- key: common
  title: Common
  description: >
    Contains common fields available in all event types.
  fields:
  - name: event.module
    description: >
      The name of the module that generated the event.

  - name: event.dataset
    description: >
      The name of the module's dataset that generated the event.

  - name: event.action
    type: keyword
    example: logged-in
    description: >
      Action describes the change that triggered the event.

      For the file integrity module the possible values are:
      attributes_modified, created, deleted, updated, moved, and config_change.

  - name: event.id
    type: keyword
    description: >
      Unique ID to describe the event.
    example: 8a4f500d

  - name: event.kind
    type: keyword
    description: >
      The kind of the event.

      This gives information about what type of information the event
      contains, without being specific to the contents of the event.  Examples
      are `event`, `state`, `alarm`. Warning: In future versions of ECS, we
      plan to provide a list of acceptable values for this field, please use
      with caution.
    example: state

  - name: message
    type: text
    example: "Hello World"
    description: >
      For log events the message field contains the log message.

      In other use cases the message field can be used to concatenate
      different values which are then freely searchable. If multiple
      messages exist, they can be combined into one message.

  - name: process
    title: Process
    group: 2
    description: >
      These fields contain information about a process.
      These fields can help you correlate metrics information with a process id/name
      from a log message.  The `process.pid` often stays in the metric itself and is
      copied to the global field for correlation.
    type: group
    fields:
      - name: start
        type: date
        example: "2016-05-23T08:05:34.853Z"
        description: >
          The time the process started.
      - name: working_directory
        type: keyword
        example: /home/alice
        description: >
          The working directory of the process.
      - name: executable
        type: keyword
        description: >
          Absolute path to the process executable.
        example: /usr/bin/ssh

  - name: network.type
    type: keyword
    description: >
      In the OSI Model this would be the Network Layer. IPv4, IPv6, IPSec, PIM, etc
    example: IPv4

  - name: user
    title: User
    description: >
      The user fields describe information about the user that is relevant
      to  the event. Fields can have one entry or multiple entries. If a
      user has more than one id, provide an array that includes all of
      them.
    type: group
    fields:
      - name: id
        type: keyword
        description: >
          One or multiple unique identifiers of the user.
      - name: name
        type: keyword
        example: albert
        description: >
          Short name or login of the user.

      - name: group
        title: Group
        description: >
          The group fields are meant to represent groups that are relevant to the
          event.
        type: group
        fields:
          - name: id
            type: keyword
            description: >
              Unique identifier for the group on the system/platform.
          - name: name
            type: keyword
            description: >
              Name of the group.

  - name: file
    type: group
    description: File attributes.
    fields:
    - name: path
      type: text
      description: The path to the file.
      multi_fields:
      - name: raw
        type: keyword
        description: >
          The path to the file. This is a non-analyzed field that is useful
          for aggregations.

    - name: target_path
      type: keyword
      description: The target path for symlinks.

    - name: type
      type: keyword
      description: The file type (file, dir, or symlink).

    - name: device
      type: keyword
      description: The device.

    - name: inode
      type: keyword
      description: The inode representing the file in the filesystem.

    - name: uid
      type: keyword
      description: >
        The user ID (UID) or security identifier (SID) of the file owner.

    - name: owner
      type: keyword
      description: The file owner's username.

    - name: gid
      type: keyword
      description: The primary group ID (GID) of the file.

    - name: group
      type: keyword
      description: The primary group name of the file.

    - name: mode
      type: keyword
      example: 0640
      description: The mode of the file in octal representation.

    - name: setuid
      type: boolean
      example: true
      description: Set if the file has the `setuid` bit set. Omitted otherwise.

    - name: setgid
      type: boolean
      example: true
      description: Set if the file has the `setgid` bit set. Omitted otherwise.

    - name: size
      type: long
      description: The file size in bytes (field is only added when `type` is `file`).

    - name: mtime
      type: date
      description: The last modified time of the file (time when content was modified).

    - name: ctime
      type: date
      description: The last change time of the file (time when metadata was changed).

    - name: origin
      type: text
      description: >
          An array of strings describing a possible external origin for
          this file. For example, the URL it was downloaded from. Only
          supported in macOS, via the kMDItemWhereFroms attribute.
          Omitted if origin information is not available.
      multi_fields:
      - name: raw
        type: keyword
        description: >
          This is a non-analyzed field that is useful for aggregations on the
          origin data.

    - name: selinux
      type: group
      description: The SELinux identity of the file.
      fields:
      - name: user
        type: keyword
        description: The owner of the object.
      - name: role
        type: keyword
        description: The object's SELinux role.
      - name: domain
        type: keyword
        description: The object's SELinux domain or type.
      - name: level
        type: keyword
        example: s0
        description: The object's SELinux level.

