- key: log
  title: Log file content
  description: >
    Contains log file lines.
  fields:
    - name: source
      type: keyword
      required: true
      description: >
        The file from which the line was read. This field contains the absolute path to the file.
        For example: `/var/log/system.log`.

    - name: offset
      type: long
      required: false
      description: >
        The file offset the reported line starts at.

    - name: message
      type: text
      ignore_above: 0
      required: true
      description: >
        The content of the line read from the log file.

    - name: stream
      type: keyword
      required: false
      description: >
        Log stream when reading container logs, can be 'stdout' or 'stderr'

    - name: prospector.type
      required: true
      deprecated: 6.3
      description: >
        The input type from which the event was generated. This field is set to the value specified
        for the `type` option in the input section of the Filebeat config file. (DEPRECATED: see `input.type`)

    - name: input.type
      required: true
      description: >
        The input type from which the event was generated. This field is set to the value specified
        for the `type` option in the input section of the Filebeat config file.

    - name: read_timestamp
      description: >
        In case the ingest pipeline parses the timestamp from the log contents, it stores
        the original `@timestamp` (representing the time when the log line was read) in this
        field.

    - name: fileset.module
      description: >
        The Filebeat module that generated this event.

    - name: fileset.name
      description: >
        The Filebeat fileset that generated this event.

    - name: syslog.facility
      type: long
      required: false
      description: >
        The facility extracted from the priority.

    - name: syslog.priority
      type: long
      required: false
      description: >
        The priority of the syslog event.

    - name: syslog.severity_label
      type: keyword
      required: false
      description: >
        The human readable severity.

    - name: syslog.facility_label
      type: keyword
      required: false
      description: >
        The human readable facility.

    - name: process.program
      type: keyword
      required: false
      description: >
        The name of the program.

    - name: process.pid
      type: long
      required: false
      description: >
        The pid of the process.

    - name: event.severity
      type: long
      required: false
      description: >
        The severity of the event.

    - name: service.name
      type: keyword
      description: >
        Service name.

    - name: log.level
      type: keyword
      description: >
        Logging level.

    - name: log.flags
      description: >
        This field contains the flags of the event.

    - name: event.created
      type: date
      description: >
        event.created contains the date on which the event was created. In case of
        log events this is when the log line was read by Filebeat. In comparison
        @timestamp is the processed timestamp from the log line. If both are identical
        only @timestamp should be used.

    - name: event.type
      type: keyword
      description: >
        A type given to this kind of event which can be used for grouping.

    - name: http.response.status_code
      type: long
      description: >
        HTTP response status_code.
      example: 404

    - name: http.response.elapsed_time
      type: long
      description: >
        Elapsed time between request and response in milli seconds.

    - name: http.response.content_length
      type: long
      description: >
        Content length of the HTTP response body.

    - name: http.request.method
      type: keyword
      description: >
        Request method.

    - name: source_ecs
      type: group
      fields:
      - name: ip
        type: ip
        description: >
          IP address of the source.

          Can be one or multiple IPv4 or IPv6 addresses.

      - name: port
        type: long
        description: >
          Port of the source.

      - name: geo
        type: group
        description:
          Geolocation for source.
        fields:
        - name: continent_name
          type: keyword
          description: >
            Name of the continent.

        - name: country_iso_code
          type: keyword
          description: >
            Country ISO code.

        - name: location
          type: geo_point
          description: >
            Longitude and latitude.

        - name: region_name
          type: keyword
          description: >
            Region name.

        - name: city_name
          type: keyword
          description: >
            City name.

        - name: region_iso_code
          type: keyword
          description: >
            Region ISO code.

    - name: destination
      type: group
      fields:
        - name: ip
          type: ip
          description: >
            IP address of the destination.

            Can be one or multiple IPv4 or IPv6 addresses.

        - name: port
          type: long
          description: >
            Port of the destination.

        - name: geo
          type: group
          description:
            Geolocation for destination.
          fields:
          - name: continent_name
            type: keyword
            description: >
              Name of the continent.

          - name: country_iso_code
            type: keyword
            description: >
              Country ISO code.

          - name: location
            type: geo_point
            description: >
              Longitude and latitude.

          - name: region_name
            type: keyword
            description: >
              Region name.

          - name: city_name
            type: keyword
            description: >
              City name.

          - name: region_iso_code
            type: keyword
            description: >
              Region ISO code.

    - name: user_agent
      title: User agent
      description: >
        The user_agent fields normally come from a browser request. They often
        show up in web service logs coming from the parsed user agent string.
      type: group
      fields:
        - name: original
          level: extended
          type: keyword
          description: >
            Unparsed version of the user_agent.

        - name: device
          level: extended
          type: keyword
          description: >
            Name of the physical device.

        - name: version
          level: extended
          type: keyword
          description: >
            Version of the physical device.

        - name: major
          level: extended
          type: long
          description: >
            Major version of the user agent.

        - name: minor
          level: extended
          type: long
          description: >
            Minor version of the user agent.

        - name: patch
          level: extended
          type: keyword
          description: >
            Patch version of the user agent.

        - name: name
          level: extended
          type: keyword
          example: Chrome
          description: >
            Name of the user agent.

        - name: os.name
          level: extended
          type: keyword
          description: >
            Name of the operating system.

        - name: os.full_name
          level: extended
          type: keyword
          description: >
            Full name of the operating system (includes version).

        - name: os.version
          level: extended
          type: keyword
          description: >
            Version of the operating system.

        - name: os.major
          level: extended
          type: long
          description: >
            Major version of the operating system.

        - name: os.minor
          level: extended
          type: long
          description: >
            Minor version of the operating system.

    - name: url
      description: >
        URL fields provide a complete URL, with scheme, host, and path. The URL
        object can be reused in other prefixes, such as `host.url.*` for
        example. Keep the structure consistent whenever you use URL fields.

      type: group
      fields:
      - name: hostname
        type: keyword
        description: >
          Hostname of the request, such as "elastic.co".
          In some cases a URL may refer to an IP and/or port directly, without a
          domain name. In this case, the IP address would go to the `hostname` field.

    - name: file
      description: >
        File fields provide details about each file.

      type: group
      fields:
        - name: path
          level: extended
          type: keyword
          description: Path to the file.

        - name: size
          type: long
          description: File size in bytes (field is only added when `type` is
            `file`).

- key: beat
  title: Beat
  description: >
    Contains common beat fields available in all event types.
  fields:

    - name: beat.name
      description: >
        The name of the Beat sending the log messages. If the Beat name is
        set in the configuration file, then that value is used. If it is not
        set, the hostname is used. To set the Beat name, use the `name`
        option in the configuration file.
    - name: beat.hostname
      description: >
        The hostname as returned by the operating system on which the Beat is
        running.
    - name: beat.timezone
      description: >
        The timezone as returned by the operating system on which the Beat is
        running.
    - name: beat.version
      description: >
        The version of the beat that generated this event.

    - name: "@timestamp"
      type: date
      required: true
      format: date
      example: August 26th 2016, 12:35:53.332
      description: >
        The timestamp when the event log record was generated.

    - name: tags
      description: >
        Arbitrary tags that can be set per Beat and per transaction
        type.

    - name: fields
      type: object
      object_type: keyword
      description: >
        Contains user configurable fields.

    - name: error
      type: group
      description: >
        Error fields containing additional info in case of errors.
      fields:
        - name: message
          type: text
          description: >
            Error message.
        - name: code
          type: long
          description: >
            Error code.
        - name: type
          type: keyword
          description: >
            Error type.
- key: cloud
  title: Cloud provider metadata
  description: >
    Metadata from cloud providers added by the add_cloud_metadata processor.
  fields:

    - name: meta.cloud.provider
      example: ec2
      description: >
        Name of the cloud provider. Possible values are ec2, gce, or digitalocean.

    - name: meta.cloud.instance_id
      description: >
        Instance ID of the host machine.

