
                short: Certificate fingerprint using the SHA1 digest of DER-encoded
                  version of certificate offered by the server.
                type: keyword
            sha256:
              field_details:
                dashed_name: tls-server-hash-sha256
                description: Certificate fingerprint using the SHA256 digest of DER-encoded
                  version of certificate offered by the server. For consistency with
                  other hash values, this value should be formatted as an uppercase
                  hash.
                example: 0687F666A054EF17A08E2F2162EAB4CBC0D265E1D7875BE74BF3C712CA92DAF0
                flat_name: tls.server.hash.sha256
                ignore_above: 1024
                level: extended
                name: server.hash.sha256
                node_name: sha256
                normalize: []
                short: Certificate fingerprint using the SHA256 digest of DER-encoded
                  version of certificate offered by the server.
                type: keyword
        issuer:
          field_details:
            dashed_name: tls-server-issuer
            description: Subject of the issuer of the x.509 certificate presented
              by the server.
            example: CN=Example Root CA, OU=Infrastructure Team, DC=example, DC=com
            flat_name: tls.server.issuer
            ignore_above: 1024
            level: extended
            name: server.issuer
            node_name: issuer
            normalize: []
            short: Subject of the issuer of the x.509 certificate presented by the
              server.
            type: keyword
        ja3s:
          field_details:
            dashed_name: tls-server-ja3s
            description: A hash that identifies servers based on how they perform
              an SSL/TLS handshake.
            example: 394441ab65754e2207b1e1b457b3641d
            flat_name: tls.server.ja3s
            ignore_above: 1024
            level: extended
            name: server.ja3s
            node_name: ja3s
            normalize: []
            short: A hash that identifies servers based on how they perform an SSL/TLS
              handshake.
            type: keyword
        not_after:
          field_details:
            dashed_name: tls-server-not-after
            description: Timestamp indicating when server certificate is no longer
              considered valid.
            example: '2021-01-01T00:00:00.000Z'
            flat_name: tls.server.not_after
            level: extended
            name: server.not_after
            node_name: not_after
            normalize: []
            short: Timestamp indicating when server certificate is no longer considered
              valid.
            type: date
        not_before:
          field_details:
            dashed_name: tls-server-not-before
            description: Timestamp indicating when server certificate is first considered
              valid.
            example: '1970-01-01T00:00:00.000Z'
            flat_name: tls.server.not_before
            level: extended
            name: server.not_before
            node_name: not_before
            normalize: []
            short: Timestamp indicating when server certificate is first considered
              valid.
            type: date
        subject:
          field_details:
            dashed_name: tls-server-subject
            description: Subject of the x.509 certificate presented by the server.
            example: CN=www.example.com, OU=Infrastructure Team, DC=example, DC=com
            flat_name: tls.server.subject
            ignore_above: 1024
            level: extended
            name: server.subject
            node_name: subject
            normalize: []
            short: Subject of the x.509 certificate presented by the server.
            type: keyword
        x509:
          field_details:
            dashed_name: tls-server-x509
            description: 'This implements the common core fields for x509 certificates.
              This information is likely logged with TLS sessions, digital signatures
              found in executable binaries, S/MIME information in email bodies, or
              analysis of files on disk.

              When the certificate relates to a file, use the fields at `file.x509`.
              When hashes of the DER-encoded certificate are available, the `hash`
              data set should be populated as well (e.g. `file.hash.sha256`).