  - name: user
    type: group
    description: User information.
    fields:

    - name: effective
      type: group
      description: Effective user information.
      fields:
      - name: id
        type: keyword
        description: Effective user ID.
      - name: group
        type: group
        description: Effective group information.
        fields:
        - name: id
          type: keyword
          description: Effective group ID.

    - name: saved
      type: group
      description: Saved user information.
      fields:
      - name: id
        type: keyword
        description: Saved user ID.
      - name: group
        type: group
        description: Saved group information.
        fields:
        - name: id
          type: keyword
          description: Saved group ID.

- key: beat
  title: Beat
  description: >
    Contains common beat fields available in all event types.
  fields:

    - name: beat.name
      description: >
        The name of the Beat sending the log messages. If the Beat name is
        set in the configuration file, then that value is used. If it is not
        set, the hostname is used. To set the Beat name, use the `name`
        option in the configuration file.
    - name: beat.hostname
      description: >
        The hostname as returned by the operating system on which the Beat is
        running.
    - name: beat.timezone
      description: >
        The timezone as returned by the operating system on which the Beat is
        running.
    - name: beat.version
      description: >
        The version of the beat that generated this event.

    - name: "@timestamp"
      type: date
      required: true
      format: date
      example: August 26th 2016, 12:35:53.332
      description: >
        The timestamp when the event log record was generated.

    - name: tags
      description: >
        Arbitrary tags that can be set per Beat and per transaction
        type.

    - name: fields
      type: object
      object_type: keyword
      description: >
        Contains user configurable fields.

    - name: error
      type: group
      description: >
        Error fields containing additional info in case of errors.
      fields:
        - name: message
          type: text
          description: >
            Error message.
        - name: code
          type: long
          description: >
            Error code.
        - name: type
          type: keyword
          description: >
            Error type.

- key: alias
  title: Alias
  description: >
    Alias fields for compatibility with 7.x.
  fields:
    # Common Beats fields
    - name: host.hostname
      type: alias
      path: beat.hostname
    - name: event.timezone
      type: alias
      path: beat.timezone

    # Cloud processor fields
    - name: cloud.provider
      type: alias
      path: meta.cloud.provider
    - name: cloud.instance.id
      type: alias
      path: meta.cloud.instance_id
    - name: cloud.instance.name
      type: alias
      path: meta.cloud.instance_name
    - name: cloud.machine.type
      type: alias
      path: meta.cloud.machine_type
    - name: cloud.availability_zone
      type: alias
      path: meta.cloud.availability_zone
    - name: cloud.project.id
      type: alias
      path: meta.cloud.project_id
    - name: cloud.region
      type: alias
      path: meta.cloud.region

    # Docker processor fields
    - name: container.id
      type: alias
      path: docker.container.id
    - name: container.name
      type: alias
      path: docker.container.name
    - name: container.image.name
      type: alias
      path: docker.container.image
- key: cloud
  title: Cloud provider metadata
  description: >
    Metadata from cloud providers added by the add_cloud_metadata processor.
  fields:

    - name: meta.cloud.provider
      example: ec2
      description: >
        Name of the cloud provider. Possible values are ec2, gce, or digitalocean.

    - name: meta.cloud.instance_id
      description: >
        Instance ID of the host machine.

    - name: meta.cloud.instance_name
      description: >
        Instance name of the host machine.

    - name: meta.cloud.machine_type
      example: t2.medium
      description: >
        Machine type of the host machine.

    - name: meta.cloud.availability_zone
      example: us-east-1c
      description: >
        Availability zone in which this host is running.

    - name: meta.cloud.project_id
      example: project-x
      description: >
        Name of the project in Google Cloud.