    - name: meta.cloud.instance_name
      description: >
        Instance name of the host machine.

    - name: meta.cloud.machine_type
      example: t2.medium
      description: >
        Machine type of the host machine.

    - name: meta.cloud.availability_zone
      example: us-east-1c
      description: >
        Availability zone in which this host is running.

    - name: meta.cloud.project_id
      example: project-x
      description: >
        Name of the project in Google Cloud.

    - name: meta.cloud.region
      description: >
        Region in which this host is running.
- key: docker
  title: Docker
  description: >
    Docker stats collected from Docker.
  short_config: false
  anchor: docker-processor
  fields:
    - name: docker
      type: group
      fields:
        - name: container.id
          type: keyword
          description: >
            Unique container id.
        - name: container.image
          type: keyword
          description: >
            Name of the image the container was built on.
        - name: container.name
          type: keyword
          description: >
            Container name.
        - name: container.labels
          type: object
          object_type: keyword
          description: >
            Image labels.
- key: host
  title: Host
  description: >
    Info collected for the host machine.
  anchor: host-processor
  fields:
    - name: host
      type: group
      fields:
        - name: name
          type: keyword
          description: >
            Hostname.
        - name: id
          type: keyword
          description: >
            Unique host id.
        - name: architecture
          type: keyword
          description: >
            Host architecture (e.g. x86_64, arm, ppc, mips).
        - name: os.platform
          type: keyword
          description: >
            OS platform (e.g. centos, ubuntu, windows).
        - name: os.version
          type: keyword
          description: >
            OS version.
        - name: os.family
          type: keyword
          description: >
            OS family (e.g. redhat, debian, freebsd, windows).
        - name: ip
          type: ip
          description: >
            List of IP-addresses.
        - name: mac
          type: keyword
          description: >
            List of hardware-addresses, usually MAC-addresses.

- key: kubernetes
  title: Kubernetes
  description: >
    Kubernetes metadata added by the kubernetes processor
  short_config: false
  anchor: kubernetes-processor
  fields:
    - name: kubernetes
      type: group
      fields:
        - name: pod.name
          type: keyword
          description: >
            Kubernetes pod name

        - name: pod.uid
          type: keyword
          description: >
            Kubernetes Pod UID

        - name: namespace
          type: keyword
          description: >
            Kubernetes namespace

        - name: node.name
          type: keyword
          description: >
            Kubernetes node name

        - name: labels
          type: object
          description: >
            Kubernetes labels map

        - name: annotations
          type: object
          description: >
            Kubernetes annotations map

        - name: container.name
          type: keyword
          description: >
            Kubernetes container name