              Events that contain certificate information about network connections,
              should use the x509 fields under the relevant TLS fields: `tls.server.x509`
              and/or `tls.client.x509`.'
            flat_name: tls.server.x509
            intermediate: true
            name: x509
            node_name: x509
            original_fieldset: x509
            short: These fields contain x509 certificate metadata.
            type: group
          fields:
            alternative_names:
              field_details:
                dashed_name: tls-server-x509-alternative-names
                description: List of subject alternative names (SAN). Name types vary
                  by certificate authority and certificate type but commonly contain
                  IP addresses, DNS names (and wildcards), and email addresses.
                example: '*.elastic.co'
                flat_name: tls.server.x509.alternative_names
                ignore_above: 1024
                level: extended
                name: alternative_names
                node_name: alternative_names
                normalize:
                - array
                original_fieldset: x509
                short: List of subject alternative names (SAN).
                type: keyword
            issuer:
              field_details:
                dashed_name: tls-server-x509-issuer
                flat_name: tls.server.x509.issuer
                intermediate: true
                name: issuer
                node_name: issuer
                original_fieldset: x509
                type: object
              fields:
                common_name:
                  field_details:
                    dashed_name: tls-server-x509-issuer-common-name
                    description: List of common name (CN) of issuing certificate authority.
                    example: Example SHA2 High Assurance Server CA
                    flat_name: tls.server.x509.issuer.common_name
                    ignore_above: 1024
                    level: extended
                    name: issuer.common_name
                    node_name: common_name
                    normalize:
                    - array
                    original_fieldset: x509
                    short: List of common name (CN) of issuing certificate authority.
                    type: keyword
                country:
                  field_details:
                    dashed_name: tls-server-x509-issuer-country
                    description: List of country (C) codes
                    example: US
                    flat_name: tls.server.x509.issuer.country
                    ignore_above: 1024
                    level: extended
                    name: issuer.country
                    node_name: country
                    normalize:
                    - array
                    original_fieldset: x509
                    short: List of country (C) codes
                    type: keyword
                distinguished_name:
                  field_details:
                    dashed_name: tls-server-x509-issuer-distinguished-name
                    description: Distinguished name (DN) of issuing certificate authority.
                    example: C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2
                      High Assurance Server CA
                    flat_name: tls.server.x509.issuer.distinguished_name
                    ignore_above: 1024
                    level: extended
                    name: issuer.distinguished_name
                    node_name: distinguished_name
                    normalize: []
                    original_fieldset: x509
                    short: Distinguished name (DN) of issuing certificate authority.
                    type: keyword
                locality:
                  field_details:
                    dashed_name: tls-server-x509-issuer-locality
                    description: List of locality names (L)
                    example: Mountain View
                    flat_name: tls.server.x509.issuer.locality
                    ignore_above: 1024
                    level: extended
                    name: issuer.locality
                    node_name: locality
                    normalize:
                    - array
                    original_fieldset: x509
                    short: List of locality names (L)
                    type: keyword
                organization:
                  field_details:
                    dashed_name: tls-server-x509-issuer-organization
                    description: List of organizations (O) of issuing certificate
                      authority.
                    example: Example Inc
                    flat_name: tls.server.x509.issuer.organization
                    ignore_above: 1024
                    level: extended
                    name: issuer.organization
                    node_name: organization
                    normalize:
                    - array
                    original_fieldset: x509
                    short: List of organizations (O) of issuing certificate authority.
                    type: keyword
                organizational_unit:
                  field_details:
                    dashed_name: tls-server-x509-issuer-organizational-unit
                    description: List of organizational units (OU) of issuing certificate
                      authority.
                    example: www.example.com
                    flat_name: tls.server.x509.issuer.organizational_unit
                    ignore_above: 1024
                    level: extended
                    name: issuer.organizational_unit
                    node_name: organizational_unit
                    normalize:
                    - array
                    original_fieldset: x509
                    short: List of organizational units (OU) of issuing certificate
                      authority.
                    type: keyword
                state_or_province:
                  field_details:
                    dashed_name: tls-server-x509-issuer-state-or-province
                    description: List of state or province names (ST, S, or P)
                    example: California
                    flat_name: tls.server.x509.issuer.state_or_province
                    ignore_above: 1024
                    level: extended
                    name: issuer.state_or_province
                    node_name: state_or_province
                    normalize:
                    - array
                    original_fieldset: x509
                    short: List of state or province names (ST, S, or P)
                    type: keyword
            not_after:
              field_details:
                dashed_name: tls-server-x509-not-after
                description: Time at which the certificate is no longer considered
                  valid.
                example: 2020-07-16 03:15:39
                flat_name: tls.server.x509.not_after
                level: extended
                name: not_after
                node_name: not_after
                normalize: []
                original_fieldset: x509
                short: Time at which the certificate is no longer considered valid.
                type: date
            not_before:
              field_details:
                dashed_name: tls-server-x509-not-before
                description: Time at which the certificate is first considered valid.
                example: 2019-08-16 01:40:25
                flat_name: tls.server.x509.not_before
                level: extended
                name: not_before
                node_name: not_before
                normalize: []
                original_fieldset: x509
                short: Time at which the certificate is first considered valid.
                type: date
            public_key_algorithm:
              field_details:
                dashed_name: tls-server-x509-public-key-algorithm
                description: Algorithm used to generate the public key.
                example: RSA
                flat_name: tls.server.x509.public_key_algorithm
                ignore_above: 1024
                level: extended
                name: public_key_algorithm
                node_name: public_key_algorithm
                normalize: []
                original_fieldset: x509
                short: Algorithm used to generate the public key.
                type: keyword
            public_key_curve:
              field_details:
                dashed_name: tls-server-x509-public-key-curve
                description: The curve used by the elliptic curve public key algorithm.
                  This is algorithm specific.
                example: nistp521
                flat_name: tls.server.x509.public_key_curve
                ignore_above: 1024
                level: extended
                name: public_key_curve
                node_name: public_key_curve
                normalize: []
                original_fieldset: x509
                short: The curve used by the elliptic curve public key algorithm.
                  This is algorithm specific.
                type: keyword
            public_key_exponent:
              field_details:
                dashed_name: tls-server-x509-public-key-exponent
                description: Exponent used to derive the public key. This is algorithm
                  specific.
                doc_values: false
                example: 65537
                flat_name: tls.server.x509.public_key_exponent
                index: false
                level: extended
                name: public_key_exponent
                node_name: public_key_exponent
                normalize: []
                original_fieldset: x509
                short: Exponent used to derive the public key. This is algorithm specific.
                type: long
            public_key_size:
              field_details:
                dashed_name: tls-server-x509-public-key-size
                description: The size of the public key space in bits.
                example: 2048
                flat_name: tls.server.x509.public_key_size
                level: extended
                name: public_key_size
                node_name: public_key_size
                normalize: []
                original_fieldset: x509
                short: The size of the public key space in bits.
                type: long
            serial_number:
              field_details:
                dashed_name: tls-server-x509-serial-number
                description: Unique serial number issued by the certificate authority.
                  For consistency, if this value is alphanumeric, it should be formatted
                  without colons and uppercase characters.
                example: 55FBB9C7DEBF09809D12CCAA
                flat_name: tls.server.x509.serial_number
                ignore_above: 1024
                level: extended
                name: serial_number
                node_name: serial_number
                normalize: []
                original_fieldset: x509
                short: Unique serial number issued by the certificate authority.
                type: keyword
            signature_algorithm:
              field_details:
                dashed_name: tls-server-x509-signature-algorithm
                description: Identifier for certificate signature algorithm. We recommend
                  using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353.
                example: SHA256-RSA
                flat_name: tls.server.x509.signature_algorithm
                ignore_above: 1024
                level: extended
                name: signature_algorithm
                node_name: signature_algorithm
                normalize: []
                original_fieldset: x509
                short: Identifier for certificate signature algorithm.
                type: keyword
            subject:
              field_details:
                dashed_name: tls-server-x509-subject
                flat_name: tls.server.x509.subject
                intermediate: true
                name: subject
                node_name: subject
                original_fieldset: x509
                type: object
              fields:
                common_name:
                  field_details:
                    dashed_name: tls-server-x509-subject-common-name
                    description: List of common names (CN) of subject.
                    example: shared.global.example.net
                    flat_name: tls.server.x509.subject.common_name
                    ignore_above: 1024
                    level: extended
                    name: subject.common_name
                    node_name: common_name
                    normalize:
                    - array
                    original_fieldset: x509
                    short: List of common names (CN) of subject.
                    type: keyword
                country:
                  field_details:
                    dashed_name: tls-server-x509-subject-country
                    description: List of country (C) code
                    example: US
                    flat_name: tls.server.x509.subject.country
                    ignore_above: 1024
                    level: extended
                    name: subject.country
                    node_name: country
                    normalize:
                    - array
                    original_fieldset: x509
                    short: List of country (C) code
                    type: keyword
                distinguished_name:
                  field_details:
                    dashed_name: tls-server-x509-subject-distinguished-name
                    description: Distinguished name (DN) of the certificate subject
                      entity.
                    example: C=US, ST=California, L=San Francisco, O=Example, Inc.,
                      CN=shared.global.example.net
                    flat_name: tls.server.x509.subject.distinguished_name
                    ignore_above: 1024
                    level: extended
                    name: subject.distinguished_name
                    node_name: distinguished_name
                    normalize: []
                    original_fieldset: x509
                    short: Distinguished name (DN) of the certificate subject entity.
                    type: keyword
                locality:
                  field_details:
                    dashed_name: tls-server-x509-subject-locality
                    description: List of locality names (L)
                    example: San Francisco
                    flat_name: tls.server.x509.subject.locality
                    ignore_above: 1024
                    level: extended
                    name: subject.locality
                    node_name: locality
                    normalize:
                    - array
                    original_fieldset: x509
                    short: List of locality names (L)
                    type: keyword
                organization:
                  field_details:
                    dashed_name: tls-server-x509-subject-organization
                    description: List of organizations (O) of subject.
                    example: Example, Inc.
                    flat_name: tls.server.x509.subject.organization
                    ignore_above: 1024
                    level: extended
                    name: subject.organization
                    node_name: organization
                    normalize:
                    - array
                    original_fieldset: x509
                    short: List of organizations (O) of subject.
                    type: keyword
                organizational_unit:
                  field_details:
                    dashed_name: tls-server-x509-subject-organizational-unit
                    description: List of organizational units (OU) of subject.
                    flat_name: tls.server.x509.subject.organizational_unit
                    ignore_above: 1024
                    level: extended
                    name: subject.organizational_unit
                    node_name: organizational_unit
                    normalize:
                    - array
                    original_fieldset: x509
                    short: List of organizational units (OU) of subject.
                    type: keyword
                state_or_province:
                  field_details:
                    dashed_name: tls-server-x509-subject-state-or-province
                    description: List of state or province names (ST, S, or P)
                    example: California
                    flat_name: tls.server.x509.subject.state_or_province
                    ignore_above: 1024
                    level: extended
                    name: subject.state_or_province
                    node_name: state_or_province
                    normalize:
                    - array
                    original_fieldset: x509
                    short: List of state or province names (ST, S, or P)
                    type: keyword
            version_number:
              field_details:
                dashed_name: tls-server-x509-version-number
                description: Version of x509 format.
                example: 3
                flat_name: tls.server.x509.version_number
                ignore_above: 1024
                level: extended
                name: version_number
                node_name: version_number
                normalize: []
                original_fieldset: x509
                short: Version of x509 format.
                type: keyword
    version:
      field_details:
        dashed_name: tls-version
        description: Numeric part of the version parsed from the original string.
        example: '1.2'
        flat_name: tls.version
        ignore_above: 1024
        level: extended
        name: version
        node_name: version
        normalize: []
        short: Numeric part of the version parsed from the original string.
        type: keyword
    version_protocol:
      field_details:
        dashed_name: tls-version-protocol
        description: Normalized lowercase protocol name parsed from original string.
        example: tls
        flat_name: tls.version_protocol
        ignore_above: 1024
        level: extended
        name: version_protocol
        node_name: version_protocol
        normalize: []
        short: Normalized lowercase protocol name parsed from original string.
        type: keyword
  schema_details:
    group: 2
    nestings:
    - tls.client.x509
    - tls.server.x509
    prefix: tls.
    reused_here:
    - full: tls.client.x509
      schema_name: x509
      short: These fields contain x509 certificate metadata.
    - full: tls.server.x509
      schema_name: x509
      short: These fields contain x509 certificate metadata.
    root: false
    title: TLS
tracing:
  field_details:
    dashed_name: tracing
    description: 'Distributed tracing makes it possible to analyze performance throughout
      a microservice architecture all in one view. This is accomplished by tracing
      all of the requests - from the initial web request in the front-end service
      - to queries made through multiple back-end services.