    - name: meta.cloud.region
      description: >
        Region in which this host is running.
- key: docker
  title: Docker
  description: >
    Docker stats collected from Docker.
  short_config: false
  anchor: docker-processor
  fields:
    - name: docker
      type: group
      fields:
        - name: container.id
          type: keyword
          description: >
            Unique container id.
        - name: container.image
          type: keyword
          description: >
            Name of the image the container was built on.
        - name: container.name
          type: keyword
          description: >
            Container name.
        - name: container.labels
          type: object
          object_type: keyword
          description: >
            Image labels.
- key: host
  title: Host
  description: >
    Info collected for the host machine.
  anchor: host-processor
  fields:
    - name: host
      type: group
      fields:
        - name: name
          type: keyword
          description: >
            Hostname.
        - name: id
          type: keyword
          description: >
            Unique host id.
        - name: architecture
          type: keyword
          description: >
            Host architecture (e.g. x86_64, arm, ppc, mips).
        - name: containerized
          type: boolean
          description: >
            If the host is a container.
        - name: os.platform
          type: keyword
          description: >
            OS platform (e.g. centos, ubuntu, windows).
        - name: os.name
          type: keyword
          description: >
            Operating system name (e.g. "Mac OS X").
        - name: os.build
          type: keyword
          description: >
            OS build information (e.g. "18D109").
        - name: os.version
          type: keyword
          description: >
            OS version.
        - name: os.family
          type: keyword
          description: >
            OS family (e.g. redhat, debian, freebsd, windows).
        - name: ip
          type: ip
          description: >
            List of IP-addresses.
        - name: mac
          type: keyword
          description: >
            List of hardware-addresses, usually MAC-addresses.
- key: kubernetes
  title: Kubernetes
  description: >
    Kubernetes metadata added by the kubernetes processor
  short_config: false
  anchor: kubernetes-processor
  fields:
    - name: kubernetes
      type: group
      fields:
        - name: pod.name
          type: keyword
          description: >
            Kubernetes pod name

        - name: pod.uid
          type: keyword
          description: >
            Kubernetes Pod UID

        - name: namespace
          type: keyword
          description: >
            Kubernetes namespace

        - name: node.name
          type: keyword
          description: >
            Kubernetes node name

        - name: labels
          type: object
          description: >
            Kubernetes labels map

        - name: annotations
          type: object
          description: >
            Kubernetes annotations map

        - name: container.name
          type: keyword
          description: >
            Kubernetes container name

        - name: container.image
          type: keyword
          description: >
            Kubernetes container image
- key: auditd
  title: Auditd
  description: These are the fields generated by the auditd module.
  fields:
  - name: event
    type: group
    fields:
    - name: category
      type: keyword
      example: audit-rule
      description: >
        The event's category is a value derived from the `record_type`.
    - name: type
      type: keyword
      description: The audit record's type.

  - name: user
    type: group
    fields:
    - name: auid
      type: keyword
      description: login user ID
    - name: uid
      type: keyword
      description: user ID
    - name: euid
      type: keyword
      description: effective user ID
    - name: fsuid
      type: keyword
      description: file system user ID
    - name: suid
      type: keyword
      description: sent user ID
    - name: gid
      type: keyword
      description: group ID
    - name: egid
      type: keyword
      description: effective group ID
    - name: sgid
      type: keyword
      description: set group ID
    - name: fsgid
      type: keyword
      description: file system group ID
    - name: name_map
      type: group
      description: >
        If `resolve_ids` is set to true in the configuration then `name_map`
        will contain a mapping of uid field names to the resolved name
        (e.g. auid -> root).
      fields:
      - name: auid
        type: keyword
        description: login user name
      - name: uid
        type: keyword
        description: user name
      - name: euid
        type: keyword
        description: effective user name
      - name: fsuid
        type: keyword
        description: file system user name
      - name: suid
        type: keyword
        description: sent user name
      - name: gid
        type: keyword
        description: group name
      - name: egid
        type: keyword
        description: effective group name
      - name: sgid
        type: keyword
        description: set group name
      - name: fsgid
        type: keyword
        description: file system group name
    - name: selinux
      type: group
      description: The SELinux identity of the actor.
      fields:
      - name: user
        type: keyword
        description: account submitted for authentication
      - name: role
        type: keyword
        description: user's SELinux role
      - name: domain
        type: keyword
        description: The actor's SELinux domain or type.
      - name: level
        type: keyword
        example: s0
        description: The actor's SELinux level.
      - name: category
        type: keyword
        description: The actor's SELinux category or compartments.

  - name: process
    type: group
    description: Process attributes.
    fields:
    - name: pid
      type: keyword
      description: Process ID.
    - name: ppid
      type: keyword
      description: Parent process ID.
    - name: name
      type: keyword
      description: Process name (comm).
    - name: title
      type: keyword
      description: Process title or command line parameters (proctitle).
    - name: exe
      type: keyword
      description: Absolute path of the executable.
    - name: cwd
      type: keyword
      description: The current working directory.
    - name: args
      type: keyword
      description: The process arguments as a list.

  - name: source
    type: group
    description: Source that triggered the event.
    fields:
    - name: ip
      type: ip
      description: The remote address.
    - name: port
      type: keyword
      description: The port number.
    - name: hostname
      type: keyword
      description: Hostname of the source.
    - name: path
      type: keyword
      description: This is the path associated with a unix socket.

  - name: destination
    type: group
    description: Destination address that triggered the event.
    fields:
    - name: ip
      type: ip
      description: The remote address.
    - name: port
      type: keyword
      description: The port number.
    - name: hostname
      type: keyword
      description: Hostname of the source.
    - name: path
      type: keyword
      description: This is the path associated with a unix socket.