        - name: container.image
          type: keyword
          description: >
            Kubernetes container image
- key: apache2
  title: "Apache2"
  description: >
    Apache2 Module
  short_config: true
  fields:
    - name: apache2
      type: group
      description: >
        Apache2 fields.
      fields:
        - name: access
          type: group
          description: >
            Contains fields for the Apache2 HTTPD access logs.
          fields:
            - name: remote_ip
              type: keyword
              description: >
                Client IP address.
            - name: user_name
              type: keyword
              description: >
                The user name used when basic authentication is used.
            - name: method
              type: keyword
              example: GET
              description: >
                The request HTTP method.
            - name: url
              type: keyword
              description: >
                The request HTTP URL.
            - name: http_version
              type: keyword
              description: >
                The HTTP version.
            - name: response_code
              type: long
              description: >
                The HTTP response code.
            - name: body_sent.bytes
              type: long
              format: bytes
              description: >
                The number of bytes of the server response body.
            - name: referrer
              type: keyword
              description: >
                The HTTP referrer.
            - name: agent
              type: text
              description: >
                Contains the un-parsed user agent string. Only present if the user
                agent Elasticsearch plugin is not available or not used.
            - name: user_agent
              type: group
              description: >
                Contains the parsed User agent field. Only present if the user
                agent Elasticsearch plugin is available and used.
              fields:
                - name: device
                  type: keyword
                  description: >
                    The name of the physical device.
                - name: major
                  type: long
                  description: >
                    The major version of the user agent.
                - name: minor
                  type: long
                  description: >
                    The minor version of the user agent.
                - name: patch
                  type: keyword
                  description: >
                    The patch version of the user agent.
                - name: name
                  type: keyword
                  example: Chrome
                  description: >
                    The name of the user agent.
                - name: os
                  type: keyword
                  description: >
                    The name of the operating system.
                - name: os_major
                  type: long
                  description: >
                    The major version of the operating system.
                - name: os_minor
                  type: long
                  description: >
                    The minor version of the operating system.
                - name: os_name
                  type: keyword
                  description: >
                    The name of the operating system.
                - name: original
                  type: text
                  index: false
                  description: >
                    Original user agent value before parsing by ingest-user-agent plugin.
            - name: geoip
              type: group
              description: >
                Contains GeoIP information gathered based on the remote_ip field.
                Only present if the GeoIP Elasticsearch plugin is available and
                used.
              fields:
                - name: continent_name
                  type: keyword
                  description: >
                    The name of the continent.
                - name: country_iso_code
                  type: keyword
                  description: >
                    Country ISO code.
                - name: location
                  type: geo_point
                  description: >
                    The longitude and latitude.
                - name: region_name
                  type: keyword
                  description: >
                    The region name.
                - name: city_name
                  type: keyword
                  description: >
                    The city name.
                - name: region_iso_code
                  type: keyword
                  description: >
                    Region ISO code.
        - name: error
          type: group
          description: >
            Fields from the Apache error logs.
          fields:
            - name: level
              type: keyword
              description: >
                The severity level of the message.
            - name: client
              type: keyword
              description: >
                The IP address of the client that generated the error.
            - name: message
              type: text
              description: >
                The logged message.
            - name: pid
              type: long
              description: >
                The process ID.
            - name: tid
              type: long
              description: >
                The thread ID.
            - name: module
              type: keyword
              description: >
                The module producing the logged message.
- key: auditd
  title: "Auditd"
  description: >
    Module for parsing auditd logs.
  short_config: true
  fields:
    - name: auditd
      type: group
      description: >
        Fields from the auditd logs.
      fields:
        - name: log
          type: group
          description: >
            Fields from the Linux audit log. Not all fields are documented here because
            they are dynamic and vary by audit event type.
          fields:
            - name: record_type
              description: >
                The audit event type.
            - name: old_auid
              description: >
                For login events this is the old audit ID used for the user prior to
                this login.
            - name: new_auid
              description: >
                For login events this is the new audit ID. The audit ID can be used to
                trace future events to the user even if their identity changes (like
                becoming root).
            - name: old_ses
              description: >
                For login events this is the old session ID used for the user prior to
                this login.
            - name: new_ses
              description: >
                For login events this is the new session ID. It can be used to tie a
                user to future events by session ID.
            - name: sequence
              type: long
              description: >
                The audit event sequence number.
            - name: acct
              description: >
                The user account name associated with the event.
            - name: pid
              description: >
                The ID of the process.
            - name: ppid
              description: >
                The ID of the process.
            - name: items
              description: >
                The number of items in an event.
            - name: item
              description: >
                The item field indicates which item out of the total number of items.
                This number is zero-based; a value of 0 means it is the first item.
            - name: a0
              description: >
                The first argument to the system call.
            - name: res
              description: >
                The result of the system call (success or failure).
            - name: geoip
              type: group
              description: >
                Contains GeoIP information gathered based on the `auditd.log.addr`
                field. Only present if the GeoIP Elasticsearch plugin is available and
                used.
              fields:
                - name: continent_name
                  type: keyword
                  description: >
                    The name of the continent.
                - name: city_name
                  type: keyword
                  description: >
                    The name of the city.
                - name: region_name
                  type: keyword
                  description: >
                    The name of the region.
                - name: country_iso_code
                  type: keyword
                  description: >
                    Country ISO code.
                - name: location
                  type: geo_point
                  description: >
                    The longitude and latitude.
                - name: region_iso_code
                  type: keyword
                  description: >
                    Region ISO code.
- key: elasticsearch
  title: "elasticsearch"
  description: >
    elasticsearch Module
  fields:
    - name: elasticsearch
      type: group
      description: >
      fields:
        - name: node.name
          description: "Name of the node"
          example: "vWNJsZ3"
          type: keyword
        - name: index.name
          description: "Index name"
          example: "filebeat-test-input"
          type: keyword
        - name: index.id
          description: "Index id"
          example: "aOGgDwbURfCV57AScqbCgw"
          type: keyword
        - name: shard.id
          description: "Id of the shard"
          example: "0"
          type: keyword
        - name: audit
          type: group
          description: >
          fields:
            - name: layer
              description: "The layer from which this event originated: rest, transport or ip_filter"
              example: "rest"
              type: keyword
            - name: event_type