      Unlike most field sets in ECS, the tracing fields are *not* nested under the
      field set name. In other words, the correct field name is `trace.id`, not `tracing.trace.id`,
      and so on.'
    flat_name: tracing
    name: tracing
    node_name: tracing
    short: Fields related to distributed tracing.
    type: group
  fields:
    span:
      field_details:
        dashed_name: span
        flat_name: span
        intermediate: true
        name: span
        node_name: span
        type: object
      fields:
        id:
          field_details:
            dashed_name: span-id
            description: 'Unique identifier of the span within the scope of its trace.

              A span represents an operation within a transaction, such as a request
              to another service, or a database query.'
            example: 3ff9a8981b7ccd5a
            flat_name: span.id
            ignore_above: 1024
            level: extended
            name: span.id
            node_name: id
            normalize: []
            short: Unique identifier of the span within the scope of its trace.
            type: keyword
    trace:
      field_details:
        dashed_name: trace
        flat_name: trace
        intermediate: true
        name: trace
        node_name: trace
        type: object
      fields:
        id:
          field_details:
            dashed_name: trace-id
            description: 'Unique identifier of the trace.

              A trace groups multiple events like transactions that belong together.
              For example, a user request handled by multiple inter-connected services.'
            example: 4bf92f3577b34da6a3ce929d0e0e4736
            flat_name: trace.id
            ignore_above: 1024
            level: extended
            name: trace.id
            node_name: id
            normalize: []
            short: Unique identifier of the trace.
            type: keyword
    transaction:
      field_details:
        dashed_name: transaction
        flat_name: transaction
        intermediate: true
        name: transaction
        node_name: transaction
        type: object
      fields:
        id:
          field_details:
            dashed_name: transaction-id
            description: 'Unique identifier of the transaction within the scope of
              its trace.

              A transaction is the highest level of work measured within a service,
              such as a request to a server.'
            example: 00f067aa0ba902b7
            flat_name: transaction.id
            ignore_above: 1024
            level: extended
            name: transaction.id
            node_name: id
            normalize: []
            short: Unique identifier of the transaction within the scope of its trace.
            type: keyword
  schema_details:
    group: 2
    prefix: ''
    root: true
    title: Tracing
url:
  field_details:
    dashed_name: url
    description: URL fields provide support for complete or partial URLs, and supports
      the breaking down into scheme, domain, path, and so on.
    flat_name: url
    name: url
    node_name: url
    short: Fields that let you store URLs in various forms.
    type: group
  fields:
    domain:
      field_details:
        dashed_name: url-domain
        description: 'Domain of the url, such as "www.elastic.co".

          In some cases a URL may refer to an IP and/or port directly, without a domain
          name. In this case, the IP address would go to the `domain` field.