  - name: network.direction
    type: keyword
    description: Direction of the network traffic (`incoming` or `outgoing`).

  - name: auditd
    type: group
    fields:
    - name: sequence
      type: long
      description: >
        The sequence number of the event as assigned by the kernel. Sequence
        numbers are stored as a uint32 in the kernel and can rollover.
    - name: session
      type: keyword
      description: >
        The session ID assigned to a login. All events related to a login
        session will have the same value.
    - name: result
      type: keyword
      example: success or fail
      description: The result of the audited operation (success/fail).

    - name: summary
      type: group
      fields:
      - name: actor
        type: group
        description: The actor is the user that triggered the audit event.
        fields:
        - name: primary
          type: keyword
          description: >
            The primary identity of the actor. This is the actor's original login
            ID. It will not change even if the user changes to another account.
        - name: secondary
          type: keyword
          description: The secondary identity of the actor. This is typically
            the same as the primary, except for when the user has used `su`.
      - name: object
        type: group
        description: >
          This is the thing or object being acted upon in the event.
        fields:
        - name: type
          type: keyword
          description: >
            A description of the what the "thing" is (e.g. file, socket,
            user-session).
        - name: primary
          type: keyword
          description: ""
        - name: secondary
          type: keyword
          description: ""
      - name: how
        type: keyword
        description: >
          This describes how the action was performed. Usually this is the exe
          or command that was being executed that triggered the event.

    - name: paths
      type: group
      description: List of paths associated with the event.
      fields:
      - name: inode
        type: keyword
        description: inode number
      - name: dev
        type: keyword
        description: device name as found in /dev
      - name: obj_user
        type: keyword
        description: ""
      - name: obj_role
        type: keyword
        description: ""
      - name: obj_domain
        type: keyword
        description: ""
      - name: obj_level
        type: keyword
        description: ""
      - name: objtype
        type: keyword
        description: ""
      - name: ouid
        type: keyword
        description: file owner user ID
      - name: rdev
        type: keyword
        description: the device identifier (special files only)
      - name: nametype
        type: keyword
        description: kind of file operation being referenced
      - name: ogid
        type: keyword
        description: file owner group ID
      - name: item
        type: keyword
        description: which item is being recorded
      - name: mode
        type: keyword
        description: mode flags on a file
      - name: name
        type: keyword
        description: file name in avcs