              description: "The type of event that occurred: anonymous_access_denied, authentication_failed, access_denied, access_granted, connection_granted, connection_denied, tampered_request, run_as_granted, run_as_denied"
              example: "access_granted"
              type: keyword
            - name: origin_type
              description: "Where the request originated: rest (request originated from a REST API request), transport (request was received on the transport channel), local_node (the local node issued the request)"
              example: "local_node"
              type: keyword
            - name: origin_address
              description: "The IP address from which the request originated"
              example: "192.168.1.42"
              type: ip
            - name: principal
              description: "The principal (username) that failed authentication"
              example: "_anonymous"
              type: keyword
            - name: action
              description: "The name of the action that was executed"
              example: "cluster:monitor/main"
              type: keyword
            - name: uri
              description: "The REST endpoint URI"
              example: /_xpack/security/_authenticate
              type: keyword
            - name: request
              description: "The type of request that was executed"
              example: "ClearScrollRequest"
              type: keyword
            - name: request_body
              description: "The body of the request, if enabled"
              example: "body"
              type: text
        - name: deprecation
          type: group
          description: >
          fields:
        - name: gc
          type: group
          description: >
            GC fileset fields.
          fields:
            - name: phase
              type: group
              description: >
                Fields specific to GC phase.
              fields:
                - name: name
                  type: keyword
                  description: >
                    Name of the GC collection phase.
                - name: duration_sec
                  type: float
                  description: >
                    Collection phase duration according to the Java virtual machine.
                - name: scrub_symbol_table_time_sec
                  type: float
                  description: >
                     Pause time in seconds cleaning up symbol tables.
                - name: scrub_string_table_time_sec
                  type: float
                  description: >
                    Pause time in seconds cleaning up string tables.
                - name: weak_refs_processing_time_sec
                  type: float
                  description: >
                    Time spent processing weak references in seconds.
                - name: parallel_rescan_time_sec
                  type: float
                  description: >
                    Time spent in seconds marking live objects while application is stopped.
                - name: class_unload_time_sec
                  type: float
                  description: >
                    Time spent unloading unused classes in seconds.
                - name: cpu_time
                  type: group
                  description: >
                    Process CPU time spent performing collections.
                  fields:
                    - name: user_sec
                      type: float
                      description: >
                        CPU time spent outside the kernel.
                    - name: sys_sec
                      type: float
                      description: >
                        CPU time spent inside the kernel. 
                    - name: real_sec
                      type: float
                      description: >
                        Total elapsed CPU time spent to complete the collection from start to finish.
            - name: jvm_runtime_sec
              type: float
              description: >
                The time from JVM start up in seconds, as a floating point number.
            - name: threads_total_stop_time_sec
              type: float
              description: >
                Garbage collection threads total stop time seconds.
            - name: stopping_threads_time_sec
              type: float
              description: >
                Time took to stop threads seconds.
            - name: tags
              type: keyword
              description: >
                GC logging tags.
            - name: heap
              type: group
              description: >
                Heap allocation and total size.
              fields:
                - name: size_kb
                  type: integer
                  description: >
                    Total heap size in kilobytes.
                - name: used_kb
                  type: integer
                  description: >
                    Used heap in kilobytes.
            - name: old_gen
              type: group
              description: >
                Old generation occupancy and total size.
              fields:
                - name: size_kb
                  type: integer
                  description: >
                    Total size of old generation in kilobytes.
                - name: used_kb
                  type: integer
                  description: >
                    Old generation occupancy in kilobytes.
            - name: young_gen
              type: group
              description: >
                Young generation occupancy and total size.
              fields:
                - name: size_kb
                  type: integer
                  description: >
                    Total size of young generation in kilobytes.
                - name: used_kb
                  type: integer
                  description: >
                    Young generation occupancy in kilobytes.
        - name: server
          description: "Server log file"
          type: group
          fields:
          - name: component
            description: "Log component"
            example: "o.e.c.m.MetaDataCreateIndexService"
            type: keyword
          - name: gc
            description: "GC log"
            type: group
            fields:
            - name: young
              description: "Young GC"
              example: ""
              type: group
              fields:
              - name: one
                description: ""
                example: ""
                type: long
              - name: two
                description: ""
                example: ""
                type: long
          - name: gc_overhead
            description: ""
            example: ""
            type: long
        - name: slowlog
          description: "Slowlog events from Elasticsearch"
          example: "[2018-06-29T10:06:14,933][INFO ][index.search.slowlog.query] [v_VJhjV] [metricbeat-6.3.0-2018.06.26][0] took[4.5ms], took_millis[4], total_hits[19435], types[], stats[], search_type[QUERY_THEN_FETCH], total_shards[1], source[{\"query\":{\"match_all\":{\"boost\":1.0}}}],"
          type: group
          fields:
          - name: logger
            description: "Logger name"
            example: "index.search.slowlog.fetch"
            type: keyword
          - name: took
            description: "Time it took to execute the query"
            example: "300ms"
            type: text
          - name: types
            description: "Types"
            example: ""
            type: keyword
          - name: stats
            description: "Statistics"
            example: ""
            type: text
          - name: search_type
            description: "Search type"
            example: "QUERY_THEN_FETCH"
            type: keyword
          - name: source_query
            description: "Slow query"
            example: "{\"query\":{\"match_all\":{\"boost\":1.0}}}"
            type: text
          - name: extra_source
            description: "Extra source information"
            example: ""
            type: text
          - name: took_millis
            description: "Time took in milliseconds"
            example: 42
            type: keyword
          - name: total_hits
            description: "Total hits"
            example: 42
            type: keyword
          - name: total_shards
            description: "Total queried shards"
            example: 22
            type: keyword
          - name: routing
            description: "Routing"
            example: "s01HZ2QBk9jw4gtgaFtn"
            type: keyword
          - name: id
            description: Id
            example: ""
            type: keyword
          - name: type
            description: "Type"
            example: "doc"
            type: keyword
- key: haproxy
  title: "haproxy"
  description: >
    haproxy Module
  fields: 
    - name: haproxy
      type: group
      description: >
      fields:

        - name: destination
          description: Destination information
          type: group
          fields:
          - name: port
            description: Port of the destination host
            type: long

          - name: ip
            description: IP of the destination host

        - name: process_name
          description: Name of the process

        - name: pid
          description: PID of the process
          type: long

        - name: client
          description: Information about the client doing the request
          type: group
          fields:
          - name: ip
            description: IP address of the client which initiated the TCP connection to haproxy.

          - name: port
            description: TCP port of the client which initiated the connection.
            type: long

        - name: frontend_name
          description: Name of the frontend (or listener) which received and processed the connection.

        - name: backend_name
          description: Name of the backend (or listener) which was selected to manage the connection to the server.

        - name: server_name
          description: Name of the last server to which the connection was sent.