          If the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF
          RFC 2732), the `[` and `]` characters should also be captured in the `domain`
          field.'
        example: www.elastic.co
        flat_name: url.domain
        ignore_above: 1024
        level: extended
        name: domain
        node_name: domain
        normalize: []
        short: Domain of the url.
        type: keyword
    extension:
      field_details:
        dashed_name: url-extension
        description: 'The field contains the file extension from the original request
          url, excluding the leading dot.

          The file extension is only set if it exists, as not every url has a file
          extension.

          The leading period must not be included. For example, the value must be
          "png", not ".png".

          Note that when the file name has multiple extensions (example.tar.gz), only
          the last one should be captured ("gz", not "tar.gz").'
        example: png
        flat_name: url.extension
        ignore_above: 1024
        level: extended
        name: extension
        node_name: extension
        normalize: []
        short: File extension from the request url, excluding the leading dot.
        type: keyword
    fragment:
      field_details:
        dashed_name: url-fragment
        description: 'Portion of the url after the `#`, such as "top".

          The `#` is not part of the fragment.'
        flat_name: url.fragment
        ignore_above: 1024
        level: extended
        name: fragment
        node_name: fragment
        normalize: []
        short: Portion of the url after the `#`.
        type: keyword
    full:
      field_details:
        dashed_name: url-full
        description: If full URLs are important to your use case, they should be stored
          in `url.full`, whether this field is reconstructed or present in the event
          source.
        example: https://www.elastic.co:443/search?q=elasticsearch#top
        flat_name: url.full
        ignore_above: 1024
        level: extended
        multi_fields:
        - flat_name: url.full.text
          name: text
          norms: false
          type: text
        name: full
        node_name: full
        normalize: []
        short: Full unparsed URL.
        type: keyword
    original:
      field_details:
        dashed_name: url-original
        description: 'Unmodified original url as seen in the event source.

          Note that in network monitoring, the observed URL may be a full URL, whereas
          in access logs, the URL is often just represented as a path.

          This field is meant to represent the URL as it was observed, complete or
          not.'
        example: https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch
        flat_name: url.original
        ignore_above: 1024
        level: extended
        multi_fields:
        - flat_name: url.original.text
          name: text
          norms: false
          type: text
        name: original
        node_name: original
        normalize: []
        short: Unmodified original url as seen in the event source.
        type: keyword
    password:
      field_details:
        dashed_name: url-password
        description: Password of the request.
        flat_name: url.password
        ignore_above: 1024
        level: extended
        name: password
        node_name: password
        normalize: []
        short: Password of the request.
        type: keyword
    path:
      field_details:
        dashed_name: url-path
        description: Path of the request, such as "/search".
        flat_name: url.path
        ignore_above: 1024
        level: extended
        name: path
        node_name: path
        normalize: []
        short: Path of the request, such as "/search".
        type: keyword
    port:
      field_details:
        dashed_name: url-port
        description: Port of the request, such as 443.
        example: 443
        flat_name: url.port
        format: string
        level: extended
        name: port
        node_name: port
        normalize: []
        short: Port of the request, such as 443.
        type: long
    query:
      field_details:
        dashed_name: url-query
        description: 'The query field describes the query string of the request, such
          as "q=elasticsearch".

          The `?` is excluded from the query string. If a URL contains no `?`, there
          is no query field. If there is a `?` but no query, the query field exists
          with an empty string. The `exists` query can be used to differentiate between
          the two cases.'
        flat_name: url.query
        ignore_above: 1024
        level: extended
        name: query
        node_name: query
        normalize: []
        short: Query string of the request.
        type: keyword
    registered_domain:
      field_details:
        dashed_name: url-registered-domain
        description: 'The highest registered url domain, stripped of the subdomain.

          For example, the registered domain for "foo.example.com" is "example.com".

          This value can be determined precisely with a list like the public suffix
          list (http://publicsuffix.org). Trying to approximate this by simply taking
          the last two labels will not work well for TLDs such as "co.uk".'
        example: example.com
        flat_name: url.registered_domain
        ignore_above: 1024
        level: extended
        name: registered_domain
        node_name: registered_domain
        normalize: []
        short: The highest registered url domain, stripped of the subdomain.
        type: keyword
    scheme:
      field_details:
        dashed_name: url-scheme
        description: 'Scheme of the request, such as "https".

          Note: The `:` is not part of the scheme.'
        example: https
        flat_name: url.scheme
        ignore_above: 1024
        level: extended
        name: scheme
        node_name: scheme
        normalize: []
        short: Scheme of the url.
        type: keyword
    subdomain:
      field_details:
        dashed_name: url-subdomain
        description: 'The subdomain portion of a fully qualified domain name includes
          all of the names except the host name under the registered_domain.  In a
          partially qualified domain, or if the the qualification level of the full
          name cannot be determined, subdomain contains all of the names below the
          registered domain.

          For example the subdomain portion of "www.east.mydomain.co.uk" is "east".
          If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com",
          the subdomain field should contain "sub2.sub1", with no trailing period.'
        example: east
        flat_name: url.subdomain
        ignore_above: 1024
        level: extended
        name: subdomain
        node_name: subdomain
        normalize: []
        short: The subdomain of the domain.
        type: keyword
    top_level_domain:
      field_details:
        dashed_name: url-top-level-domain
        description: 'The effective top level domain (eTLD), also known as the domain
          suffix, is the last part of the domain name. For example, the top level
          domain for example.com is "com".

          This value can be determined precisely with a list like the public suffix
          list (http://publicsuffix.org). Trying to approximate this by simply taking
          the last label will not work well for effective TLDs such as "co.uk".'
        example: co.uk
        flat_name: url.top_level_domain
        ignore_above: 1024
        level: extended
        name: top_level_domain
        node_name: top_level_domain
        normalize: []
        short: The effective top level domain (com, org, net, co.uk).
        type: keyword
    username:
      field_details:
        dashed_name: url-username
        description: Username of the request.
        flat_name: url.username
        ignore_above: 1024
        level: extended
        name: username
        node_name: username
        normalize: []
        short: Username of the request.
        type: keyword
  schema_details:
    group: 2
    prefix: url.
    reusable:
      expected:
      - as: url
        at: threat.indicator
        beta: Reusing the `url` fields in this location is currently considered beta.
        full: threat.indicator.url
      - as: url
        at: threat.enrichments.indicator
        beta: Reusing the `url` fields in this location is currently considered beta.
        full: threat.enrichments.indicator.url
      order: 2
      top_level: true
    root: false
    title: URL
user:
  field_details:
    dashed_name: user
    description: 'The user fields describe information about the user that is relevant
      to the event.

