- key: apm
  title: General APM fields
  description:
  fields:
    - name: listening
      type: keyword
      description: >
        Address the server is listening on.
    - name: processor.name
      type: keyword
      description: Processor name.

    - name: processor.event
      type: keyword
      description: Processor event.

    - name: timestamp
      type: group
      description:
      fields:
        - name: us
          type: long
          count: 1
          description: >
            Timestamp of the event in microseconds since Unix epoch.

    - name: context
      type: group
      description: >
        Any arbitrary contextual information regarding the event, captured by the agent, optionally provided by the user.
      dynamic: false
      fields:

        - name: tags
          type: object
          object_type: keyword
          dynamic: true
          description: >
            A flat mapping of user-defined tags with string values.

        - name: http
          type: group
          fields:

          - name: status_code
            type: long
            description: >
              The status code of the http response.

        - name: user
          type: group
          fields:

          - name: username
            type: keyword
            description: >
              The username of the logged in user.

          - name: id
            type: keyword
            description: >
              Identifier of the logged in user.

          - name: email
            type: keyword
            description: >
              Email of the logged in user.

          - name: ip
            type: ip
            description: >
              IP of the user where the event is recorded, typically a web browser.
              This is obtained from the X-Forwarded-For header, of which the first entry is the IP of the original client.
              This value however might not be necessarily trusted, as it can be forged by a malicious user.

          - name: user-agent
            type: text
            description: >
              Software agent acting in behalf of a user, eg. a web browser / OS combination.

        - name: request
          type: group
          fields:

          - name: url
            type: group
            description: >
              A complete Url, with scheme, host and path.
            fields:

              - name: raw
                type: keyword
                description: >
                  The raw, unparsed URL of the request, e.g https://example.com:443/search?q=elasticsearch#top.

              - name: protocol
                type: keyword
                description: >
                  The protocol of the request, e.g. "https:".

              - name: full
                type: keyword
                description: >
                  The full, possibly agent-assembled URL of the request, e.g https://example.com:443/search?q=elasticsearch#top.

              - name: hostname
                type: keyword
                description: >
                  The hostname of the request, e.g. "example.com".

              - name: port
                type: keyword
                description: >
                  The port of the request, e.g. 443.

              - name: pathname
                type: keyword
                description: >
                  The path of the request, e.g. "/search".

              - name: search
                type: keyword
                description: >
                  The search describes the query string of the request, e.g. "q=elasticsearch".

              - name: hash
                type: keyword
                description: >
                  The hash of the request URL, e.g. "top".

          - name: http_version
            type: keyword
            description: >
              The http version of the request leading to this event.

          - name: method
            type: keyword
            description: >
              The http method of the request leading to this event.

        - name: response
          type: group
          fields:

          - name: status_code
            type: long
            description: >
              The http status code of the response, eg. '200'.

          - name: finished
            type: boolean
            description: >
              A boolean indicating whether the response was finished or not.

        - name: system
          type: group
          description: >
            Optional system fields.
          fields:

            - name: hostname
              type: keyword
              description: >
                The hostname of the system the event was recorded on.

            - name: architecture
              type: keyword
              description: >
                The architecture of the system the event was recorded on.

            - name: platform
              type: keyword
              description: >
                The platform of the system the event was recorded on.

            - name: ip
              type: ip
              description: >
                IP of the host that records the event.

        - name: process
          type: group
          description: >
            Information pertaining to the running process where the data was collected
          fields:
            - name: pid
              type: long
              description: >
                Numeric process ID of the service process.

            - name: ppid
              type: long
              description: >
                Numeric ID of the service's parent process.

            - name: title
              type: keyword
              description: >
                Service process title.

        - name: service
          type: group
          description: >
            Service fields.
          fields:
            - name: name
              type: keyword
              description: >
                Immutable unique name of the service emitting this event.
              format: url
              label_template: "{{value}}"
              open_link_in_current_tab: true
              url_template:
                - min_version: "5.0.0"
                  value: "../app/kibana#/dashboard/41b5d920-7821-11e7-8c47-65b845b5cfb3?_a=(query:(query_string:(analyze_wildcard:!t,query:'context.service.name:%22{{value}}%22')))"
                - min_version: "6.0.0-alpha1"
                  value: "../app/kibana#/dashboard/41b5d920-7821-11e7-8c47-65b845b5cfb3?_a=(query:(language:lucene,query:'context.service.name:\"{{value}}\"'))"

            - name: version
              type: keyword
              description: >
                Version of the service emitting this event.

            - name: environment
              type: keyword
              description: >
                Service environment.

            - name: language
              type: group
              fields:

              - name: name
                type: keyword
                description: >
                  Name of the programming language used.

              - name: version
                type: keyword
                description: >
                  Version of the programming language used.

            - name: runtime
              type: group
              fields:

              - name: name
                type: keyword
                description: >
                  Name of the runtime used.

              - name: version
                type: keyword
                description: >
                  Version of the runtime used.

            - name: framework
              type: group
              fields:

              - name: name
                type: keyword
                description: >
                  Name of the framework used.

              - name: version
                type: keyword
                description: >
                  Version of the framework used.

            - name: agent
              type: group
              fields:

              - name: name
                type: keyword
                description: >
                  Name of the agent used.

              - name: version
                type: keyword
                description: >
                  Version of the agent used.

    - name: transaction
      type: group
      dynamic: false
      fields:
        - name: id
          type: keyword
          description: >
            The transaction ID.
          format: url
          label_template: "View Spans"
          open_link_in_current_tab: true
          url_template:
            - min_version: 5.0.0
              value: "../app/kibana#/dashboard/3e3de700-7de0-11e7-b115-df9c90da2df1?_a=(query:(query_string:(analyze_wildcard:!t,query:'transaction.id:%22{{value}}%22')))"
            - min_version: 6.0.0-alpha1
              value: "../app/kibana#/dashboard/3e3de700-7de0-11e7-b115-df9c90da2df1?_a=(query:(language:lucene,query:'transaction.id:{{value}}'))"

    - name: trace 
      type: group
      dynamic: false
      fields:
        - name: id
          type: keyword
          description: >
             The ID of the trace to which the event belongs to.

    - name: parent 
      type: group
      dynamic: false
      fields:
        - name: id
          type: keyword
          description: >
             The ID of the parent event.

- key: beat
  title: Beat
  description: >
    Contains common beat fields available in all event types.
  fields:

    - name: beat.name
      description: >
        The name of the Beat sending the log messages. If the Beat name is
        set in the configuration file, then that value is used. If it is not
        set, the hostname is used. To set the Beat name, use the `name`
        option in the configuration file.
    - name: beat.hostname
      description: >
        The hostname as returned by the operating system on which the Beat is
        running.
    - name: beat.timezone
      description: >
        The timezone as returned by the operating system on which the Beat is
        running.
    - name: beat.version
      description: >
        The version of the beat that generated this event.

    - name: "@timestamp"
      type: date
      required: true
      format: date
      example: August 26th 2016, 12:35:53.332
      description: >
        The timestamp when the event log record was generated.

    - name: tags
      description: >
        Arbitrary tags that can be set per Beat and per transaction
        type.

    - name: fields
      type: object
      object_type: keyword
      description: >
        Contains user configurable fields.

    - name: error
      type: group
      description: >
        Error fields containing additional info in case of errors.
      fields:
        - name: message
          type: text
          description: >
            Error message.
        - name: code
          type: long
          description: >
            Error code.
        - name: type
          type: keyword
          description: >
            Error type.
- key: cloud
  title: Cloud provider metadata
  description: >
    Metadata from cloud providers added by the add_cloud_metadata processor.
  fields:

    - name: meta.cloud.provider
      example: ec2
      description: >
        Name of the cloud provider. Possible values are ec2, gce, or digitalocean.

    - name: meta.cloud.instance_id
      description: >
        Instance ID of the host machine.

    - name: meta.cloud.instance_name
      description: >
        Instance name of the host machine.

    - name: meta.cloud.machine_type
      example: t2.medium
      description: >
        Machine type of the host machine.

    - name: meta.cloud.availability_zone
      example: us-east-1c
      description: >
        Availability zone in which this host is running.

    - name: meta.cloud.project_id
      example: project-x
      description: >
        Name of the project in Google Cloud.

    - name: meta.cloud.region
      description: >
        Region in which this host is running.
- key: docker
  title: Docker
  description: >
    Docker stats collected from Docker.
  short_config: false
  anchor: docker-processor
  fields:
    - name: docker
      type: group
      fields:
        - name: container.id
          type: keyword
          description: >
            Unique container id.
        - name: container.image
          type: keyword
          description: >
            Name of the image the container was built on.
        - name: container.name
          type: keyword
          description: >
            Container name.
        - name: container.labels
          type: object
          object_type: keyword
          description: >
            Image labels.
- key: host
  title: Host
  description: >
    Info collected for the host machine.
  anchor: host-processor
  fields:
    - name: host
      type: group
      fields:
        - name: name
          type: keyword
          description: >
            Hostname.
        - name: id
          type: keyword
          description: >
            Unique host id.
        - name: architecture
          type: keyword
          description: >
            Host architecture (e.g. x86_64, arm, ppc, mips).
        - name: os.platform
          type: keyword
          description: >
            OS platform (e.g. centos, ubuntu, windows).
        - name: os.version
          type: keyword
          description: >
            OS version.
        - name: os.family
          type: keyword
          description: >
            OS family (e.g. redhat, debian, freebsd, windows).
        - name: ip
          type: ip
          description: >
            List of IP-addresses.
        - name: mac
          type: keyword
          description: >
            List of hardware-addresses, usually MAC-addresses.

- key: kubernetes
  title: Kubernetes
  description: >
    Kubernetes metadata added by the kubernetes processor
  short_config: false
  anchor: kubernetes-processor
  fields:
    - name: kubernetes
      type: group
      fields:
        - name: pod.name
          type: keyword
          description: >
            Kubernetes pod name

        - name: pod.uid
          type: keyword
          description: >
            Kubernetes Pod UID

        - name: namespace
          type: keyword
          description: >
            Kubernetes namespace

        - name: node.name
          type: keyword
          description: >
            Kubernetes node name

        - name: labels
          type: object
          description: >
            Kubernetes labels map

        - name: annotations
          type: object
          description: >
            Kubernetes annotations map

        - name: container.name
          type: keyword
          description: >
            Kubernetes container name

        - name: container.image
          type: keyword
          description: >
            Kubernetes container image
- key: apm-error
  title: APM Error
  description: Error-specific data for APM
  fields:
    - name: view errors
      type: keyword
      script: "doc['context.service.name'].value"
      language: painless
      format: url
      label_template: "View Errors"
      open_link_in_current_tab: true
      url_template:
        - min_version: 5.0.0
          value: "../app/kibana#/dashboard/37f6fac0-7c6a-11e7-aa55-3b0d52c71c60?_a=(query:(query_string:(analyze_wildcard:!t,query:'context.service.name:%22{{value}}%22')))"
        - min_version: 6.0.0-alpha1
          value: "../app/kibana#/dashboard/37f6fac0-7c6a-11e7-aa55-3b0d52c71c60?_a=(query:(language:lucene,query:'context.service.name:\"{{value}}\"'))"

    - name: error id icon
      type: keyword
      script: "doc['error.grouping_key'].value"
      language: painless
      format: url
      label_template: "-"

    - name: error
      type: group
      description: >
        Data captured by an agent representing an event occurring in a monitored service.
      dynamic: false
      fields:

        - name: id
          type: keyword
          count: 4
          description: >
            The ID of the error.

        - name: culprit
          type: text
          count: 2
          description: Function call which was the primary perpetrator of this event.

        - name: grouping_key
          type: keyword
          description: >
            GroupingKey of the logged error for use in grouping.
          format: url
          label_template: "View Error Details"
          open_link_in_current_tab: true
          url_template:
            - min_version: 5.0.0
              value: "../app/kibana#/dashboard/5f08a870-7c6a-11e7-aa55-3b0d52c71c60?_a=(query:(query_string:(analyze_wildcard:!t,query:'error.grouping_key:%22{{value}}%22')))"
            - min_version: 6.0.0-alpha1
              value: "../app/kibana#/dashboard/5f08a870-7c6a-11e7-aa55-3b0d52c71c60?_a=(query:(language:lucene,query:'error.grouping_key:{{value}}'))"

        - name: exception
          type: group
          description: >
            Information about the originally thrown error.
          fields:

            - name: code
              type: keyword
              description: The error code set when the error happened, e.g. database error code.

            - name: message
              type: text
              count: 2
              description: The original error message.

            - name: module
              type: keyword
              description: The module namespace of the original error.

            - name: type
              type: keyword
              count: 4

            - name: handled
              type: boolean
              count: 2
              description: Indicator whether the error was caught somewhere in the code or not.


        - name: log
          type: group
          description: >
            Additional information added by logging the error.
          fields:

            - name: level
              type: keyword
              description: The severity of the record.

            - name: logger_name
              type: keyword
              description: The name of the logger instance used.

            - name: message
              type: text
              count: 2
              description: The additionally logged error message.

            - name: param_message
              type: keyword
              description: >
                A parametrized message. E.g. 'Could not connect to %s'.
                The property message is still required, and should be equal to the param_message, but with placeholders replaced.
                In some situations the param_message is used to group errors together.
- key: system
  title: "APM System Metrics"
  description: >
    System status metrics, like CPU and memory usage, that are collected from the operating system.
  short_config: true
  fields:
    - name: system
      type: group
      description: >
        `system` contains local system metrics.
      fields:

      - name: cpu
        type: group
        description: >
          `cpu` contains local CPU stats.
        fields:
        - name: total.norm.pct
          type: scaled_float
          format: percent
          description: >
            The percentage of CPU time spent by the process since the last event.
            This value is normalized by the number of CPU cores and it ranges
            from 0 to 100%.