        - name: total_waiting_time_ms
          description: Total time in milliseconds spent waiting in the various queues
          type: long

        - name: connection_wait_time_ms
          description: Total time in milliseconds spent waiting for the connection to establish to the final server
          type: long

        - name: bytes_read
          description: Total number of bytes transmitted to the client when the log is emitted.
          type: long

        - name: time_queue
          description: Total time in milliseconds spent waiting in the various queues.
          type: long

        - name: time_backend_connect
          description: Total time in milliseconds spent waiting for the connection to establish to the final server, including retries.
          type: long

        - name: server_queue
          description: Total number of requests which were processed before this one in the server queue.
          type: long

        - name: backend_queue
          description: Total number of requests which were processed before this one in the backend's global queue.
          type: long

        - name: bind_name
          description: Name of the listening address which received the connection.

        - name: error_message
          description: Error message logged by HAProxy in case of error.
          type: text
          
        - name: source
          type: text
          description: The HAProxy source of the log
        
        - name: geoip
          type: group
          description: >
            Contains GeoIP information gathered based on the client.ip field.
            Only present if the GeoIP Elasticsearch plugin is available and
            used.
          fields:
            - name: continent_name
              type: keyword
              description: Name of the continent.
            - name: country_iso_code
              type: keyword
              description: Country ISO code.
            - name: location
              type: geo_point
              description: Represents a geopoint with the longitude and latitude.
            - name: region_name
              type: keyword
              description: Name of the region
            - name: city_name
              type: keyword
              description: City name.
            - name: region_iso_code
              type: keyword
              description: ISO code of the region

        - name: termination_state
          description: Condition the session was in when the session ended.

        - name: connections
          description: Contains various counts of connections active in the process.
          type: group
          fields:
            - name: active
              description: Total number of concurrent connections on the process when the session was logged.
              type: long

            - name: frontend
              description: Total number of concurrent connections on the frontend when the session was logged.
              type: long

            - name: backend
              description: Total number of concurrent connections handled by the backend when the session was logged.
              type: long

            - name: server
              description: Total number of concurrent connections still active on the server when the session was logged.
              type: long

            - name: retries
              description: Number of connection retries experienced by this session when trying to connect to the server.
              type: long
        - name: mode
          type: text
          description: mode that the frontend is operating (TCP or HTTP)
        - name: http
          description: Please add description
          type: group
          fields: 
        
          - name: response
            description: Fields related to the HTTP response
            type: group
            fields:
            - name: status_code
              description: HTTP status code returned to the client.
              type: long
        
            - name: captured_cookie
              description: >
                Optional "name=value" entry indicating that the client had this cookie in the response.
        
            - name: captured_headers
              description: >
                List of headers captured in the response due to the presence of the "capture response header" statement in the frontend.
              type: text
        
          - name: request
            description: Fields related to the HTTP request
            type: group
            fields:
            - name: captured_cookie
              description: >
                Optional "name=value" entry indicating that the server has returned a cookie with its request.
        
            - name: captured_headers
              description: >
                List of headers captured in the request due to the presence of the "capture request header" statement in the frontend.
              type: text
        
            - name: raw_request_line
              description: Complete HTTP request line, including the method, request and HTTP version string.
              type: text
              
            - name: time_active_ms
              description: Time the request remained active in haproxy, which is the total time in milliseconds elapsed between the first byte of the request was received and the last byte of response was sent.
              type: long
        
            - name: time_wait_without_data_ms
              description: Total time in milliseconds spent waiting for the server to send a full HTTP response, not counting data.
              type: long
        
            - name: time_wait_ms
              description: Total time in milliseconds spent waiting for a full HTTP request from the client (not counting body) after the first byte was received.
              type: long
        
        - name: tcp
          description: TCP log format
          type: group
          fields:
          - name: processing_time_ms
            type: long
            description: Total time in milliseconds elapsed between the accept and the last close
          - name: connection_waiting_time_ms
            type: long
            description: Total time in milliseconds elapsed between the accept and the last close
- key: icinga
  title: "Icinga"
  description: >
    Icinga Module
  fields:
    - name: icinga
      type: group
      description: >
      fields:
        - name: debug
          type: group
          description: >
            Contains fields for the Icinga debug logs.
          fields:
            - name: facility
              type: keyword
              description: >
                Specifies what component of Icinga logged the message.
            - name: severity
              type: keyword
              description: >
                Possible values are "debug", "notice", "information", "warning" or
                "critical".
            - name: message
              type: text
              description: >
                The logged message.
        - name: main
          type: group
          description: >
            Contains fields for the Icinga main logs.
          fields:
            - name: facility
              type: keyword
              description: >
                Specifies what component of Icinga logged the message.
            - name: severity
              type: keyword
              description: >
                Possible values are "debug", "notice", "information", "warning" or
                "critical".
            - name: message
              type: text
              description: >
                The logged message.
        - name: startup
          type: group
          description: >
            Contains fields for the Icinga startup logs.
          fields:
            - name: facility
              type: keyword
              description: >
                Specifies what component of Icinga logged the message.
            - name: severity
              type: keyword
              description: >
                Possible values are "debug", "notice", "information", "warning" or
                "critical".
            - name: message
              type: text
              description: >
                The logged message.
- key: iis
  title: "IIS"
  description: >
    Module for parsing IIS log files.
  fields:
    - name: iis
      type: group
      description: >
        Fields from IIS log files.
      fields:
        - name: access
          type: group
          description: >
            Contains fields for IIS access logs.
          fields:
            - name: server_ip
              type: keyword
              description: >
                The server IP address.
            - name: method
              type: keyword
              example: GET
              description: >
                The request HTTP method.
            - name: url
              type: keyword
              description: >
                The request HTTP URL.
            - name: query_string
              type: keyword
              description: >
                The request query string, if any.
            - name: port
              type: long
              description: >
                The request port number.
            - name: user_name
              type: keyword
              description: >
                The user name used when basic authentication is used.
            - name: remote_ip
              type: keyword
              description: >
                The client IP address.
            - name: referrer
              type: keyword
              description: >
                The HTTP referrer.
            - name: response_code
              type: long
              description: >
                The HTTP response code.
            - name: sub_status
              type: long
              description: >
                The HTTP substatus code.
            - name: win32_status
              type: long
              description: >
                The Windows status code.
            - name: request_time_ms
              type: long
              description: >
                The request time in milliseconds.
            - name: site_name
              type: keyword
              description: >
                The site name and instance number.
            - name: server_name
              type: keyword
              description: >
                The name of the server on which the log file entry was generated.
            - name: http_version
              type: keyword
              description: >
                The HTTP version.
            - name: cookie
              type: keyword
              description: >
                The content of the cookie sent or received, if any.
            - name: hostname
              type: keyword
              description: >
                The host header name, if any.
            - name: body_sent.bytes
              type: long
              format: bytes
              description: >
                The number of bytes of the server response body.
            - name: body_received.bytes
              type: long
              format: bytes
              description: >
                The number of bytes of the server request body.
            - name: agent
              type: text
              description: >
                Contains the un-parsed user agent string. Only present if the user
                agent Elasticsearch plugin is not available or not used.
            - name: user_agent
              type: group
              description: >
                Contains the parsed user agent field. Only present if the user
                agent Elasticsearch plugin is available and used.
              fields:
                - name: device
                  type: keyword
                  description: >
                    The name of the physical device.
                - name: major
                  type: long
                  description: >
                    The major version of the user agent.
                - name: minor
                  type: long
                  description: >
                    The minor version of the user agent.
                - name: patch
                  type: keyword
                  description: >
                    The patch version of the user agent.
                - name: name
                  type: keyword
                  example: Chrome
                  description: >
                    The name of the user agent.
                - name: os
                  type: keyword
                  description: >
                    The name of the operating system.
                - name: os_major
                  type: long
                  description: >
                    The major version of the operating system.
                - name: os_minor
                  type: long
                  description: >
                    The minor version of the operating system.
                - name: os_name
                  type: keyword
                  description: >
                    The name of the operating system.
                - name: original
                  type: text
                  index: false
                  description: >
                    Original user agent value before parsing by ingest-user-agent plugin.
            - name: geoip
              type: group
              description: >
                Contains GeoIP information gathered based on the remote_ip field.
                Only present if the GeoIP Elasticsearch plugin is available and
                used.
              fields:
                - name: continent_name
                  type: keyword
                  description: >
                    The name of the continent.
                - name: country_iso_code
                  type: keyword
                  description: >
                    Country ISO code.
                - name: location
                  type: geo_point
                  description: >
                    The longitude and latitude.
                - name: region_name
                  type: keyword
                  description: >
                    The region name.
                - name: city_name
                  type: keyword
                  description: >
                    The city name.
                - name: region_iso_code
                  type: keyword
                  description: >
                    Region ISO code.
        - name: error
          type: group
          description: >
            Contains fields for IIS error logs.
          fields:
            - name: remote_ip
              type: keyword
              description: >
                The client IP address.
            - name: remote_port
              type: long
              description: >
                The client port number.
            - name: server_ip
              type: keyword
              description: >
                The server IP address.
            - name: server_port
              type: long
              description: >
                The server port number.
            - name: http_version
              type: keyword
              description: >
                The HTTP version.
            - name: method
              type: keyword
              example: GET
              description: >
                The request HTTP method.
            - name: url
              type: keyword
              description: >
                The request HTTP URL.
            - name: response_code
              type: long
              description: >
                The HTTP response code.
            - name: reason_phrase
              type: keyword
              description: >
                The HTTP reason phrase.
            - name: queue_name
              type: keyword
              description: >
                The IIS application pool name.
            - name: geoip
              type: group
              description: >
                Contains GeoIP information gathered based on the remote_ip field.
                Only present if the GeoIP Elasticsearch plugin is available and
                used.
              fields:
                - name: continent_name
                  type: keyword
                  description: >
                    The name of the continent.
                - name: country_iso_code
                  type: keyword
                  description: >
                    Country ISO code.
                - name: location
                  type: geo_point
                  description: >
                    The longitude and latitude.
                - name: region_name
                  type: keyword
                  description: >
                    The region name.
                - name: city_name
                  type: keyword
                  description: >
                    The city name.
                - name: region_iso_code
                  type: keyword
                  description: >
                    Region ISO code.
- key: kafka
  title: "Kafka"
  description: >
    Kafka module
  fields:
    - name: kafka
      type: group
      description: >
      fields:
        - name: log
          type: group
          description: >
            Kafka log lines.
          fields:
            - name: timestamp
              description: >
                The timestamp from the log line.
            - name: level
              example: "WARN"
              description: >
                The log level.
            - name: message
              type: text
              description: >
                The logged message.
            - name: component
              type: keyword
              description: >
                Component the log is coming from.
            - name: class
              type: text
              description: >
                Java class the log is coming from.
            - name: trace
              type: group
              description: >
                  Trace in the log line.
              fields:
                - name: class
                  type: keyword
                  description: >
                    Java class the trace is coming from.
                - name: message
                  type: text
                  description: >
                      Message part of the trace.
                - name: full
                  type: text
                  description: >
                      The full trace in the log line.
- key: kibana
  title: "kibana"
  description: >
    kibana Module
  fields:
    - name: kibana
      type: group
      description: >
      fields:
        - name: log
          type: group
          description: >
            Kafka log lines.
          fields:
            - name: tags
              type: keyword
              description: >
                Kibana logging tags.
            - name: state
              type: keyword
              description: >
                Current state of Kibana.
            - name: meta
              type: object
              object_type: keyword
- key: logstash
  title: "logstash"
  description: >
    logstash Module
  fields:
    - name: logstash
      type: group
      description: >
      fields:
        - name: log
          title: "Logstash"
          type: group
          description: >
            Fields from the Logstash logs.
          fields:
            - name: message
              type: text
              description: >
                Contains the un-parsed log message
            - name: level
              type: keyword
              description: >
                The log level of the message, this correspond to Log4j levels.
            - name: module
              type: keyword
              description: >
                The module or class where the event originate.
            - name: thread
              type: text
              description: >
                Information about the running thread where the log originate.
            - name: log_event
              type: object
              description: >
                key and value debugging information.
        