      Fields can have one entry or multiple entries. If a user has more than one id,
      provide an array that includes all of them.'
    flat_name: user
    name: user
    node_name: user
    short: Fields to describe the user relevant to the event.
    type: group
  fields:
    changes:
      field_details:
        dashed_name: user-user
        description: 'The user fields describe information about the user that is
          relevant to the event.

          Fields can have one entry or multiple entries. If a user has more than one
          id, provide an array that includes all of them.'
        flat_name: user.user
        intermediate: true
        name: changes
        node_name: user
        original_fieldset: user
        short: Fields to describe the user relevant to the event.
        type: group
      fields:
        domain:
          field_details:
            dashed_name: user-changes-domain
            description: 'Name of the directory the user is a member of.

              For example, an LDAP or Active Directory domain name.'
            flat_name: user.changes.domain
            ignore_above: 1024
            level: extended
            name: domain
            node_name: domain
            normalize: []
            original_fieldset: user
            short: Name of the directory the user is a member of.
            type: keyword
        email:
          field_details:
            dashed_name: user-changes-email
            description: User email address.
            flat_name: user.changes.email
            ignore_above: 1024
            level: extended
            name: email
            node_name: email
            normalize: []
            original_fieldset: user
            short: User email address.
            type: keyword
        extra:
          field_details:
            dashed_name: user-changes-extra
            description: 'Additional information in key/value pairs.

              For additional information provided by the authenticator to events.

              Note: Not searchable or filterable.'
            enabled: false
            example: '{"authenticator": "ldap", "cipher": "argon2"}'
            flat_name: user.changes.extra
            level: custom
            name: extra
            node_name: extra
            normalize: []
            object_type: keyword
            original_fieldset: user
            short: Custom key/value pairs.
            type: object
        full_name:
          field_details:
            dashed_name: user-changes-full-name
            description: User's full name, if available.
            example: Albert Einstein
            flat_name: user.changes.full_name
            ignore_above: 1024
            level: extended
            multi_fields:
            - flat_name: user.changes.full_name.text
              name: text
              norms: false
              type: text
            name: full_name
            node_name: full_name
            normalize: []
            original_fieldset: user
            short: User's full name, if available.
            type: keyword
        group:
          field_details:
            dashed_name: user-changes-group
            description: The group fields are meant to represent groups that are relevant
              to the event.
            flat_name: user.changes.group
            intermediate: true
            name: group
            node_name: group
            original_fieldset: group
            short: User's group relevant to the event.
            type: group
          fields:
            domain:
              field_details:
                dashed_name: user-changes-group-domain
                description: 'Name of the directory the group is a member of.

                  For example, an LDAP or Active Directory domain name.'
                flat_name: user.changes.group.domain
                ignore_above: 1024
                level: extended
                name: domain
                node_name: domain
                normalize: []
                original_fieldset: group
                short: Name of the directory the group is a member of.
                type: keyword
            id:
              field_details:
                dashed_name: user-changes-group-id
                description: Unique identifier for the group on the system/platform.
                flat_name: user.changes.group.id
                ignore_above: 1024
                level: extended
                name: id
                node_name: id
                normalize: []
                original_fieldset: group
                short: Unique identifier for the group on the system/platform.
                type: keyword
            name:
              field_details:
                dashed_name: user-changes-group-name
                description: Name of the group.
                flat_name: user.changes.group.name
                ignore_above: 1024
                level: extended
                name: name
                node_name: name
                normalize: []
                original_fieldset: group
                short: Name of the group.
                type: keyword
        hash:
          field_details:
            dashed_name: user-changes-hash
            description: 'Unique user hash to correlate information for a user in
              anonymized form.

              Useful if `user.id` or `user.name` contain confidential information
              and cannot be used.'
            flat_name: user.changes.hash
            ignore_above: 1024
            level: extended
            name: hash
            node_name: hash
            normalize: []
            original_fieldset: user
            short: Unique user hash to correlate information for a user in anonymized
              form.
            type: keyword
        id:
          field_details:
            dashed_name: user-changes-id
            description: Unique identifier of the user.
            flat_name: user.changes.id
            ignore_above: 1024
            level: core
            name: id
            node_name: id
            normalize: []
            original_fieldset: user
            short: Unique identifier of the user.
            type: keyword
        name:
          field_details:
            dashed_name: user-changes-name
            description: Short name or login of the user.
            example: albert
            flat_name: user.changes.name
            ignore_above: 1024
            level: core
            multi_fields:
            - flat_name: user.changes.name.text
              name: text
              norms: false
              type: text
            name: name
            node_name: name
            normalize: []
            original_fieldset: user
            short: Short name or login of the user.
            type: keyword
        roles:
          field_details:
            dashed_name: user-changes-roles
            description: Array of user roles at the time of the event.
            example: '["kibana_admin", "reporting_user"]'
            flat_name: user.changes.roles
            ignore_above: 1024
            level: extended
            name: roles
            node_name: roles
            normalize:
            - array
            original_fieldset: user
            short: Array of user roles at the time of the event.
            type: keyword
    domain:
      field_details:
        dashed_name: user-domain
        description: 'Name of the directory the user is a member of.

          For example, an LDAP or Active Directory domain name.'
        flat_name: user.domain
        ignore_above: 1024
        level: extended
        name: domain
        node_name: domain
        normalize: []
        short: Name of the directory the user is a member of.
        type: keyword
    effective:
      field_details:
        dashed_name: user-user
        description: 'The user fields describe information about the user that is
          relevant to the event.

          Fields can have one entry or multiple entries. If a user has more than one
          id, provide an array that includes all of them.'
        flat_name: user.user
        intermediate: true
        name: effective
        node_name: user
        original_fieldset: user
        short: Fields to describe the user relevant to the event.
        type: group
      fields:
        domain:
          field_details:
            dashed_name: user-effective-domain
            description: 'Name of the directory the user is a member of.

