- key: common
  title: "Common heartbeat monitor"
  description:
  fields:
    - name: event
      type: group
      description: Used for context information about the log or metric event itself.
      fields:
        - name: dataset
          type: keyword
          description: Name of the dataset.

    - name: monitor
      type: group
      description: >
        Common monitor fields.

      fields:
        - name: type
          type: keyword
          description: >
            The monitor type.

        - name: name
          type: keyword
          description: >
            The monitors configured name

        - name: id
          type: keyword
          description: >
            The monitors full job ID as used by heartbeat.

        - name: duration
          type: group
          description: Total monitoring test duration
          fields:
            - name: us
              type: long
              description: Duration in microseconds

        - name: scheme
          type: keyword
          description: >
            Address url scheme. For example `tcp`, `tls`, `http`, and `https`.

        - name: host
          type: keyword
          description: >
            Hostname of service being monitored. Can be missing, if service is
            monitored by IP.

        - name: ip
          type: ip
          description: >
            IP of service being monitored. If service is monitored by hostname,
            the `ip` field contains the resolved ip address for the current host.

        - name: status
          required: true
          type: keyword
          description: >
            Indicator if monitor could validate the service to be available.

- key: resolve
  title: "Host lookup"
  description:
  fields:
    - name: resolve
      type: group
      description: >
        Host lookup fields.
      fields:
        - name: host
          type: keyword
          description: >
            Hostname of service being monitored.

        - name: ip
          type: ip
          description: >
            IP address found for the given host.

        - name: rtt
          type: group
          description: Duration required to resolve an IP from hostname.
          fields:
            - name: us
              type: long
              description: Duration in microseconds


- key: beat
  title: Beat
  description: >
    Contains common beat fields available in all event types.
  fields:

    - name: beat.name
      description: >
        The name of the Beat sending the log messages. If the Beat name is
        set in the configuration file, then that value is used. If it is not
        set, the hostname is used. To set the Beat name, use the `name`
        option in the configuration file.
    - name: beat.hostname
      description: >
        The hostname as returned by the operating system on which the Beat is
        running.
    - name: beat.timezone
      description: >
        The timezone as returned by the operating system on which the Beat is
        running.
    - name: beat.version
      description: >
        The version of the beat that generated this event.

    - name: "@timestamp"
      type: date
      required: true
      format: date
      example: August 26th 2016, 12:35:53.332
      description: >
        The timestamp when the event log record was generated.

    - name: tags
      description: >
        Arbitrary tags that can be set per Beat and per transaction
        type.

    - name: fields
      type: object
      object_type: keyword
      description: >
        Contains user configurable fields.

    - name: error
      type: group
      description: >
        Error fields containing additional info in case of errors.
      fields:
        - name: message
          type: text
          description: >
            Error message.
        - name: code
          type: long
          description: >
            Error code.
        - name: type
          type: keyword
          description: >
            Error type.

- key: alias
  title: Alias
  description: >
    Alias fields for compatibility with 7.x.
  fields:
    # Common Beats fields
    - name: host.hostname
      type: alias
      path: beat.hostname
    - name: event.timezone
      type: alias
      path: beat.timezone

    # Cloud processor fields
    - name: cloud.provider
      type: alias
      path: meta.cloud.provider
    - name: cloud.instance.id
      type: alias
      path: meta.cloud.instance_id
    - name: cloud.instance.name
      type: alias
      path: meta.cloud.instance_name
    - name: cloud.machine.type
      type: alias
      path: meta.cloud.machine_type
    - name: cloud.availability_zone
      type: alias
      path: meta.cloud.availability_zone
    - name: cloud.project.id
      type: alias
      path: meta.cloud.project_id
    - name: cloud.region
      type: alias
      path: meta.cloud.region

    # Docker processor fields
    - name: container.id
      type: alias
      path: docker.container.id
    - name: container.name
      type: alias
      path: docker.container.name
    - name: container.image.name
      type: alias
      path: docker.container.image
- key: cloud
  title: Cloud provider metadata
  description: >
    Metadata from cloud providers added by the add_cloud_metadata processor.
  fields:

    - name: meta.cloud.provider
      example: ec2
      description: >
        Name of the cloud provider. Possible values are ec2, gce, or digitalocean.

    - name: meta.cloud.instance_id
      description: >
        Instance ID of the host machine.

    - name: meta.cloud.instance_name
      description: >
        Instance name of the host machine.

    - name: meta.cloud.machine_type
      example: t2.medium
      description: >
        Machine type of the host machine.

    - name: meta.cloud.availability_zone
      example: us-east-1c
      description: >
        Availability zone in which this host is running.

    - name: meta.cloud.project_id
      example: project-x
      description: >
        Name of the project in Google Cloud.

    - name: meta.cloud.region
      description: >
        Region in which this host is running.
- key: docker
  title: Docker
  description: >
    Docker stats collected from Docker.
  short_config: false
  anchor: docker-processor
  fields:
    - name: docker
      type: group
      fields:
        - name: container.id
          type: keyword
          description: >
            Unique container id.
        - name: container.image
          type: keyword
          description: >
            Name of the image the container was built on.
        - name: container.name
          type: keyword
          description: >
            Container name.
        - name: container.labels
          type: object
          object_type: keyword
          description: >
            Image labels.
- key: host
  title: Host
  description: >
    Info collected for the host machine.
  anchor: host-processor
  fields:
    - name: host
      type: group
      fields:
        - name: name
          type: keyword
          description: >
            Hostname.
        - name: id
          type: keyword
          description: >
            Unique host id.
        - name: architecture
          type: keyword
          description: >
            Host architecture (e.g. x86_64, arm, ppc, mips).
        - name: containerized
          type: boolean
          description: >
            If the host is a container.
        - name: os.platform
          type: keyword
          description: >
            OS platform (e.g. centos, ubuntu, windows).
        - name: os.name
          type: keyword
          description: >
            Operating system name (e.g. "Mac OS X").
        - name: os.build
          type: keyword
          description: >
            OS build information (e.g. "18D109").
        - name: os.version
          type: keyword
          description: >
            OS version.
        - name: os.family
          type: keyword
          description: >
            OS family (e.g. redhat, debian, freebsd, windows).
        - name: ip
          type: ip
          description: >
            List of IP-addresses.
        - name: mac
          type: keyword
          description: >
            List of hardware-addresses, usually MAC-addresses.
- key: kubernetes
  title: Kubernetes
  description: >
    Kubernetes metadata added by the kubernetes processor
  short_config: false
  anchor: kubernetes-processor
  fields:
    - name: kubernetes
      type: group
      fields:
        - name: pod.name
          type: keyword
          description: >
            Kubernetes pod name