        - name: slowlog
          type: group
          description: >
            slowlog
          fields:
            - name: message
              type: text
              description: >
                Contains the un-parsed log message
            - name: level
              type: keyword
              description: >
                The log level of the message, this correspond to Log4j levels.
            - name: module
              type: keyword
              description: >
                The module or class where the event originate.
            - name: thread
              type: text
              description: >
                Information about the running thread where the log originate.
            - name: event
              type: text
              description: >
                Raw dump of the original event
            - name: plugin_name
              type: keyword
              description: >
                Name of the plugin
            - name: plugin_type
              type: keyword
              description: >
                Type of the plugin: Inputs, Filters, Outputs or Codecs.
            - name: took_in_millis
              type: long
              description: >
                Execution time for the plugin in milliseconds.
            - name: took_in_nanos
              type: long
              description: >
                Execution time for the plugin in nanoseconds.
            - name: plugin_params
              type: text
              description: >
                String value of the plugin configuration
            - name: plugin_params_object
              type: object
              description: >
                key -> value of the configuration used by the plugin.
        
        
        
        
        
- key: mongodb
  title: "mongodb"
  description: >
    Module for parsing MongoDB log files.
  fields:
    - name: mongodb
      type: group
      description: >
          Fields from MongoDB logs.
      fields:
        - name: log
          type: group
          description: >
              Contains fields from MongoDB logs.
          fields:
          - name: severity
            description: >
                Severity level of message
            example: I
            type: keyword
          - name: component
            description: >
                Functional categorization of message
            example: COMMAND
            type: keyword
          - name: context
            description: >
                Context of message
            example: initandlisten
            type: keyword
          - name: message
            description: >
                The message in the log line.
            type: text
- key: mysql
  title: "MySQL"
  description: >
    Module for parsing the MySQL log files.
  short_config: true
  fields:
    - name: mysql
      type: group
      description: >
        Fields from the MySQL log files.
      fields:
        - name: error
          type: group
          description: >
            Contains fields from the MySQL error logs.
          fields:
            - name: timestamp
              description: >
                The timestamp from the log line.
            - name: thread_id
              type: long
              description: >
                As of MySQL 5.7.2, this is the thread id. For MySQL versions prior to 5.7.2, this
                field contains the process id.
            - name: level
              example: "Warning"
              description:
                The log level.
            - name: message
              type: text
              description: >
                The logged message.
        - name: slowlog
          type: group
          description: >
            Contains fields from the MySQL slow logs.
          fields:
            - name: user
              description: >
                The MySQL user that created the query.
            - name: host
              description: >
                The host from where the user that created the query logged in.
            - name: ip
              description: >
                The IP address from where the user that created the query logged in.
            - name: query_time.sec
              type: float
              description: >
                The total time the query took, in seconds, as a floating point number.
            - name: lock_time.sec
              type: float
              description: >
                The amount of time the query waited for the lock to be available. The
                value is in seconds, as a floating point number.
            - name: rows_sent
              type: long
              description: >
                The number of rows returned by the query.
            - name: rows_examined
              type: long
              description: >
                The number of rows scanned by the query.
            - name: timestamp
              type: long
              description: >
                The unix timestamp taken from the `SET timestamp` query.
            - name: query
              description: >
                The slow query.
            - name: id
              type: long
              description: >
                The connection ID for the query.
- key: nginx
  title: "Nginx"
  description: >
    Module for parsing the Nginx log files.
  short_config: true
  fields:
    - name: nginx
      type: group
      description: >
        Fields from the Nginx log files.
      fields:
        - name: access
          type: group
          description: >
            Contains fields for the Nginx access logs.
          fields:
            - name: remote_ip_list
              type: array
              description: >
                An array of remote IP addresses. It is a list because it is common to include, besides the client
                IP address, IP addresses from headers like `X-Forwarded-For`. See also the `remote_ip` field.
            - name: remote_ip
              type: keyword
              description: >
                Client IP address. The first public IP address from the `remote_ip_list` array. If no public IP
                addresses are present, this field contains the first private IP address from the `remote_ip_list`
                array.
            - name: user_name
              type: keyword
              description: >
                The user name used when basic authentication is used.
            - name: method
              type: keyword
              example: GET
              description: >
                The request HTTP method.
            - name: url
              type: keyword
              description: >
                The request HTTP URL.
            - name: http_version
              type: keyword
              description: >
                The HTTP version.
            - name: response_code
              type: long
              description: >
                The HTTP response code.
            - name: body_sent.bytes
              type: long
              format: bytes
              description: >
                The number of bytes of the server response body.
            - name: referrer
              type: keyword
              description: >
                The HTTP referrer.
            - name: agent
              type: text
              description: >
                Contains the un-parsed user agent string. Only present if the user
                agent Elasticsearch plugin is not available or not used.
            - name: user_agent
              type: group
              description: >
                Contains the parsed User agent field. Only present if the user
                agent Elasticsearch plugin is available and used.
              fields:
                - name: device
                  type: keyword
                  description: >
                    The name of the physical device.
                - name: major
                  type: long
                  description: >
                    The major version of the user agent.
                - name: minor
                  type: long
                  description: >
                    The minor version of the user agent.
                - name: patch
                  type: keyword
                  description: >
                    The patch version of the user agent.
                - name: name
                  type: keyword
                  example: Chrome
                  description: >
                    The name of the user agent.
                - name: os
                  type: keyword
                  description: >
                    The name of the operating system.
                - name: os_major
                  type: long
                  description: >
                    The major version of the operating system.
                - name: os_minor
                  type: long
                  description: >
                    The minor version of the operating system.
                - name: os_name
                  type: keyword
                  description: >
                    The name of the operating system.
                - name: original
                  type: text
                  index: false
                  description: >
                    Original user agent value before parsing by ingest-user-agent plugin.
            - name: geoip
              type: group
              description: >
                Contains GeoIP information gathered based on the remote_ip field.
                Only present if the GeoIP Elasticsearch plugin is available and
                used.
              fields:
                - name: continent_name
                  type: keyword
                  description: >
                    The name of the continent.
                - name: country_iso_code
                  type: keyword
                  description: >
                    Country ISO code.
                - name: location
                  type: geo_point
                  description: >
                    The longitude and latitude.
                - name: region_name
                  type: keyword
                  description: >
                    The region name.
                - name: city_name
                  type: keyword
                  description: >
                    The city name.
                - name: region_iso_code
                  type: keyword
                  description: >
                    Region ISO code.
        - name: error
          type: group
          description: >
            Contains fields for the Nginx error logs.
          fields:
            - name: level
              type: keyword
              description: >
                Error level (e.g. error, critical).
            - name: pid
              type: long
              description: >
                Process identifier (PID).
            - name: tid
              type: long
              description: >
                Thread identifier.
            - name: connection_id
              type: long
              description: >
                Connection identifier.
            - name: message
              type: text
              description: >
                The error message
- key: osquery
  title: "Osquery"
  description: >
    Fields exported by the `osquery` module
  fields:
    - name: osquery
      type: group
      description: >
      fields:
        - name: result
          type: group
          description: >
            Common fields exported by the result metricset.
          fields:
            - name: name
              type: keyword
              description: >
                The name of the query that generated this event.
            - name: action
              type: keyword
              description: >
                For incremental data, marks whether the entry was added
                or removed. It can be one of "added", "removed", or "snapshot".
            - name: host_identifier
              type: keyword
              description: >
                The identifier for the host on which the osquery agent is running.
                Normally the hostname.
            - name: unix_time
              type: long
              description: >
                Unix timestamp of the event, in seconds since the epoch. Used for computing the `@timestamp` column.
            - name: calendar_time
              tupe: keyword
              description: >
                String representation of the collection time, as formatted by osquery.
- key: postgresql
  title: "PostgreSQL"
  description: >
    Module for parsing the PostgreSQL log files.
  short_config: true
  fields:
    - name: postgresql
      type: group
      description: >
          Fields from PostgreSQL logs.
      fields:
        - name: log
          type: group
          description: >
            Fields from the PostgreSQL log files.
          fields:
            - name: timestamp
              description: >
                The timestamp from the log line.
            - name: timezone
              description: >
                The timezone of timestamp.
            - name: thread_id
              type: long
              description: >
                  Process id
            - name: user
              example: "admin"
              description:
                Name of user
            - name: database
              example: "mydb"
              description:
                Name of database
            - name: level
              example: "FATAL"
              description:
                The log level.
            - name: duration
              type: float
              example: "30.0"
              description:
                Duration of a query.
            - name: query
              example: "SELECT * FROM users;"
              description:
                Query statement.
            - name: message
              type: text
              description: >
                The logged message.
- key: redis
  title: "Redis"
  description: >
    Redis Module
  fields:
    - name: redis
      type: group
      description: >
      fields:
        - name: log
          type: group
          description: >
            Redis log files
          fields:
            - name: pid
              type: long
              description: >
                The process ID of the Redis server.
            - name: role
              type: keyword
              description: >
                The role of the Redis instance. Can be one of `master`, `slave`, `child` (for RDF/AOF writing child),
                or `sentinel`.
            - name: level
              type: keyword
              description: >
                The log level. Can be one of `debug`, `verbose`, `notice`, or `warning`.
            - name: message
              type: text
              description: >
                The log message
        - name: slowlog
          type: group
          description: >
            Slow logs are retrieved from Redis via a network connection.
          fields:
            - name: cmd
              type: keyword
              description: >
                The command executed.
            - name: duration.us
              type: long
              description: >
                How long it took to execute the command in microseconds.
            - name: id
              type: long
              description: >
                The ID of the query.
            - name: key
              type: keyword
              description: >
                The key on which the command was executed.
            - name: args
              type: keyword
              description: >
                The arguments with which the command was called.
- key: system
  title: "System"
  description: >
    Module for parsing system log files.
  short_config: true
  fields:
    - name: system
      type: group
      description: >
        Fields from the system log files.
      fields:
        - name: auth
          type: group
          description: >
            Fields from the Linux authorization logs.
          fields:
            - name: timestamp
              description: >
                The timestamp as read from the auth message.
            - name: hostname
              description: >
                The hostname as read from the auth message.
            - name: program
              description: >
                The process name as read from the auth message.
            - name: pid
              type: long
              description: >
                The PID of the process that sent the auth message.
            - name: message
              type: text
              description: >
                The message in the log line.
            - name: user
              description: >
                The Unix user that this event refers to.
        
            - name: ssh
              type: group
              description: >
                Fields specific to SSH login events.
              fields:
              - name: event
                description: >
                  The SSH login event. Can be one of "Accepted", "Failed", or "Invalid". "Accepted"
                  means a successful login. "Invalid" means that the user is not configured on the
                  system. "Failed" means that the SSH login attempt has failed.
              - name: method
                description: >
                  The SSH authentication method. Can be one of "password" or "publickey".
              - name: ip
                type: ip
                description: >
                  The client IP from where the login attempt was made.
              - name: dropped_ip
                type: ip
                description: >
                  The client IP from SSH connections that are open and immediately dropped.
              - name: port
                type: long
                description: >
                  The client port from where the login attempt was made.
              - name: signature
                description: >
                  The signature of the client public key.
              - name: geoip
                type: group
                description: >
                  Contains GeoIP information gathered based on the `system.auth.ip` field.
                  Only present if the GeoIP Elasticsearch plugin is available and
                  used.
                fields:
                  - name: continent_name
                    type: keyword
                    description: >
                      The name of the continent.
                  - name: city_name
                    type: keyword
                    description: >
                      The name of the city.
                  - name: region_name
                    type: keyword
                    description: >
                      The name of the region.
                  - name: country_iso_code
                    type: keyword
                    description: >
                      Country ISO code.
                  - name: location
                    type: geo_point
                    description: >
                      The longitude and latitude.
                  - name: region_iso_code
                    type: keyword
                    description: >
                      Region ISO code.
            - name: sudo
              type: group
              description: >
                Fields specific to events created by the `sudo` command.
              fields:
              - name: error
                example: user NOT in sudoers
                description: >
                  The error message in case the sudo command failed.
              - name: tty
                description: >
                  The TTY where the sudo command is executed.
              - name: pwd
                description: >
                  The current directory where the sudo command is executed.
              - name: user
                example: root
                description: >
                  The target user to which the sudo command is switching.
              - name: command
                description: >
                  The command executed via sudo.
        