              For example, an LDAP or Active Directory domain name.'
            flat_name: user.effective.domain
            ignore_above: 1024
            level: extended
            name: domain
            node_name: domain
            normalize: []
            original_fieldset: user
            short: Name of the directory the user is a member of.
            type: keyword
        email:
          field_details:
            dashed_name: user-effective-email
            description: User email address.
            flat_name: user.effective.email
            ignore_above: 1024
            level: extended
            name: email
            node_name: email
            normalize: []
            original_fieldset: user
            short: User email address.
            type: keyword
        extra:
          field_details:
            dashed_name: user-effective-extra
            description: 'Additional information in key/value pairs.

              For additional information provided by the authenticator to events.

              Note: Not searchable or filterable.'
            enabled: false
            example: '{"authenticator": "ldap", "cipher": "argon2"}'
            flat_name: user.effective.extra
            level: custom
            name: extra
            node_name: extra
            normalize: []
            object_type: keyword
            original_fieldset: user
            short: Custom key/value pairs.
            type: object
        full_name:
          field_details:
            dashed_name: user-effective-full-name
            description: User's full name, if available.
            example: Albert Einstein
            flat_name: user.effective.full_name
            ignore_above: 1024
            level: extended
            multi_fields:
            - flat_name: user.effective.full_name.text
              name: text
              norms: false
              type: text
            name: full_name
            node_name: full_name
            normalize: []
            original_fieldset: user
            short: User's full name, if available.
            type: keyword
        group:
          field_details:
            dashed_name: user-effective-group
            description: The group fields are meant to represent groups that are relevant
              to the event.
            flat_name: user.effective.group
            intermediate: true
            name: group
            node_name: group
            original_fieldset: group
            short: User's group relevant to the event.
            type: group
          fields:
            domain:
              field_details:
                dashed_name: user-effective-group-domain
                description: 'Name of the directory the group is a member of.

                  For example, an LDAP or Active Directory domain name.'
                flat_name: user.effective.group.domain
                ignore_above: 1024
                level: extended
                name: domain
                node_name: domain
                normalize: []
                original_fieldset: group
                short: Name of the directory the group is a member of.
                type: keyword
            id:
              field_details:
                dashed_name: user-effective-group-id
                description: Unique identifier for the group on the system/platform.
                flat_name: user.effective.group.id
                ignore_above: 1024
                level: extended
                name: id
                node_name: id
                normalize: []
                original_fieldset: group
                short: Unique identifier for the group on the system/platform.
                type: keyword
            name:
              field_details:
                dashed_name: user-effective-group-name
                description: Name of the group.
                flat_name: user.effective.group.name
                ignore_above: 1024
                level: extended
                name: name
                node_name: name
                normalize: []
                original_fieldset: group
                short: Name of the group.
                type: keyword
        hash:
          field_details:
            dashed_name: user-effective-hash
            description: 'Unique user hash to correlate information for a user in
              anonymized form.

              Useful if `user.id` or `user.name` contain confidential information
              and cannot be used.'
            flat_name: user.effective.hash
            ignore_above: 1024
            level: extended
            name: hash
            node_name: hash
            normalize: []
            original_fieldset: user
            short: Unique user hash to correlate information for a user in anonymized
              form.
            type: keyword
        id:
          field_details:
            dashed_name: user-effective-id
            description: Unique identifier of the user.
            flat_name: user.effective.id
            ignore_above: 1024
            level: core
            name: id
            node_name: id
            normalize: []
            original_fieldset: user
            short: Unique identifier of the user.
            type: keyword
        name:
          field_details:
            dashed_name: user-effective-name
            description: Short name or login of the user.
            example: albert
            flat_name: user.effective.name
            ignore_above: 1024
            level: core
            multi_fields:
            - flat_name: user.effective.name.text
              name: text
              norms: false
              type: text
            name: name
            node_name: name
            normalize: []
            original_fieldset: user
            short: Short name or login of the user.
            type: keyword
        roles:
          field_details:
            dashed_name: user-effective-roles
            description: Array of user roles at the time of the event.
            example: '["kibana_admin", "reporting_user"]'
            flat_name: user.effective.roles
            ignore_above: 1024
            level: extended
            name: roles
            node_name: roles
            normalize:
            - array
            original_fieldset: user
            short: Array of user roles at the time of the event.
            type: keyword
    email:
      field_details:
        dashed_name: user-email
        description: User email address.
        flat_name: user.email
        ignore_above: 1024
        level: extended
        name: email
        node_name: email
        normalize: []
        short: User email address.
        type: keyword
    extra:
      field_details:
        dashed_name: user-extra
        description: 'Additional information in key/value pairs.

          For additional information provided by the authenticator to events.

          Note: Not searchable or filterable.'
        enabled: false
        example: '{"authenticator": "ldap", "cipher": "argon2"}'
        flat_name: user.extra
        level: custom
        name: extra
        node_name: extra
        normalize: []
        object_type: keyword
        short: Custom key/value pairs.
        type: object
    full_name:
      field_details:
        dashed_name: user-full-name
        description: User's full name, if available.
        example: Albert Einstein
        flat_name: user.full_name
        ignore_above: 1024
        level: extended
        multi_fields:
        - flat_name: user.full_name.text
          name: text
          norms: false
          type: text
        name: full_name
        node_name: full_name
        normalize: []
        short: User's full name, if available.
        type: keyword
    group:
      field_details:
        dashed_name: user-group
        description: The group fields are meant to represent groups that are relevant
          to the event.
        flat_name: user.group
        intermediate: true
        name: group
        node_name: group
        original_fieldset: group
        short: User's group relevant to the event.
        type: group
      fields:
        domain:
          field_details:
            dashed_name: user-group-domain
            description: 'Name of the directory the group is a member of.

              For example, an LDAP or Active Directory domain name.'
            flat_name: user.group.domain
            ignore_above: 1024
            level: extended
            name: domain
            node_name: domain
            normalize: []
            original_fieldset: group
            short: Name of the directory the group is a member of.
            type: keyword
        id:
          field_details:
            dashed_name: user-group-id
            description: Unique identifier for the group on the system/platform.
            flat_name: user.group.id
            ignore_above: 1024
            level: extended
            name: id
            node_name: id
            normalize: []
            original_fieldset: group
            short: Unique identifier for the group on the system/platform.
            type: keyword
        name:
          field_details:
            dashed_name: user-group-name
            description: Name of the group.
            flat_name: user.group.name
            ignore_above: 1024
            level: extended
            name: name
            node_name: name
            normalize: []
            original_fieldset: group
            short: Name of the group.
            type: keyword
    hash:
      field_details:
        dashed_name: user-hash
        description: 'Unique user hash to correlate information for a user in anonymized
          form.

          Useful if `user.id` or `user.name` contain confidential information and
          cannot be used.'
        flat_name: user.hash
        ignore_above: 1024
        level: extended
        name: hash
        node_name: hash
        normalize: []
        short: Unique user hash to correlate information for a user in anonymized
          form.
        type: keyword
    id:
      field_details:
        dashed_name: user-id
        description: Unique identifier of the user.
        flat_name: user.id
        ignore_above: 1024
        level: core
        name: id
        node_name: id
        normalize: []
        short: Unique identifier of the user.
        type: keyword
    name:
      field_details:
        dashed_name: user-name
        description: Short name or login of the user.
        example: albert
        flat_name: user.name
        ignore_above: 1024
        level: core
        multi_fields:
        - flat_name: user.name.text
          name: text
          norms: false
          type: text
        name: name
        node_name: name
        normalize: []
        short: Short name or login of the user.
        type: keyword
    roles:
      field_details:
        dashed_name: user-roles
        description: Array of user roles at the time of the event.
        example: '["kibana_admin", "reporting_user"]'
        flat_name: user.roles
        ignore_above: 1024
        level: extended
        name: roles
        node_name: roles
        normalize:
        - array
        short: Array of user roles at the time of the event.
        type: keyword
    target:
      field_details:
        dashed_name: user-user
        description: 'The user fields describe information about the user that is
          relevant to the event.

          Fields can have one entry or multiple entries. If a user has more than one
          id, provide an array that includes all of them.'
        flat_name: user.user
        intermediate: true
        name: target
        node_name: user
        original_fieldset: user
        short: Fields to describe the user relevant to the event.
        type: group
      fields:
        domain:
          field_details:
            dashed_name: user-target-domain
            description: 'Name of the directory the user is a member of.

              For example, an LDAP or Active Directory domain name.'
            flat_name: user.target.domain
            ignore_above: 1024
            level: extended
            name: domain
            node_name: domain
            normalize: []
            original_fieldset: user
            short: Name of the directory the user is a member of.
            type: keyword
        email:
          field_details:
            dashed_name: user-target-email
            description: User email address.
            flat_name: user.target.email
            ignore_above: 1024
            level: extended
            name: email
            node_name: email
            normalize: []
            original_fieldset: user
            short: User email address.
            type: keyword
        extra:
          field_details:
            dashed_name: user-target-extra
            description: 'Additional information in key/value pairs.

              For additional information provided by the authenticator to events.

              Note: Not searchable or filterable.'
            enabled: false
            example: '{"authenticator": "ldap", "cipher": "argon2"}'
            flat_name: user.target.extra
            level: custom
            name: extra
            node_name: extra
            normalize: []
            object_type: keyword
            original_fieldset: user
            short: Custom key/value pairs.
            type: object
        full_name:
          field_details:
            dashed_name: user-target-full-name
            description: User's full name, if available.
            example: Albert Einstein
            flat_name: user.target.full_name
            ignore_above: 1024
            level: extended
            multi_fields:
            - flat_name: user.target.full_name.text
              name: text
              norms: false
              type: text
            name: full_name
            node_name: full_name
            normalize: []
            original_fieldset: user
            short: User's full name, if available.
            type: keyword
        group:
          field_details:
            dashed_name: user-target-group
            description: The group fields are meant to represent groups that are relevant
              to the event.
            flat_name: user.target.group
            intermediate: true
            name: group
            node_name: group
            original_fieldset: group
            short: User's group relevant to the event.
            type: group
          fields:
            domain:
              field_details:
                dashed_name: user-target-group-domain
                description: 'Name of the directory the group is a member of.

                  For example, an LDAP or Active Directory domain name.'
                flat_name: user.target.group.domain
                ignore_above: 1024
                level: extended
                name: domain
                node_name: domain
                normalize: []
                original_fieldset: group
                short: Name of the directory the group is a member of.
                type: keyword
            id:
              field_details:
                dashed_name: user-target-group-id
                description: Unique identifier for the group on the system/platform.
                flat_name: user.target.group.id
                ignore_above: 1024
                level: extended
                name: id
                node_name: id
                normalize: []
                original_fieldset: group
                short: Unique identifier for the group on the system/platform.
                type: keyword
            name:
              field_details:
                dashed_name: user-target-group-name
                description: Name of the group.
                flat_name: user.target.group.name
                ignore_above: 1024
                level: extended
                name: name
                node_name: name
                normalize: []
                original_fieldset: group
                short: Name of the group.
                type: keyword
        hash:
          field_details:
            dashed_name: user-target-hash
            description: 'Unique user hash to correlate information for a user in
              anonymized form.

              Useful if `user.id` or `user.name` contain confidential information
              and cannot be used.'
            flat_name: user.target.hash
            ignore_above: 1024
            level: extended
            name: hash
            node_name: hash
            normalize: []
            original_fieldset: user
            short: Unique user hash to correlate information for a user in anonymized
              form.
            type: keyword
        id:
          field_details:
            dashed_name: user-target-id
            description: Unique identifier of the user.
            flat_name: user.target.id
            ignore_above: 1024
            level: core
            name: id
            node_name: id
            normalize: []
            original_fieldset: user
            short: Unique identifier of the user.
            type: keyword
        name:
          field_details:
            dashed_name: user-target-name
            description: Short name or login of the user.
            example: albert
            flat_name: user.target.name
            ignore_above: 1024
            level: core
            multi_fields:
            - flat_name: user.target.name.text
              name: text
              norms: false
              type: text
            name: name
            node_name: name
            normalize: []
            original_fieldset: user
            short: Short name or login of the user.
            type: keyword
        roles:
          field_details:
            dashed_name: user-target-roles
            description: Array of user roles at the time of the event.
            example: '["kibana_admin", "reporting_user"]'
            flat_name: user.target.roles
            ignore_above: 1024
            level: extended
            name: roles
            node_name: roles
            normalize:
            - array
            original_fieldset: user
            short: Array of user roles at the time of the event.
            type: keyword
  schema_details:
    group: 2
    nestings:
    - user.changes
    - user.effective
    - user.group
    - user.target
    prefix: user.
    reusable:
      expected:
      - as: user
        at: client
        full: client.user
      - as: user
        at: destination
        full: destination.user
      - as: user
        at: server
        full: server.user
      - as: user
        at: source
        full: source.user
      - as: target
        at: user
        full: user.target
        short_override: Targeted user of action taken.
      - as: effective
        at: user
        full: user.effective
        short_override: User whose privileges were assumed.
      - as: changes
        at: user
        full: user.changes
        short_override: Captures changes made to a user.
      - as: user
        at: host
        full: host.user
        short_override: This reuse is deprecated and will be removed in the next major
          ECS version.
      order: 2
      top_level: true
    reused_here:
    - full: user.group
      schema_name: group
      short: User's group relevant to the event.
    - full: user.target
      schema_name: user
      short: Targeted user of action taken.
    - full: user.effective
      schema_name: user
      short: User whose privileges were assumed.
    - full: user.changes
      schema_name: user
      short: Captures changes made to a user.
    root: false
    title: User
user_agent:
  field_details:
    dashed_name: user-agent
    description: 'The user_agent fields normally come from a browser request.

      They often show up in web service logs coming from the parsed user agent string.'
    flat_name: user_agent
    name: user_agent
    node_name: user_agent
    short: Fields to describe a browser user_agent string.
    type: group
  fields:
    device:
      field_details:
        dashed_name: user-agent-device
        flat_name: user_agent.device
        intermediate: true
        name: device
        node_name: device
        type: object
      fields:
        name:
          field_details:
            dashed_name: user-agent-device-name
            description: Name of the device.
            example: iPhone
            flat_name: user_agent.device.name
            ignore_above: 1024
            level: extended
            name: device.name
            node_name: name
            normalize: []
            short: Name of the device.
            type: keyword
    name:
      field_details:
        dashed_name: user-agent-name
        description: Name of the user agent.
        example: Safari
        flat_name: user_agent.name
        ignore_above: 1024
        level: extended
        name: name
        node_name: name
        normalize: []
        short: Name of the user agent.
        type: keyword
    original:
      field_details:
        dashed_name: user-agent-original
        description: Unparsed user_agent string.
        example: Mozilla/5.0 (iPhone; CPU iPhone OS 12_1 like Mac OS X) AppleWebKit/605.1.15
          (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1
        flat_name: user_agent.original
        ignore_above: 1024
        level: extended
        multi_fields:
        - flat_name: user_agent.original.text
          name: text
          norms: false
          type: text
        name: original
        node_name: original
        normalize: []
        short: Unparsed user_agent string.
        type: keyword
    os:
      field_details:
        dashed_name: user-agent-os
        description: The OS fields contain information about the operating system.
        flat_name: user_agent.os
        intermediate: true
        name: os
        node_name: os
        original_fieldset: os
        short: OS fields contain information about the operating system.
        type: group
      fields:
        family:
          field_details:
            dashed_name: user-agent-os-family
            description: OS family (such as redhat, debian, freebsd, windows).
            example: debian
            flat_name: user_agent.os.family
            ignore_above: 1024
            level: extended
            name: family
            node_name: family
            normalize: []
            original_fieldset: os
            short: OS family (such as redhat, debian, freebsd, windows).
            type: keyword
        full:
          field_details:
            dashed_name: user-agent-os-full
            description: Operating system name, including the version or code name.
            example: Mac OS Mojave
            flat_name: user_agent.os.full
            ignore_above: 1024
            level: extended
            multi_fields:
            - flat_name: user_agent.os.full.text
              name: text
              norms: false
              type: text
            name: full
            node_name: full
            normalize: []
            original_fieldset: os
            short: Operating system name, including the version or code name.
            type: keyword
        kernel:
          field_details:
            dashed_name: user-agent-os-kernel
            description: Operating system kernel version as a raw string.
            example: 4.4.0-112-generic
            flat_name: user_agent.os.kernel
            ignore_above: 1024
            level: extended
            name: kernel
            node_name: kernel
            normalize: []
            original_fieldset: os
            short: Operating system kernel version as a raw string.
            type: keyword
        name:
          field_details:
            dashed_name: user-agent-os-name
            description: Operating system name, without the version.
            example: Mac OS X
            flat_name: user_agent.os.name
            ignore_above: 1024
            level: extended
            multi_fields:
            - flat_name: user_agent.os.name.text
              name: text
              norms: false
              type: text
            name: name
            node_name: name
            normalize: []
            original_fieldset: os
            short: Operating system name, without the version.
            type: keyword
        platform:
          field_details:
            dashed_name: user-agent-os-platform
            description: Operating system platform (such centos, ubuntu, windows).
            example: darwin
            flat_name: user_agent.os.platform
            ignore_above: 1024
            level: extended
            name: platform
            node_name: platform
            normalize: []
            original_fieldset: os
            short: Operating system platform (such centos, ubuntu, windows).
            type: keyword
        type:
          field_details:
            dashed_name: user-agent-os-type
            description: 'Use the `os.type` field to categorize the operating system
              into one of the broad commercial families.

              One of these following values should be used (lowercase): linux, macos,
              unix, windows.

              If the OS you''re dealing with is not in the list, the field should
              not be populated. Please let us know by opening an issue with ECS, to
              propose its addition.'
            example: macos
            flat_name: user_agent.os.type
            ignore_above: 1024
            level: extended
            name: type
            node_name: type
            normalize: []
            original_fieldset: os
            short: 'Which commercial OS family (one of: linux, macos, unix or windows).'
            type: keyword
        version:
          field_details:
            dashed_name: user-agent-os-version
            description: Operating system version as a raw string.
            example: 10.14.1
            flat_name: user_agent.os.version
            ignore_above: 1024
            level: extended
            name: version
            node_name: version
            normalize: []
            original_fieldset: os
            short: Operating system version as a raw string.
            type: keyword
    version:
      field_details:
        dashed_name: user-agent-version
        description: Version of the user agent.
        example: 12.0
        flat_name: user_agent.version
        ignore_above: 1024
        level: extended
        name: version
        node_name: version
        normalize: []
        short: Version of the user agent.
        type: keyword
  schema_details:
    group: 2
    nestings:
    - user_agent.os
    prefix: user_agent.
    reused_here:
    - full: user_agent.os
      schema_name: os
      short: OS fields contain information about the operating system.
    root: false
    title: User agent