        - name: pod.uid
          type: keyword
          description: >
            Kubernetes Pod UID

        - name: namespace
          type: keyword
          description: >
            Kubernetes namespace

        - name: node.name
          type: keyword
          description: >
            Kubernetes node name

        - name: labels
          type: object
          description: >
            Kubernetes labels map

        - name: annotations
          type: object
          description: >
            Kubernetes annotations map

        - name: container.name
          type: keyword
          description: >
            Kubernetes container name

        - name: container.image
          type: keyword
          description: >
            Kubernetes container image
- key: socks5
  title: "SOCKS5 proxy"
  description:
  fields:
    - name: socks5
      type: group
      description: >
        SOCKS5 proxy related fields:
      fields:
        - name: rtt
          type: group
          description: >
            TLS layer round trip times.
          fields:
            - name: connect
              type: group
              description: >
                Time required to establish a connection via SOCKS5 to endpoint
                based on available connection to SOCKS5 proxy.
              fields:
                - name: us
                  type: long
                  description: Duration in microseconds


- key: tls
  title: "TLS encryption layer"
  description:
  fields:
    - name: tls
      type: group
      description: >
        TLS layer related fields.
      fields:
        - name: certificate_not_valid_before
          type: date
          description: Earliest time at which the connection's certificates are valid.
        - name: certificate_not_valid_after
          type: date
          description: Latest time at which the connection's certificates are valid.
        - name: rtt
          type: group
          description: >
            TLS layer round trip times.
          fields:
            - name: handshake
              type: group
              description: >
                Time required to finish TLS handshake based on already available network
                connection.
              fields:
                - name: us
                  type: long
                  description: Duration in microseconds

- key: http
  title: "HTTP monitor"
  description:
  fields:
    - name: http
      type: group
      description: >
        HTTP related fields.
      fields:
        - name: url
          type: text
          description: >
            Service url used by monitor.
          multi_fields:
          - name: raw
            type: keyword
            description: >
              The service url used by monitor. This is a non-analyzed field that is useful
              for aggregations.

        - name: response
          type: group
          description: >
            Service response parameters.
          fields:
            - name: status_code
              type: integer
              description: >
                Response status code.
        - name: rtt
          type: group
          description: >
            HTTP layer round trip times.
          fields:
            - name: validate
              type: group
              description: |
                Duration between first byte of HTTP request being written and
                response being processed by validator. Duration based on already
                available network connection.

                Note: if validator is not reading body or only a prefix, this
                      number does not fully represent the total time needed
                      to read the body.
              fields:
                - name: us
                  type: long
                  description: Duration in microseconds

            - name: validate_body
              type: group
              description: |
                Duration of validator required to read and validate the response
                body.

                Note: if validator is not reading body or only a prefix, this
                      number does not fully represent the total time needed
                      to read the body.
              fields:
                - name: us
                  type: long
                  description: Duration in microseconds

            - name: write_request
              type: group
              description:
                Duration of sending the complete HTTP request. Duration based on
                already available network connection.
              fields:
                - name: us
                  type: long
                  description: Duration in microseconds

            - name: response_header
              type: group
              description:
                Time required between sending the start of sending the HTTP
                request and first byte from HTTP response being read. Duration
                based on already available network connection.
              fields:
                - name: us
                  type: long
                  description: Duration in microseconds

            - name: content.us
              type: long
              description:
                Time required to retrieved the content in micro seconds.

            - name: total
              type: group
              description: |
                Duration required to process the HTTP transaction. Starts with
                the initial TCP connection attempt. Ends with after validator
                did check the response.

                Note: if validator is not reading body or only a prefix, this
                      number does not fully represent the total time needed.
              fields:
                - name: us
                  type: long
                  description: Duration in microseconds
- key: icmp
  title: "ICMP"
  description:
  fields:
    - name: icmp
      type: group
      description: >
        IP ping fields.
      fields:
        - name: requests
          type: integer
          description: >
            Number if ICMP EchoRequests send.

        - name: rtt
          type: group
          description: ICMP Echo Request and Reply round trip time
          fields:
            - name: us
              type: long
              description: Duration in microseconds
- key: tcp
  title: "TCP layer"
  description:
  fields:
    - name: tcp
      type: group
      description: >
        TCP network layer related fields.
      fields:
        - name: port
          type: integer
          description: >
            Service port number.

        - name: rtt
          type: group
          description: >
            TCP layer round trip times.
          fields:
            - name: connect
              type: group
              description: >
                Duration required to establish a TCP connection based on already
                available IP address.
              fields:
                - name: us
                  type: long
                  description: Duration in microseconds

            - name: validate
              type: group
              description: >
                Duration of validation step based on existing TCP connection.
              fields:
                - name: us
                  type: long
                  description: Duration in microseconds