            - name: useradd
              type: group
              description: >
                Fields specific to events created by the `useradd` command.
              fields:
              - name: name
                description: >
                  The user name being added.
              - name: uid
                type: long
                description:
                  The user ID.
              - name: gid
                type: long
                description:
                  The group ID.
              - name: home
                description:
                  The home folder for the new user.
              - name: shell
                description:
                  The default shell for the new user.
        
            - name: groupadd
              type: group
              description: >
                Fields specific to events created by the `groupadd` command.
              fields:
              - name: name
                description: >
                  The name of the new group.
              - name: gid
                type: long
                description: >
                  The ID of the new group.
        - name: syslog
          type: group
          description: >
            Contains fields from the syslog system logs.
          fields:
            - name: timestamp
              description: >
                The timestamp as read from the syslog message.
            - name: hostname
              description: >
                The hostname as read from the syslog message.
            - name: program
              description: >
                The process name as read from the syslog message.
            - name: pid
              description: >
                The PID of the process that sent the syslog message.
            - name: message
              type: text
              description: >
                The message in the log line.
- key: traefik
  title: "Traefik"
  description: >
    Module for parsing the Traefik log files.
  fields:
    - name: traefik
      type: group
      description: >
        Fields from the Traefik log files.
      fields:
        - name: access
          type: group
          description: >
            Contains fields for the Traefik access logs.
          fields:
            - name: remote_ip
              type: keyword
              description: >
                Client IP address.
            - name: user_name
              type: keyword
              description: >
                The user name used when basic authentication is used.
            - name: method
              type: keyword
              example: GET
              description: >
                The request HTTP method.
            - name: url
              type: keyword
              description: >
                The request HTTP URL.
            - name: http_version
              type: keyword
              description: >
                The HTTP version.
            - name: response_code
              type: long
              description: >
                The HTTP response code.
            - name: body_sent.bytes
              type: long
              format: bytes
              description: >
                The number of bytes of the server response body.
            - name: referrer
              type: keyword
              description: >
                The HTTP referrer.
            - name: agent
              type: text
              description: >
                Contains the un-parsed user agent string. Only present if the user
                agent Elasticsearch plugin is not available or not used.
            - name: user_agent
              type: group
              description: >
                Contains the parsed User agent field. Only present if the user
                agent Elasticsearch plugin is available and used.
              fields:
                - name: device
                  type: keyword
                  description: >
                    The name of the physical device.
                - name: major
                  type: long
                  description: >
                    The major version of the user agent.
                - name: minor
                  type: long
                  description: >
                    The minor version of the user agent.
                - name: patch
                  type: keyword
                  description: >
                    The patch version of the user agent.
                - name: name
                  type: keyword
                  example: Chrome
                  description: >
                    The name of the user agent.
                - name: os
                  type: keyword
                  description: >
                    The name of the operating system.
                - name: os_major
                  type: long
                  description: >
                    The major version of the operating system.
                - name: os_minor
                  type: long
                  description: >
                    The minor version of the operating system.
                - name: os_name
                  type: keyword
                  description: >
                    The name of the operating system.
                - name: original
                  type: text
                  index: false
                  description: >
                    Original user agent value before parsing by ingest-user-agent plugin.
            - name: geoip
              type: group
              description: >
                Contains GeoIP information gathered based on the remote_ip field.
                Only present if the GeoIP Elasticsearch plugin is available and
                used.
              fields:
                - name: continent_name
                  type: keyword
                  description: >
                    The name of the continent.
                - name: country_iso_code
                  type: keyword
                  description: >
                    Country ISO code.
                - name: location
                  type: geo_point
                  description: >
                    The longitude and latitude.
                - name: region_name
                  type: keyword
                  description: >
                    The region name.
                - name: city_name
                  type: keyword
                  description: >
                    The city name.
                - name: region_iso_code
                  type: keyword
                  description: >
                    Region ISO code.
            - name: request_count
              type: long
              description: >
                The number of requests
            - name: frontend_name
              type: text
              description: >
                The name of the frontend used
            - name: backend_url
              type: text
              description:
                The url of the backend where request is forwarded
- key: suricata
  title: Suricata
  description: >
    Module for handling the EVE JSON logs produced by Suricata.
  fields:
    - name: suricata
      type: group
      description: >
        Fields from the Suricata EVE log file.
      fields:
        - name: eve
          type: group
          description: >
            Fields exported by the EVE JSON logs
          fields:
            - name: event_type
              type: keyword
        
            - name: app_proto_orig
              type: keyword
        
            - name: tcp
              type: group
              fields:
              - name: tcp_flags
                type: keyword
        
              - name: psh
                type: boolean
        
              - name: tcp_flags_tc
                type: keyword
        
              - name: ack
                type: boolean
        
              - name: syn
                type: boolean
        
              - name: state
                type: keyword
        
              - name: tcp_flags_ts
                type: keyword
        
              - name: rst
                type: boolean
        
              - name: fin
                type: boolean
        
            - name: fileinfo
              type: group
              fields:
              - name: sha1
                type: keyword
        
              - name: filename
                type: keyword
        
              - name: tx_id
                type: long
        
              - name: state
                type: keyword
        
              - name: stored
                type: boolean
        
              - name: gaps
                type: boolean
        
              - name: sha256
                type: keyword
        
              - name: md5
                type: keyword
        
              - name: size
                type: long
        
            - name: icmp_type
              type: long
        
            - name: dest_port
              type: long
        
            - name: src_port
              type: long
        
            - name: proto
              type: keyword
        
            - name: pcap_cnt
              type: long
        
            - name: src_ip
              type: ip
        
            - name: dns
              type: group
              fields:
              - name: type
                type: keyword
        
              - name: rrtype
                type: keyword
        
              - name: rrname
                type: keyword
        
              - name: rdata
                type: keyword
        
              - name: tx_id
                type: long
        
              - name: ttl
                type: long
        
              - name: rcode
                type: keyword
        
              - name: id
                type: long
        
            - name: flow_id
              type: keyword
        
            - name: email
              type: group
              fields:
              - name: status
                type: keyword
        
            - name: dest_ip
              type: ip
        
            - name: icmp_code
              type: long
        
            - name: http
              type: group
              fields:
              - name: status
                type: long
        
              - name: redirect
                type: keyword
        
              - name: http_user_agent
                type: keyword
        
              - name: protocol
                type: keyword
        
              - name: http_refer
                type: keyword
        
              - name: url
                type: keyword
        
              - name: hostname
                type: keyword
        
              - name: length
                type: long
        
              - name: http_method
                type: keyword
        
              - name: http_content_type
                type: keyword
        
            - name: timestamp
              type: date
        
            - name: in_iface
              type: keyword
        
            - name: alert
              type: group
              fields:
              - name: category
                type: keyword
        