      - name: memory
        type: group
        description: >
          `memory` contains local memory stats.
        fields:
        - name: total
          type: long
          format: bytes
          description: >
            Total memory.
        - name: actual
          type: group
          description: >
            Actual memory used and free.
          fields:
          - name: free
            type: long
            format: bytes
            description: >
              Actual free memory in bytes. It is calculated based on the OS. On Linux it consists of the free memory
              plus caches and buffers. On OSX it is a sum of free memory and the inactive memory. On Windows, it is equal
              to `system.memory.free`.

      - name: process
        type: group
        description: >
          `process` contains process metadata, CPU metrics, and memory metrics.
        fields:
        - name: cpu
          type: group
          description: >
            `cpu` contains local CPU stats.
          fields:
          - name: total.norm.pct
            type: scaled_float
            format: percent
            description: >
              The percentage of CPU time spent by the process since the last event.
              This value is normalized by the number of CPU cores and it ranges
              from 0 to 100%.
        - name: memory
          type: group
          description: Memory-specific statistics per process.
          prefix: "[float]"
          fields:
          - name: size
            type: long
            format: bytes
            description: >
              The total virtual memory the process has.
          - name: rss.bytes
            type: long
            format: bytes
            description: >
              The Resident Set Size. The amount of memory the process occupied in main memory (RAM).
- key: apm-sourcemap
  title: APM Sourcemap
  description: Sourcemap files enriched with metadata
  kibana:
    source_filters:
      - sourcemap.sourcemap
  fields:
    - name: sourcemap
      dynamic: false
      type: group
      fields:
        - name: service
          type: group
          description: >
            Service fields.
          fields:
            - name: name
              type: keyword
              description: >
                The name of the service this sourcemap belongs to.
            - name: version
              type: keyword
              description: >
                Service version.

        - name: bundle_filepath
          type: keyword
          description: >
            Location of the sourcemap relative to the file requesting it.
- key: apm-span
  title: APM Span
  description: Span-specific data for APM.
  fields:
    - name: view spans
      format: url
      label_template: "View Spans"

    - name: span
      type: group
      dynamic: false
      fields:

        - name: id
          type: long 
          description: >
            Deprecated (>= 6.5). A locally unique ID of the span.

        - name: hex_id
          type: keyword 
          description: >
            The ID of the span, introduced (>= 6.5).

        - name: name
          type: keyword
          count: 1
          description: >
            Generic designation of a span in the scope of a transaction.

        - name: type
          type: keyword
          count: 1
          description: >
            Keyword of specific relevance in the service's domain (eg: 'db.postgresql.query', 'template.erb', 'cache', etc).

        - name: start
          type: group
          description:
          fields:
            - name: us
              type: long
              count: 1
              description: >
                Offset relative to the transaction's timestamp identifying the start of the span, in microseconds.

        - name: duration
          type: group
          description:
          fields:

            - name: us
              type: long
              count: 1
              description: >
                Duration of the span, in microseconds.
              format: duration
              input_format: microseconds
              output_format: asMilliseconds
              output_precision: 0

        - name: parent
          type: long
          description: >
            Deprecated (>= 6.5). The locally unique ID of the parent of the span.
- key: apm-transaction
  title: APM Transaction
  description: Transaction-specific data for APM
  fields:
    - name: transaction
      type: group
      dynamic: false
      fields:
        - name: name
          type: text
          multi_fields:
            - name: keyword
              type: keyword
          description: >
            Generic designation of a transaction in the scope of a single service (eg. 'GET /users/:id').

        - name: type
          type: keyword
          description: >
            Keyword of specific relevance in the service's domain (eg. 'request', 'backgroundjob', etc)

        - name: duration
          type: group
          description:
          fields:

            - name: us
              type: long
              description: >
                Total duration of this transaction, in microseconds.
              format: duration
              input_format: microseconds
              output_format: asMilliseconds
              output_precision: 0

        - name: result
          type: keyword
          description: >
            The result of the transaction. HTTP status code for HTTP-related transactions.

        - name: marks
          type: object
          object_type: keyword
          dynamic: true
          description: >
            A user-defined mapping of groups of marks in milliseconds.

        - name: marks.navigationTiming
          type: object
          object_type: scaled_float
          scaling_factor: 1000000
          dynamic: true

        - name: sampled
          type: boolean
          description: >
            Transactions that are 'sampled' will include all available information. Transactions that are not sampled will not have spans or context. Defaults to true.

        - name: span_count
          type: group
          fields:
            - name: dropped
              type: group
              fields:
                - name: total
                  type: long
                  description: The total amount of dropped spans for this transaction.