    - name: data
      type: group
      description: The data from the audit messages.
      fields:
      - name: action
        type: keyword
        description: netfilter packet disposition
      - name: minor
        type: keyword
        description: device minor number
      - name: acct
        type: keyword
        description: a user's account name
      - name: addr
        type: keyword
        description: the remote address that the user is connecting from
      - name: cipher
        type: keyword
        description: name of crypto cipher selected
      - name: id
        type: keyword
        description: during account changes
      - name: entries
        type: keyword
        description: number of entries in the netfilter table
      - name: kind
        type: keyword
        description: server or client in crypto operation
      - name: ksize
        type: keyword
        description: key size for crypto operation
      - name: spid
        type: keyword
        description: sent process ID
      - name: arch
        type: keyword
        description: the elf architecture flags
      - name: argc
        type: keyword
        description: the number of arguments to an execve syscall
      - name: major
        type: keyword
        description: device major number
      - name: unit
        type: keyword
        description: systemd unit
      - name: table
        type: keyword
        description: netfilter table name
      - name: terminal
        type: keyword
        description: terminal name the user is running programs on
      - name: grantors
        type: keyword
        description: pam modules approving the action
      - name: direction
        type: keyword
        description: direction of crypto operation
      - name: op
        type: keyword
        description: the operation being performed that is audited
      - name: tty
        type: keyword
        description: tty udevice the user is running programs on
      - name: syscall
        type: keyword
        description: syscall number in effect when the event occurred
      - name: data
        type: keyword
        description: TTY text
      - name: family
        type: keyword
        description: netfilter protocol
      - name: mac
        type: keyword
        description: crypto MAC algorithm selected
      - name: pfs
        type: keyword
        description: perfect forward secrecy method
      - name: items
        type: keyword
        description: the number of path records in the event
      - name: a0
        type: keyword
        description: ""
      - name: a1
        type: keyword
        description: ""
      - name: a2
        type: keyword
        description: ""
      - name: a3
        type: keyword
        description: ""
      - name: hostname
        type: keyword
        description: the hostname that the user is connecting from
      - name: lport
        type: keyword
        description: local network port
      - name: rport
        type: keyword
        description: remote port number
      - name: exit
        type: keyword
        description: syscall exit code
      - name: fp
        type: keyword
        description: crypto key finger print
      - name: laddr
        type: keyword
        description: local network address
      - name: sport
        type: keyword
        description: local port number
      - name: capability
        type: keyword
        description: posix capabilities
      - name: nargs
        type: keyword
        description: the number of arguments to a socket call
      - name: new-enabled
        type: keyword
        description: new TTY audit enabled setting
      - name: audit_backlog_limit
        type: keyword
        description: audit system's backlog queue size
      - name: dir
        type: keyword
        description: directory name
      - name: cap_pe
        type: keyword
        description: process effective capability map
      - name: model
        type: keyword
        description: security model being used for virt
      - name: new_pp
        type: keyword
        description: new process permitted capability map
      - name: old-enabled
        type: keyword
        description: present TTY audit enabled setting
      - name: oauid
        type: keyword
        description: object's login user ID
      - name: old
        type: keyword
        description: old value
      - name: banners
        type: keyword
        description: banners used on printed page
      - name: feature
        type: keyword
        description: kernel feature being changed
      - name: vm-ctx
        type: keyword
        description: the vm's context string
      - name: opid
        type: keyword
        description: object's process ID
      - name: seperms
        type: keyword
        description: SELinux permissions being used
      - name: seresult
        type: keyword
        description: SELinux AVC decision granted/denied
      - name: new-rng
        type: keyword
        description: device name of rng being added from a vm
      - name: old-net
        type: keyword
        description: present MAC address assigned to vm
      - name: sigev_signo
        type: keyword
        description: signal number
      - name: ino
        type: keyword
        description: inode number
      - name: old_enforcing
        type: keyword
        description: old MAC enforcement status
      - name: old-vcpu
        type: keyword
        description: present number of CPU cores
      - name: range
        type: keyword
        description: user's SE Linux range
      - name: res
        type: keyword
        description: result of the audited operation(success/fail)
      - name: added
        type: keyword
        description: number of new files detected
      - name: fam
        type: keyword
        description: socket address family
      - name: nlnk-pid
        type: keyword
        description: pid of netlink packet sender
      - name: subj
        type: keyword
        description: lspp subject's context string
      - name: a[0-3]
        type: keyword
        description: the arguments to a syscall
      - name: cgroup
        type: keyword
        description: path to cgroup in sysfs
      - name: kernel
        type: keyword
        description: kernel's version number
      - name: ocomm
        type: keyword
        description: object's command line name
      - name: new-net
        type: keyword
        description: MAC address being assigned to vm
      - name: permissive
        type: keyword
        description: SELinux is in permissive mode
      - name: class
        type: keyword
        description: resource class assigned to vm
      - name: compat
        type: keyword
        description: is_compat_task result
      - name: fi
        type: keyword
        description: file assigned inherited capability map
      - name: changed
        type: keyword
        description: number of changed files
      - name: msg
        type: keyword
        description: the payload of the audit record
      - name: dport
        type: keyword
        description: remote port number
      - name: new-seuser
        type: keyword
        description: new SELinux user
      - name: invalid_context
        type: keyword
        description: SELinux context
      - name: dmac
        type: keyword
        description: remote MAC address
      - name: ipx-net
        type: keyword
        description: IPX network number
      - name: iuid
        type: keyword
        description: ipc object's user ID
      - name: macproto
        type: keyword
        description: ethernet packet type ID field
      - name: obj
        type: keyword
        description: lspp object context string
      - name: ipid
        type: keyword
        description: IP datagram fragment identifier
      - name: new-fs
        type: keyword
        description: file system being added to vm
      - name: vm-pid
        type: keyword
        description: vm's process ID
      - name: cap_pi
        type: keyword
        description: process inherited capability map
      - name: old-auid
        type: keyword
        description: previous auid value
      - name: oses
        type: keyword
        description: object's session ID
      - name: fd
        type: keyword
        description: file descriptor number
      - name: igid
        type: keyword
        description: ipc object's group ID
      - name: new-disk
        type: keyword
        description: disk being added to vm
      - name: parent
        type: keyword
        description: the inode number of the parent file
      - name: len
        type: keyword
        description: length
      - name: oflag
        type: keyword
        description: open syscall flags
      - name: uuid
        type: keyword
        description: a UUID
      - name: code
        type: keyword
        description: seccomp action code
      - name: nlnk-grp
        type: keyword
        description: netlink group number
      - name: cap_fp
        type: keyword
        description: file permitted capability map
      - name: new-mem
        type: keyword
        description: new amount of memory in KB
      - name: seperm
        type: keyword
        description: SELinux permission being decided on
      - name: enforcing
        type: keyword
        description: new MAC enforcement status
      - name: new-chardev
        type: keyword
        description: new character device being assigned to vm
      - name: old-rng
        type: keyword
        description: device name of rng being removed from a vm
      - name: outif
        type: keyword
        description: out interface number
      - name: cmd
        type: keyword
        description: command being executed
      - name: hook
        type: keyword
        description: netfilter hook that packet came from
      - name: new-level
        type: keyword
        description: new run level
      - name: sauid
        type: keyword
        description: sent login user ID
      - name: sig
        type: keyword
        description: signal number
      - name: audit_backlog_wait_time
        type: keyword
        description: audit system's backlog wait time
      - name: printer
        type: keyword
        description: printer name
      - name: old-mem
        type: keyword
        description: present amount of memory in KB
      - name: perm
        type: keyword
        description: the file permission being used
      - name: old_pi
        type: keyword
        description: old process inherited capability map
      - name: state
        type: keyword
        description: audit daemon configuration resulting state
      - name: format
        type: keyword
        description: audit log's format
      - name: new_gid
        type: keyword
        description: new group ID being assigned
      - name: tcontext
        type: keyword
        description: the target's or object's context string
      - name: maj
        type: keyword
        description: device major number
      - name: watch
        type: keyword
        description: file name in a watch record
      - name: device
        type: keyword
        description: device name
      - name: grp
        type: keyword
        description: group name
      - name: bool
        type: keyword
        description: name of SELinux boolean
      - name: icmp_type
        type: keyword
        description: type of icmp message
      - name: new_lock
        type: keyword
        description: new value of feature lock
      - name: old_prom
        type: keyword
        description: network promiscuity flag
      - name: acl
        type: keyword
        description: access mode of resource assigned to vm
      - name: ip
        type: keyword
        description: network address of a printer
      - name: new_pi
        type: keyword
        description: new process inherited capability map
      - name: default-context
        type: keyword
        description: default MAC context
      - name: inode_gid
        type: keyword
        description: group ID of the inode's owner
      - name: new-log_passwd
        type: keyword
        description: new value for TTY password logging
      - name: new_pe
        type: keyword
        description: new process effective capability map
      - name: selected-context
        type: keyword
        description: new MAC context assigned to session
      - name: cap_fver
        type: keyword
        description: file system capabilities version number
      - name: file
        type: keyword
        description: file name
      - name: net
        type: keyword
        description: network MAC address
      - name: virt
        type: keyword
        description: kind of virtualization being referenced
      - name: cap_pp
        type: keyword
        description: process permitted capability map
      - name: old-range
        type: keyword
        description: present SELinux range
      - name: resrc
        type: keyword
        description: resource being assigned
      - name: new-range
        type: keyword
        description: new SELinux range
      - name: obj_gid
        type: keyword
        description: group ID of object
      - name: proto
        type: keyword
        description: network protocol
      - name: old-disk
        type: keyword
        description: disk being removed from vm
      - name: audit_failure
        type: keyword
        description: audit system's failure mode
      - name: inif
        type: keyword
        description: in interface number
      - name: vm
        type: keyword
        description: virtual machine name
      - name: flags
        type: keyword
        description: mmap syscall flags
      - name: nlnk-fam
        type: keyword
        description: netlink protocol number
      - name: old-fs
        type: keyword
        description: file system being removed from vm
      - name: old-ses
        type: keyword
        description: previous ses value
      - name: seqno
        type: keyword
        description: sequence number
      - name: fver
        type: keyword
        description: file system capabilities version number
      - name: qbytes
        type: keyword
        description: ipc objects quantity of bytes
      - name: seuser
        type: keyword
        description: user's SE Linux user acct
      - name: cap_fe
        type: keyword
        description: file assigned effective capability map
      - name: new-vcpu
        type: keyword
        description: new number of CPU cores
      - name: old-level
        type: keyword
        description: old run level
      - name: old_pp
        type: keyword
        description: old process permitted capability map
      - name: daddr
        type: keyword
        description: remote IP address
      - name: old-role
        type: keyword
        description: present SELinux role
      - name: ioctlcmd
        type: keyword
        description: The request argument to the ioctl syscall
      - name: smac
        type: keyword
        description: local MAC address
      - name: apparmor
        type: keyword
        description: apparmor event information
      - name: fe
        type: keyword
        description: file assigned effective capability map
      - name: perm_mask
        type: keyword
        description: file permission mask that triggered a watch event
      - name: ses
        type: keyword
        description: login session ID
      - name: cap_fi
        type: keyword
        description: file inherited capability map
      - name: obj_uid
        type: keyword
        description: user ID of object
      - name: reason
        type: keyword
        description: text string denoting a reason for the action
      - name: list
        type: keyword
        description: the audit system's filter list number
      - name: old_lock
        type: keyword
        description: present value of feature lock
      - name: bus
        type: keyword
        description: name of subsystem bus a vm resource belongs to
      - name: old_pe
        type: keyword
        description: old process effective capability map
      - name: new-role
        type: keyword
        description: new SELinux role
      - name: prom
        type: keyword
        description: network promiscuity flag
      - name: uri
        type: keyword
        description: URI pointing to a printer
      - name: audit_enabled
        type: keyword
        description: audit systems's enable/disable status
      - name: old-log_passwd
        type: keyword
        description: present value for TTY password logging
      - name: old-seuser
        type: keyword
        description: present SELinux user
      - name: per
        type: keyword
        description: linux personality
      - name: scontext
        type: keyword
        description: the subject's context string
      - name: tclass
        type: keyword
        description: target's object classification
      - name: ver
        type: keyword
        description: audit daemon's version number
      - name: new
        type: keyword
        description: value being set in feature
      - name: val
        type: keyword
        description: generic value associated with the operation
      - name: img-ctx
        type: keyword
        description: the vm's disk image context string
      - name: old-chardev
        type: keyword
        description: present character device assigned to vm
      - name: old_val
        type: keyword
        description: current value of SELinux boolean
      - name: success
        type: keyword
        description: whether the syscall was successful or not
      - name: inode_uid
        type: keyword
        description: user ID of the inode's owner
      - name: removed
        type: keyword
        description: number of deleted files
      - name: socket
        type: group
        fields:
        - name: port
          type: keyword
          description: The port number.
        - name: saddr
          type: keyword
          description: The raw socket address structure.
        - name: addr
          type: keyword
          description: The remote address.
        - name: family
          type: keyword
          example: unix
          description: The socket family (unix, ipv4, ipv6, netlink).
        - name: path
          type: keyword
          description: This is the path associated with a unix socket.
    - name: messages
      type: text
      description: >
        An ordered list of the raw messages received from the kernel that
        were used to construct this document. This field is present if an error
        occurred processing the data or if `include_raw_message` is set
        in the config.
    - name: warnings
      type: keyword
      description: >
        The warnings generated by the Beat during the construction of the event.
        These are disabled by default and are used for development and debug
        purposes only.

  - name: geoip
    type: group
    description: >
      The geoip fields are defined as a convenience in case you decide to
      enrich the data using a geoip filter in Logstash or Ingest Node.
    fields:
      - name: continent_name
        type: keyword
        description: >
          The name of the continent.
      - name: city_name
        type: keyword
        description: >
          The name of the city.
      - name: region_name
        type: keyword
        description: >
          The name of the region.
      - name: country_iso_code
        type: keyword
        description: >
          Country ISO code.
      - name: location
        type: geo_point
        description: >
          The longitude and latitude.
- key: file_integrity
  title: File Integrity
  description: These are the fields generated by the file_integrity module.
  fields:
  - name: hash
    type: group
    description: >
      Hashes of the file. The keys are algorithm names and the values are
      the hex encoded digest values.

    fields:
    - name: blake2b_256
      type: keyword
      description: BLAKE2b-256 hash of the file.

    - name: blake2b_384
      type: keyword
      description: BLAKE2b-384 hash of the file.

    - name: blake2b_512
      type: keyword
      description: BLAKE2b-512 hash of the file.

    - name: md5
      type: keyword
      description: MD5 hash of the file.

    - name: sha1
      type: keyword
      description: SHA1 hash of the file.

    - name: sha224
      type: keyword
      description: SHA224 hash of the file.

    - name: sha256
      type: keyword
      description: SHA256 hash of the file.

    - name: sha384
      type: keyword
      description: SHA384 hash of the file.

    - name: sha3_224
      type: keyword
      description: SHA3_224 hash of the file.

    - name: sha3_256
      type: keyword
      description: SHA3_256 hash of the file.

    - name: sha3_384
      type: keyword
      description: SHA3_384 hash of the file.

    - name: sha3_512
      type: keyword
      description: SHA3_512 hash of the file.

    - name: sha512
      type: keyword
      description: SHA512 hash of the file.

    - name: sha512_224
      type: keyword
      description: SHA512/224 hash of the file.

    - name: sha512_256
      type: keyword
      description: SHA512/256 hash of the file.

    - name: xxh64
      type: keyword
      description: XX64 hash of the file.
- key: system
  title: "System"
  description: >
    These are the fields generated by the system module.
  release: experimental
  fields:

  - name: event
    type: group
    fields:
    - name: origin
      type: keyword
      description: >
        Origin of the event. This can be a file path (e.g. `/var/log/log.1`),
        or the name of the system component that supplied the data (e.g. `netlink`).
    - name: outcome
      type: keyword
      description: >
        The outcome of the event.

        If the event describes an action, this fields contains the outcome of
        that action. Examples outcomes are `success` and `failure`. Warning: In
        future versions of ECS, we plan to provide a list of acceptable values
        for this field, please use with caution.

      example: success

  - name: user
    type: group
    fields:
    - name: entity_id
      type: keyword
      description: >
        ID uniquely identifying the user on a host. It is computed as a SHA-256 hash
        of the host ID, user ID, and user name.
    - name: terminal
      type: keyword
      description: >
        Terminal of the user.

  - name: process
    type: group
    fields:
    - name: entity_id
      type: keyword
      description: >
        ID uniquely identifying the process. It is computed as a SHA-256 hash of the
        host ID, PID, and process start time.

  - name: socket
    type: group
    fields:
    - name: entity_id
      type: keyword
      description: >
        ID uniquely identifying the socket. It is computed as a SHA-256 hash of the
        host ID, socket inode, local IP, local port, remote IP, and remote port.

  - name: system.audit
    type: group
    description: >
    fields:
        - name: host
          type: group
          description: >
            `host` contains general host information.
          release: experimental
          fields:
          - name: uptime
            type: long
            format: duration
            input_format: nanoseconds
            output_format: asDays
            output_precision: 1
            description: >
                Uptime in nanoseconds.
          - name: boottime
            type: date
            description: >
                Boot time.
          - name: containerized
            type: boolean
            description: >
                Set if host is a container.
          - name: timezone.name
            type: keyword
            description: >
                Name of the timezone of the host, e.g. BST.
          - name: timezone.offset.sec
            type: long
            description: >
                Timezone offset in seconds.
          - name: hostname
            type: keyword
            description: >
                Hostname.
          - name: id
            type: keyword
            description: >
                Host ID.
          - name: architecture
            type: keyword
            description: >
                Host architecture (e.g. x86_64).
          - name: mac
            type: keyword
            description: >
                MAC addresses.
          - name: ip
            type: ip
            description: >
                IP addresses.
          - name: os
            type: group
            description: >
              `os` contains information about the operating system.
            fields:
            - name: platform
              type: keyword
              description: >
                OS platform (e.g. centos, ubuntu, windows).
            - name: name
              type: keyword
              description: >
                OS name (e.g. Mac OS X).
            - name: family
              type: keyword
              description: >
                OS family (e.g. redhat, debian, freebsd, windows).
            - name: version
              type: keyword
              description: >
                OS version.
            - name: kernel
              type: keyword
              description: >
                The operating system's kernel version.
        - name: package
          type: group
          description: >
            `package` contains information about an installed or removed package.
          release: experimental
          fields:
          - name: entity_id
            type: keyword
            description: >
              ID uniquely identifying the package. It is computed as a SHA-256 hash of the
                host ID, package name, and package version.
          - name: name
            type: keyword
            description: >
              Package name.
          - name: version
            type: keyword
            description: >
              Package version.
          - name: release
            type: keyword
            description: >
              Package release.
          - name: arch
            type: keyword
            description: >
              Package architecture.
          - name: license
            type: keyword
            description: >
              Package license.
          - name: installtime
            type: date
            description: >
              Package install time.
          - name: size
            type: long
            description: >
              Package size.
          - name: summary
            description: >
              Package summary.
          - name: url
            type: keyword
            description: >
              Package URL.
        - name: user
          type: group
          description: >
            `user` contains information about the users on a system.
          release: experimental
          fields:
            - name: name
              type: keyword
              description: >
                  User name.
            - name: uid
              type: keyword
              description: >
                  User ID.
            - name: gid
              type: keyword
              description: >
                  Group ID.
            - name: dir
              type: keyword
              description: >
                  User's home directory.
            - name: shell
              type: keyword
              description: >
                  Program to run at login.
            - name: user_information
              type: text
              description: >
                  General user information. On Linux, this is the gecos field.
            - name: group
              type: object
              description: >
                `group` contains information about any groups the user is part of (beyond the user's primary group).
              fields:
                - name: name
                  type: keyword
                  description: >
                      Group name.
                - name: gid
                  type: integer
                  description: >
                      Group ID.
            - name: password
              type: group
              description: >
                `password` contains information about a user's password (not the password itself).
              fields:
                - name: type
                  type: keyword
                  description: >
                      A user's password type. Possible values are `shadow_password`
                      (the password hash is in the shadow file), `password_disabled`,
                      `no_password` (this is dangerous as anyone can log in), and
                      `crypt_password` (when the password field in /etc/passwd seems
                      to contain an encrypted password).
                - name: last_changed
                  type: date
                  description: >
                      The day the user's password was last changed.