              - name: severity
                type: long
        
              - name: rev
                type: long
        
              - name: gid
                type: long
        
              - name: signature
                type: keyword
        
              - name: action
                type: keyword
        
              - name: signature_id
                type: long
        
            - name: ssh
              type: group
              fields:
              - name: client
                type: group
                fields:
                - name: proto_version
                  type: keyword
        
                - name: software_version
                  type: keyword
        
              - name: server
                type: group
                fields:
                - name: proto_version
                  type: keyword
        
                - name: software_version
                  type: keyword
        
            - name: stats
              type: group
              fields:
              - name: capture
                type: group
                fields:
                - name: kernel_packets
                  type: long
        
                - name: kernel_drops
                  type: long
        
                - name: kernel_ifdrops
                  type: long
        
              - name: uptime
                type: long
        
              - name: detect
                type: group
                fields:
                - name: alert
                  type: long
        
              - name: http
                type: group
                fields:
                - name: memcap
                  type: long
        
                - name: memuse
                  type: long
        
              - name: file_store
                type: group
                fields:
                - name: open_files
                  type: long
        
              - name: defrag
                type: group
                fields:
                - name: max_frag_hits
                  type: long
        
                - name: ipv4
                  type: group
                  fields:
                  - name: timeouts
                    type: long
        
                  - name: fragments
                    type: long
        
                  - name: reassembled
                    type: long
        
                - name: ipv6
                  type: group
                  fields:
                  - name: timeouts
                    type: long
        
                  - name: fragments
                    type: long
        
                  - name: reassembled
                    type: long
        
              - name: flow
                type: group
                fields:
                - name: tcp_reuse
                  type: long
        
                - name: udp
                  type: long
        
                - name: memcap
                  type: long
        
                - name: emerg_mode_entered
                  type: long
        
                - name: emerg_mode_over
                  type: long
        
                - name: tcp
                  type: long
        
                - name: icmpv6
                  type: long
        
                - name: icmpv4
                  type: long
        
                - name: spare
                  type: long
        
                - name: memuse
                  type: long
        
              - name: tcp
                type: group
                fields:
                - name: pseudo_failed
                  type: long
        
                - name: ssn_memcap_drop
                  type: long
        
                - name: insert_data_overlap_fail
                  type: long
        
                - name: sessions
                  type: long
        
                - name: pseudo
                  type: long
        
                - name: synack
                  type: long
        
                - name: insert_data_normal_fail
                  type: long
        
                - name: syn
                  type: long
        
                - name: memuse
                  type: long
        
                - name: invalid_checksum
                  type: long
        
                - name: segment_memcap_drop
                  type: long
        
                - name: overlap
                  type: long
        
                - name: insert_list_fail
                  type: long
        
                - name: rst
                  type: long
        
                - name: stream_depth_reached
                  type: long
        
                - name: reassembly_memuse
                  type: long
        
                - name: reassembly_gap
                  type: long
        
                - name: overlap_diff_data
                  type: long
        
                - name: no_flow
                  type: long
        
              - name: decoder
                type: group
                fields:
                - name: avg_pkt_size
                  type: long
        
                - name: bytes
                  type: long
        
                - name: tcp
                  type: long
        
                - name: raw
                  type: long
        
                - name: ppp
                  type: long
        
                - name: vlan_qinq
                  type: long
        
                - name: 'null'
                  type: long
        
                - name: ltnull
                  type: group
                  fields:
                  - name: unsupported_type
                    type: long
        
                  - name: pkt_too_small
                    type: long
        
                - name: invalid
                  type: long
        
                - name: gre
                  type: long
        
                - name: ipv4
                  type: long
        
                - name: ipv6
                  type: long
        
                - name: pkts
                  type: long
        
                - name: ipv6_in_ipv6
                  type: long
        
                - name: ipraw
                  type: group
                  fields:
                  - name: invalid_ip_version
                    type: long
        
                - name: pppoe
                  type: long
        
                - name: udp
                  type: long
        
                - name: dce
                  type: group
                  fields:
                  - name: pkt_too_small
                    type: long
        
                - name: vlan
                  type: long
        
                - name: sctp
                  type: long
        
                - name: max_pkt_size
                  type: long
        
                - name: teredo
                  type: long
        
                - name: mpls
                  type: long
        
                - name: sll
                  type: long
        
                - name: icmpv6
                  type: long
        
                - name: icmpv4
                  type: long
        
                - name: erspan
                  type: long
        
                - name: ethernet
                  type: long
        
                - name: ipv4_in_ipv6
                  type: long
        
                - name: ieee8021ah
                  type: long
        
              - name: dns
                type: group
                fields:
                - name: memcap_global
                  type: long
        
                - name: memcap_state
                  type: long
        
                - name: memuse
                  type: long
        
              - name: flow_mgr
                type: group
                fields:
                - name: rows_busy
                  type: long
        
                - name: flows_timeout
                  type: long
        
                - name: flows_notimeout
                  type: long
        
                - name: rows_skipped
                  type: long
        
                - name: closed_pruned
                  type: long
        
                - name: new_pruned
                  type: long
        
                - name: flows_removed
                  type: long
        
                - name: bypassed_pruned
                  type: long
        
                - name: est_pruned
                  type: long
        
                - name: flows_timeout_inuse
                  type: long
        
                - name: flows_checked
                  type: long
        
                - name: rows_maxlen
                  type: long
        
                - name: rows_checked
                  type: long
        
                - name: rows_empty
                  type: long
        
              - name: app_layer
                type: group
                fields:
                - name: flow
                  type: group
                  fields:
                  - name: tls
                    type: long
        
                  - name: ftp
                    type: long
        
                  - name: http
                    type: long
        
                  - name: failed_udp
                    type: long
        
                  - name: dns_udp
                    type: long
        
                  - name: dns_tcp
                    type: long
        
                  - name: smtp
                    type: long
        
                  - name: failed_tcp
                    type: long
        
                  - name: msn
                    type: long
        
                  - name: ssh
                    type: long
        
                  - name: imap
                    type: long
        
                  - name: dcerpc_udp
                    type: long
        
                  - name: dcerpc_tcp
                    type: long
        
                  - name: smb
                    type: long
        
                - name: tx
                  type: group
                  fields:
                  - name: tls
                    type: long
        
                  - name: ftp
                    type: long
        
                  - name: http
                    type: long
        
                  - name: dns_udp
                    type: long
        
                  - name: dns_tcp
                    type: long
        
                  - name: smtp
                    type: long
        
                  - name: ssh
                    type: long
        
                  - name: dcerpc_udp
                    type: long
        
                  - name: dcerpc_tcp
                    type: long
        
                  - name: smb
                    type: long
        
            - name: tls
              type: group
              fields:
              - name: notbefore
                type: date
        
              - name: issuerdn
                type: keyword
        
              - name: sni
                type: keyword
        
              - name: version
                type: keyword
        
              - name: session_resumed
                type: boolean
        
              - name: fingerprint
                type: keyword
        
              - name: serial
                type: keyword
        
              - name: notafter
                type: date
        
              - name: subject
                type: keyword
        
            - name: app_proto_ts
              type: keyword
        
            - name: flow
              type: group
              fields:
              - name: bytes_toclient
                type: long
        
              - name: start
                type: date
        
              - name: pkts_toclient
                type: long
        
              - name: age
                type: long
        
              - name: state
                type: keyword
        
              - name: bytes_toserver
                type: long
        
              - name: reason
                type: keyword
        
              - name: pkts_toserver
                type: long
        
              - name: end
                type: date
        
              - name: alerted
                type: boolean
        
            - name: app_proto
              type: keyword
        
            - name: tx_id
              type: long
        
            - name: app_proto_tc
              type: keyword
        
            - name: smtp
              type: group
              fields:
              - name: rcpt_to
                type: keyword
        
              - name: mail_from
                type: keyword
        
              - name: helo
                type: keyword
        
            - name: app_proto_expected
              type: keyword
        
            - name: flags
              type: group
              fields:
