# WARNING! Do not edit this file directly, it was generated by the ECS project,
# based on ECS version 8.0.0-dev.
# Please visit https://github.com/elastic/ecs to suggest changes to ECS fields.

- key: ecs
  title: ECS
  description: ECS Fields.
  fields:
  - name: '@timestamp'
    level: core
    required: true
    type: date
    description: 'Date/time when the event originated.

      This is the date/time extracted from the event, typically representing when
      the event was generated by the source.

      If the event source has no original timestamp, this value is typically populated
      by the first time the event was received by the pipeline.

      Required field for all events.'
    example: '2016-05-23T08:05:34.853Z'
    default_field: true
  - name: labels
    level: core
    type: object
    object_type: keyword
    description: 'Custom key/value pairs.

      Can be used to add meta information to events. Should not contain nested objects.
      All values are stored as keyword.

      Example: `docker` and `k8s` labels.'
    example: '{"application": "foo-bar", "env": "production"}'
    default_field: true
  - name: message
    level: core
    type: match_only_text
    description: 'For log events the message field contains the log message, optimized
      for viewing in a log viewer.

      For structured logs without an original message field, other fields can be concatenated
      to form a human-readable summary of the event.

      If multiple messages exist, they can be combined into one message.'
    example: Hello World
    default_field: true
  - name: tags
    level: core
    type: keyword
    ignore_above: 1024
    description: List of keywords used to tag each event.
    example: '["production", "env2"]'
    default_field: true
  - name: agent
    title: Agent
    group: 2
    description: 'The agent fields contain the data about the software entity, if
      any, that collects, detects, or observes events on a host, or takes measurements
      on a host.

      Examples include Beats. Agents may also run on observers. ECS agent.* fields
      shall be populated with details of the agent running on the host or observer
      where the event happened or the measurement was taken.'
    footnote: 'Examples: In the case of Beats for logs, the agent.name is filebeat.
      For APM, it is the agent running in the app/service. The agent information does
      not change if data is sent through queuing systems like Kafka, Redis, or processing
      systems such as Logstash or APM Server.'
    type: group
    default_field: true
    fields:
    - name: build.original
      level: core
      type: keyword
      ignore_above: 1024
      description: 'Extended build information for the agent.

        This field is intended to contain any build information that a data source
        may provide, no specific formatting is required.'
      example: metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c
        built 2020-02-05 23:10:10 +0000 UTC]
      default_field: false
    - name: ephemeral_id
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Ephemeral identifier of this agent (if one exists).

        This id normally changes across restarts, but `agent.id` does not.'
      example: 8a4f500f
    - name: id
      level: core
      type: keyword
      ignore_above: 1024
      description: 'Unique identifier of this agent (if one exists).

        Example: For Beats this would be beat.id.'
      example: 8a4f500d
    - name: name
      level: core
      type: keyword
      ignore_above: 1024
      description: 'Custom name of the agent.

        This is a name that can be given to an agent. This can be helpful if for example
        two Filebeat instances are running on the same host but a human readable separation
        is needed on which Filebeat instance data is coming from.

        If no name is given, the name is often left empty.'
      example: foo
    - name: type
      level: core
      type: keyword
      ignore_above: 1024
      description: 'Type of the agent.

        The agent type always stays the same and should be given by the agent used.
        In case of Filebeat the agent would always be Filebeat also if two Filebeat
        instances are run on the same machine.'
      example: filebeat
    - name: version
      level: core
      type: keyword
      ignore_above: 1024
      description: Version of the agent.
      example: 6.0.0-rc2
  - name: as
    title: Autonomous System
    group: 2
    description: An autonomous system (AS) is a collection of connected Internet Protocol
      (IP) routing prefixes under the control of one or more network operators on
      behalf of a single administrative entity or domain that presents a common, clearly
      defined routing policy to the internet.
    type: group
    default_field: true
    fields:
    - name: number
      level: extended
      type: long
      description: Unique number allocated to the autonomous system. The autonomous
        system number (ASN) uniquely identifies each network on the Internet.
      example: 15169
    - name: organization.name
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: match_only_text
        default_field: false
      description: Organization name.
      example: Google LLC
  - name: client
    title: Client
    group: 2
    description: 'A client is defined as the initiator of a network connection for
      events regarding sessions, connections, or bidirectional flow records.

      For TCP events, the client is the initiator of the TCP connection that sends
      the SYN packet(s). For other protocols, the client is generally the initiator
      or requestor in the network transaction. Some systems use the term "originator"
      to refer the client in TCP connections. The client fields describe details about
      the system acting as the client in the network event. Client fields are usually
      populated in conjunction with server fields. Client fields are generally not
      populated for packet-level events.

      Client / server representations can add semantic context to an exchange, which
      is helpful to visualize the data in certain situations. If your context falls
      in that category, you should still ensure that source and destination are filled
      appropriately.'
    type: group
    default_field: true
    fields:
    - name: address
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Some event client addresses are defined ambiguously. The event
        will sometimes list an IP, a domain or a unix socket.  You should always store
        the raw address in the `.address` field.

        Then it should be duplicated to `.ip` or `.domain`, depending on which one
        it is.'
    - name: as.number
      level: extended
      type: long
      description: Unique number allocated to the autonomous system. The autonomous
        system number (ASN) uniquely identifies each network on the Internet.
      example: 15169
    - name: as.organization.name
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: match_only_text
        default_field: false
      description: Organization name.
      example: Google LLC
    - name: bytes
      level: core
      type: long
      format: bytes
      description: Bytes sent from the client to the server.
      example: 184
    - name: domain
      level: core
      type: keyword
      ignore_above: 1024
      description: 'The domain name of the client system.

        This value may be a host name, a fully qualified domain name, or another host
        naming format. The value may derive from the original event or be added from
        enrichment.'
      example: foo.example.com
    - name: geo.city_name
      level: core
      type: keyword
      ignore_above: 1024
      description: City name.
      example: Montreal
    - name: geo.continent_code
      level: core
      type: keyword
      ignore_above: 1024
      description: Two-letter code representing continent's name.
      example: NA
      default_field: false
    - name: geo.continent_name
      level: core
      type: keyword
      ignore_above: 1024
      description: Name of the continent.
      example: North America
    - name: geo.country_iso_code
      level: core
      type: keyword
      ignore_above: 1024
      description: Country ISO code.
      example: CA
    - name: geo.country_name
      level: core
      type: keyword
      ignore_above: 1024
      description: Country name.
      example: Canada
    - name: geo.location
      level: core
      type: geo_point
      description: Longitude and latitude.
      example: '{ "lon": -73.614830, "lat": 45.505918 }'
    - name: geo.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'User-defined description of a location, at the level of granularity
        they care about.

        Could be the name of their data centers, the floor number, if this describes
        a local physical entity, city names.

        Not typically used in automated geolocation.'
      example: boston-dc
    - name: geo.postal_code
      level: core
      type: keyword
      ignore_above: 1024
      description: 'Postal code associated with the location.

        Values appropriate for this field may also be known as a postcode or ZIP code
        and will vary widely from country to country.'
      example: 94040
      default_field: false
    - name: geo.region_iso_code
      level: core
      type: keyword
      ignore_above: 1024
      description: Region ISO code.
      example: CA-QC
    - name: geo.region_name
      level: core
      type: keyword
      ignore_above: 1024
      description: Region name.
      example: Quebec
    - name: geo.timezone
      level: core
      type: keyword
      ignore_above: 1024
      description: The time zone of the location, such as IANA time zone name.
      example: America/Argentina/Buenos_Aires
      default_field: false
    - name: ip
      level: core
      type: ip
      description: IP address of the client (IPv4 or IPv6).
    - name: mac
      level: core
      type: keyword
      ignore_above: 1024
      description: 'MAC address of the client.

        The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit
        byte) is represented by two [uppercase] hexadecimal digits giving the value
        of the octet as an unsigned integer. Successive octets are separated by a
        hyphen.'
      example: 00-00-5E-00-53-23
    - name: nat.ip
      level: extended
      type: ip
      description: 'Translated IP of source based NAT sessions (e.g. internal client
        to internet).

        Typically connections traversing load balancers, firewalls, or routers.'
    - name: nat.port
      level: extended
      type: long
      format: string
      description: 'Translated port of source based NAT sessions (e.g. internal client
        to internet).

        Typically connections traversing load balancers, firewalls, or routers.'
    - name: packets
      level: core
      type: long
      description: Packets sent from the client to the server.
      example: 12
    - name: port
      level: core
      type: long
      format: string
      description: Port of the client.
    - name: registered_domain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The highest registered client domain, stripped of the subdomain.

        For example, the registered domain for "foo.example.com" is "example.com".

        This value can be determined precisely with a list like the public suffix
        list (http://publicsuffix.org). Trying to approximate this by simply taking
        the last two labels will not work well for TLDs such as "co.uk".'
      example: example.com
    - name: subdomain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The subdomain portion of a fully qualified domain name includes
        all of the names except the host name under the registered_domain.  In a partially
        qualified domain, or if the the qualification level of the full name cannot
        be determined, subdomain contains all of the names below the registered domain.

        For example the subdomain portion of "www.east.mydomain.co.uk" is "east".
        If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com",
        the subdomain field should contain "sub2.sub1", with no trailing period.'
      example: east
      default_field: false
    - name: top_level_domain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The effective top level domain (eTLD), also known as the domain
        suffix, is the last part of the domain name. For example, the top level domain
        for example.com is "com".

        This value can be determined precisely with a list like the public suffix
        list (http://publicsuffix.org). Trying to approximate this by simply taking
        the last label will not work well for effective TLDs such as "co.uk".'
      example: co.uk
    - name: user.domain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Name of the directory the user is a member of.

        For example, an LDAP or Active Directory domain name.'
    - name: user.email
      level: extended
      type: keyword
      ignore_above: 1024
      description: User email address.
    - name: user.full_name
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: match_only_text
        default_field: false
      description: User's full name, if available.
      example: Albert Einstein
    - name: user.group.domain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Name of the directory the group is a member of.

        For example, an LDAP or Active Directory domain name.'
    - name: user.group.id
      level: extended
      type: keyword
      ignore_above: 1024
      description: Unique identifier for the group on the system/platform.
    - name: user.group.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Name of the group.
    - name: user.hash
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Unique user hash to correlate information for a user in anonymized
        form.

        Useful if `user.id` or `user.name` contain confidential information and cannot
        be used.'
    - name: user.id
      level: core
      type: keyword
      ignore_above: 1024
      description: Unique identifier of the user.
      example: S-1-5-21-202424912787-2692429404-2351956786-1000
    - name: user.name
      level: core
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: match_only_text
        default_field: false
      description: Short name or login of the user.
      example: a.einstein
    - name: user.roles
      level: extended
      type: keyword
      ignore_above: 1024
      description: Array of user roles at the time of the event.
      example: '["kibana_admin", "reporting_user"]'
      default_field: false
  - name: cloud
    title: Cloud
    group: 2
    description: Fields related to the cloud or infrastructure the events are coming
      from.
    footnote: 'Examples: If Metricbeat is running on an EC2 host and fetches data
      from its host, the cloud info contains the data about this machine. If Metricbeat
      runs on a remote machine outside the cloud and fetches data from a service running
      in the cloud, the field contains cloud data from the machine the service is
      running on.

      The cloud fields may be self-nested under cloud.origin.* and cloud.target.*  to
      describe origin or target service''s cloud information in the context of  incoming
      or outgoing requests, respectively. However, the fieldsets  cloud.origin.* and
      cloud.target.* must not be confused with the root cloud  fieldset that is used
      to describe the cloud context of the actual service  under observation. The
      fieldset cloud.origin.* may only be used in the  context of incoming requests
      or events to provide the originating service''s  cloud information. The fieldset
      cloud.target.* may only be used in the  context of outgoing requests or events
      to describe the target service''s  cloud information.'
    type: group
    default_field: true
    fields:
    - name: account.id
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The cloud account or organization id used to identify different
        entities in a multi-tenant environment.

        Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.'
      example: 666777888999
    - name: account.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The cloud account name or alias used to identify different entities
        in a multi-tenant environment.

        Examples: AWS account name, Google Cloud ORG display name.'
      example: elastic-dev
      default_field: false
    - name: availability_zone
      level: extended
      type: keyword
      ignore_above: 1024
      description: Availability zone in which this host, resource, or service is located.
      example: us-east-1c
    - name: instance.id
      level: extended
      type: keyword
      ignore_above: 1024
      description: Instance ID of the host machine.
      example: i-1234567890abcdef0
    - name: instance.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Instance name of the host machine.
    - name: machine.type
      level: extended
      type: keyword
      ignore_above: 1024
      description: Machine type of the host machine.
      example: t2.medium
    - name: origin.account.id
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The cloud account or organization id used to identify different
        entities in a multi-tenant environment.

        Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.'
      example: 666777888999
      default_field: false
    - name: origin.account.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The cloud account name or alias used to identify different entities
        in a multi-tenant environment.

        Examples: AWS account name, Google Cloud ORG display name.'
      example: elastic-dev
      default_field: false
    - name: origin.availability_zone
      level: extended
      type: keyword
      ignore_above: 1024
      description: Availability zone in which this host, resource, or service is located.
      example: us-east-1c
      default_field: false
    - name: origin.instance.id
      level: extended
      type: keyword
      ignore_above: 1024
      description: Instance ID of the host machine.
      example: i-1234567890abcdef0
      default_field: false
    - name: origin.instance.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Instance name of the host machine.
      default_field: false
    - name: origin.machine.type
      level: extended
      type: keyword
      ignore_above: 1024
      description: Machine type of the host machine.
      example: t2.medium
      default_field: false
    - name: origin.project.id
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The cloud project identifier.

        Examples: Google Cloud Project id, Azure Project id.'
      example: my-project
      default_field: false
    - name: origin.project.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The cloud project name.

        Examples: Google Cloud Project name, Azure Project name.'
      example: my project
      default_field: false
    - name: origin.provider
      level: extended
      type: keyword
      ignore_above: 1024
      description: Name of the cloud provider. Example values are aws, azure, gcp,
        or digitalocean.
      example: aws
      default_field: false
    - name: origin.region
      level: extended
      type: keyword
      ignore_above: 1024
      description: Region in which this host, resource, or service is located.
      example: us-east-1
      default_field: false
    - name: origin.service.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The cloud service name is intended to distinguish services running
        on different platforms within a provider, eg AWS EC2 vs Lambda, GCP GCE vs
        App Engine, Azure VM vs App Server.

        Examples: app engine, app service, cloud run, fargate, lambda.'
      example: lambda
      default_field: false
    - name: project.id
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The cloud project identifier.

        Examples: Google Cloud Project id, Azure Project id.'
      example: my-project
      default_field: false
    - name: project.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The cloud project name.

        Examples: Google Cloud Project name, Azure Project name.'
      example: my project
      default_field: false
    - name: provider
      level: extended
      type: keyword
      ignore_above: 1024
      description: Name of the cloud provider. Example values are aws, azure, gcp,
        or digitalocean.
      example: aws
    - name: region
      level: extended
      type: keyword
      ignore_above: 1024
      description: Region in which this host, resource, or service is located.
      example: us-east-1
    - name: service.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The cloud service name is intended to distinguish services running
        on different platforms within a provider, eg AWS EC2 vs Lambda, GCP GCE vs
        App Engine, Azure VM vs App Server.

        Examples: app engine, app service, cloud run, fargate, lambda.'
      example: lambda
      default_field: false
    - name: target.account.id
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The cloud account or organization id used to identify different
        entities in a multi-tenant environment.

        Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.'
      example: 666777888999
      default_field: false
    - name: target.account.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The cloud account name or alias used to identify different entities
        in a multi-tenant environment.

        Examples: AWS account name, Google Cloud ORG display name.'
      example: elastic-dev
      default_field: false
    - name: target.availability_zone
      level: extended
      type: keyword
      ignore_above: 1024
      description: Availability zone in which this host, resource, or service is located.
      example: us-east-1c
      default_field: false
    - name: target.instance.id
      level: extended
      type: keyword
      ignore_above: 1024
      description: Instance ID of the host machine.
      example: i-1234567890abcdef0
      default_field: false
    - name: target.instance.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Instance name of the host machine.
      default_field: false
    - name: target.machine.type
      level: extended
      type: keyword
      ignore_above: 1024
      description: Machine type of the host machine.
      example: t2.medium
      default_field: false
    - name: target.project.id
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The cloud project identifier.

        Examples: Google Cloud Project id, Azure Project id.'
      example: my-project
      default_field: false
    - name: target.project.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The cloud project name.

        Examples: Google Cloud Project name, Azure Project name.'
      example: my project
      default_field: false
    - name: target.provider
      level: extended
      type: keyword
      ignore_above: 1024
      description: Name of the cloud provider. Example values are aws, azure, gcp,
        or digitalocean.
      example: aws
      default_field: false
    - name: target.region
      level: extended
      type: keyword
      ignore_above: 1024
      description: Region in which this host, resource, or service is located.
      example: us-east-1
      default_field: false
    - name: target.service.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The cloud service name is intended to distinguish services running
        on different platforms within a provider, eg AWS EC2 vs Lambda, GCP GCE vs
        App Engine, Azure VM vs App Server.

        Examples: app engine, app service, cloud run, fargate, lambda.'
      example: lambda
      default_field: false
  - name: code_signature
    title: Code Signature
    group: 2
    description: These fields contain information about binary code signatures.
    type: group
    default_field: true
    fields:
    - name: digest_algorithm
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The hashing algorithm used to sign the process.

        This value can distinguish signatures when a file is signed multiple times
        by the same signer but with a different digest algorithm.'
      example: sha256
      default_field: false
    - name: exists
      level: core
      type: boolean
      description: Boolean to capture if a signature is present.
      example: 'true'
      default_field: false
    - name: signing_id
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The identifier used to sign the process.

        This is used to identify the application manufactured by a software vendor.
        The field is relevant to Apple *OS only.'
      example: com.apple.xpc.proxy
      default_field: false
    - name: status
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Additional information about the certificate status.

        This is useful for logging cryptographic errors with the certificate validity
        or trust status. Leave unpopulated if the validity or trust of the certificate
        was unchecked.'
      example: ERROR_UNTRUSTED_ROOT
      default_field: false
    - name: subject_name
      level: core
      type: keyword
      ignore_above: 1024
      description: Subject name of the code signer
      example: Microsoft Corporation
      default_field: false
    - name: team_id
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The team identifier used to sign the process.

        This is used to identify the team or vendor of a software product. The field
        is relevant to Apple *OS only.'
      example: EQHXZ8M8AV
      default_field: false
    - name: timestamp
      level: extended
      type: date
      description: Date and time when the code signature was generated and signed.
      example: '2021-01-01T12:10:30Z'
      default_field: false
    - name: trusted
      level: extended
      type: boolean
      description: 'Stores the trust status of the certificate chain.

        Validating the trust of the certificate chain may be complicated, and this
        field should only be populated by tools that actively check the status.'
      example: 'true'
      default_field: false
    - name: valid
      level: extended
      type: boolean
      description: 'Boolean to capture if the digital signature is verified against
        the binary content.

        Leave unpopulated if a certificate was unchecked.'
      example: 'true'
      default_field: false
  - name: container
    title: Container
    group: 2
    description: 'Container fields are used for meta information about the specific
      container that is the source of information.
      These fields help correlate data based containers from any runtime.'
    type: group
    default_field: true
    fields:
    - name: cpu.usage
      level: extended
      type: scaled_float
      description: 'Percent CPU used which is normalized by the number of CPU cores
        and it ranges from 0 to 1. Scaling factor: 1000.'
      scaling_factor: 1000
      default_field: false
    - name: disk.read.bytes
      level: extended
      type: long
      description: The total number of bytes (gauge) read successfully (aggregated
        from all disks) since the last metric collection.
      default_field: false
    - name: disk.write.bytes
      level: extended
      type: long
      description: The total number of bytes (gauge) written successfully (aggregated
        from all disks) since the last metric collection.
      default_field: false
    - name: id
      level: core
      type: keyword
      ignore_above: 1024
      description: Unique container id.
    - name: image.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Name of the image the container was built on.
    - name: image.tag
      level: extended
      type: keyword
      ignore_above: 1024
      description: Container image tags.
    - name: labels
      level: extended
      type: object
      object_type: keyword
      description: Image labels.
    - name: memory.usage
      level: extended
      type: scaled_float
      description: 'Memory usage percentage and it ranges from 0 to 1. Scaling factor:
        1000.'
      scaling_factor: 1000
      default_field: false
    - name: name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Container name.
    - name: network.egress.bytes
      level: extended
      type: long
      description: The number of bytes (gauge) sent out on all network interfaces
        by the container since the last metric collection.
      default_field: false
    - name: network.ingress.bytes
      level: extended
      type: long
      description: The number of bytes received (gauge) on all network interfaces
        by the container since the last metric collection.
      default_field: false
    - name: runtime
      level: extended
      type: keyword
      ignore_above: 1024
      description: Runtime managing this container.
      example: docker
  - name: data_stream
    title: Data Stream
    group: 2
    description: 'The data_stream fields take part in defining the new data stream
      naming scheme.

      In the new data stream naming scheme the value of the data stream fields combine
      to the name of the actual data stream in the following manner: `{data_stream.type}-{data_stream.dataset}-{data_stream.namespace}`.
      This means the fields can only contain characters that are valid as part of
      names of data streams. More details about this can be found in this https://www.elastic.co/blog/an-introduction-to-the-elastic-data-stream-naming-scheme[blog
      post].

      An Elasticsearch data stream consists of one or more backing indices, and a
      data stream name forms part of the backing indices names. Due to this convention,
      data streams must also follow index naming restrictions. For example, data stream
      names cannot include `\`, `/`, `*`, `?`, `"`, `<`, `>`, `|`, ` ` (space character),
      `,`, or `#`. Please see the Elasticsearch reference for additional https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-create-index.html#indices-create-api-path-params[restrictions].'
    type: group
    default_field: true
    fields:
    - name: dataset
      level: extended
      type: constant_keyword
      description: "The field can contain anything that makes sense to signify the\
        \ source of the data.\nExamples include `nginx.access`, `prometheus`, `endpoint`\
        \ etc. For data streams that otherwise fit, but that do not have dataset set\
        \ we use the value \"generic\" for the dataset value. `event.dataset` should\
        \ have the same value as `data_stream.dataset`.\nBeyond the Elasticsearch\
        \ data stream naming criteria noted above, the `dataset` value has additional\
        \ restrictions:\n  * Must not contain `-`\n  * No longer than 100 characters"
      example: nginx.access
      default_field: false
    - name: namespace
      level: extended
      type: constant_keyword
      description: "A user defined namespace. Namespaces are useful to allow grouping\
        \ of data.\nMany users already organize their indices this way, and the data\
        \ stream naming scheme now provides this best practice as a default. Many\
        \ users will populate this field with `default`. If no value is used, it falls\
        \ back to `default`.\nBeyond the Elasticsearch index naming criteria noted\
        \ above, `namespace` value has the additional restrictions:\n  * Must not\
        \ contain `-`\n  * No longer than 100 characters"
      example: production
      default_field: false
    - name: type
      level: extended
      type: constant_keyword
      description: 'An overarching type for the data stream.

        Currently allowed values are "logs" and "metrics". We expect to also add "traces"
        and "synthetics" in the near future.'
      example: logs
      default_field: false
  - name: destination
    title: Destination
    group: 2
    description: 'Destination fields capture details about the receiver of a network
      exchange/packet. These fields are populated from a network event, packet, or
      other event containing details of a network transaction.

      Destination fields are usually populated in conjunction with source fields.
      The source and destination fields are considered the baseline and should always
      be filled if an event contains source and destination details from a network
      transaction. If the event also contains identification of the client and server
      roles, then the client and server fields should also be populated.'
    type: group
    default_field: true
    fields:
    - name: address
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Some event destination addresses are defined ambiguously. The
        event will sometimes list an IP, a domain or a unix socket.  You should always
        store the raw address in the `.address` field.

        Then it should be duplicated to `.ip` or `.domain`, depending on which one
        it is.'
    - name: as.number
      level: extended
      type: long
      description: Unique number allocated to the autonomous system. The autonomous
        system number (ASN) uniquely identifies each network on the Internet.
      example: 15169
    - name: as.organization.name
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: match_only_text
        default_field: false
      description: Organization name.
      example: Google LLC
    - name: bytes
      level: core
      type: long
      format: bytes
      description: Bytes sent from the destination to the source.
      example: 184
    - name: domain
      level: core
      type: keyword
      ignore_above: 1024
      description: 'The domain name of the destination system.

        This value may be a host name, a fully qualified domain name, or another host
        naming format. The value may derive from the original event or be added from
        enrichment.'
      example: foo.example.com
    - name: geo.city_name
      level: core
      type: keyword
      ignore_above: 1024
      description: City name.
      example: Montreal
    - name: geo.continent_code
      level: core
      type: keyword
      ignore_above: 1024
      description: Two-letter code representing continent's name.
      example: NA
      default_field: false
    - name: geo.continent_name
      level: core
      type: keyword
      ignore_above: 1024
      description: Name of the continent.
      example: North America
    - name: geo.country_iso_code
      level: core
      type: keyword
      ignore_above: 1024
      description: Country ISO code.
      example: CA
    - name: geo.country_name
      level: core
      type: keyword
      ignore_above: 1024
      description: Country name.
      example: Canada
    - name: geo.location
      level: core
      type: geo_point
      description: Longitude and latitude.
      example: '{ "lon": -73.614830, "lat": 45.505918 }'
    - name: geo.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'User-defined description of a location, at the level of granularity
        they care about.

        Could be the name of their data centers, the floor number, if this describes
        a local physical entity, city names.

        Not typically used in automated geolocation.'
      example: boston-dc
    - name: geo.postal_code
      level: core
      type: keyword
      ignore_above: 1024
      description: 'Postal code associated with the location.

        Values appropriate for this field may also be known as a postcode or ZIP code
        and will vary widely from country to country.'
      example: 94040
      default_field: false
    - name: geo.region_iso_code
      level: core
      type: keyword
      ignore_above: 1024
      description: Region ISO code.
      example: CA-QC
    - name: geo.region_name
      level: core
      type: keyword
      ignore_above: 1024
      description: Region name.
      example: Quebec
    - name: geo.timezone
      level: core
      type: keyword
      ignore_above: 1024
      description: The time zone of the location, such as IANA time zone name.
      example: America/Argentina/Buenos_Aires
      default_field: false
    - name: ip
      level: core
      type: ip
      description: IP address of the destination (IPv4 or IPv6).
    - name: mac
      level: core
      type: keyword
      ignore_above: 1024
      description: 'MAC address of the destination.

        The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit
        byte) is represented by two [uppercase] hexadecimal digits giving the value
        of the octet as an unsigned integer. Successive octets are separated by a
        hyphen.'
      example: 00-00-5E-00-53-23
    - name: nat.ip
      level: extended
      type: ip
      description: 'Translated ip of destination based NAT sessions (e.g. internet
        to private DMZ)

        Typically used with load balancers, firewalls, or routers.'
    - name: nat.port
      level: extended
      type: long
      format: string
      description: 'Port the source session is translated to by NAT Device.

        Typically used with load balancers, firewalls, or routers.'
    - name: packets
      level: core
      type: long
      description: Packets sent from the destination to the source.
      example: 12
    - name: port
      level: core
      type: long
      format: string
      description: Port of the destination.
    - name: registered_domain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The highest registered destination domain, stripped of the subdomain.

        For example, the registered domain for "foo.example.com" is "example.com".

        This value can be determined precisely with a list like the public suffix
        list (http://publicsuffix.org). Trying to approximate this by simply taking
        the last two labels will not work well for TLDs such as "co.uk".'
      example: example.com
    - name: subdomain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The subdomain portion of a fully qualified domain name includes
        all of the names except the host name under the registered_domain.  In a partially
        qualified domain, or if the the qualification level of the full name cannot
        be determined, subdomain contains all of the names below the registered domain.

        For example the subdomain portion of "www.east.mydomain.co.uk" is "east".
        If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com",
        the subdomain field should contain "sub2.sub1", with no trailing period.'
      example: east
      default_field: false
    - name: top_level_domain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The effective top level domain (eTLD), also known as the domain
        suffix, is the last part of the domain name. For example, the top level domain
        for example.com is "com".

        This value can be determined precisely with a list like the public suffix
        list (http://publicsuffix.org). Trying to approximate this by simply taking
        the last label will not work well for effective TLDs such as "co.uk".'
      example: co.uk
    - name: user.domain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Name of the directory the user is a member of.

        For example, an LDAP or Active Directory domain name.'
    - name: user.email
      level: extended
      type: keyword
      ignore_above: 1024
      description: User email address.
    - name: user.full_name
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: match_only_text
        default_field: false
      description: User's full name, if available.
      example: Albert Einstein
    - name: user.group.domain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Name of the directory the group is a member of.

        For example, an LDAP or Active Directory domain name.'
    - name: user.group.id
      level: extended
      type: keyword
      ignore_above: 1024
      description: Unique identifier for the group on the system/platform.
    - name: user.group.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Name of the group.
    - name: user.hash
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Unique user hash to correlate information for a user in anonymized
        form.

        Useful if `user.id` or `user.name` contain confidential information and cannot
        be used.'
    - name: user.id
      level: core
      type: keyword
      ignore_above: 1024
      description: Unique identifier of the user.
      example: S-1-5-21-202424912787-2692429404-2351956786-1000
    - name: user.name
      level: core
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: match_only_text
        default_field: false
      description: Short name or login of the user.
      example: a.einstein
    - name: user.roles
      level: extended
      type: keyword
      ignore_above: 1024
      description: Array of user roles at the time of the event.
      example: '["kibana_admin", "reporting_user"]'
      default_field: false
  - name: dll
    title: DLL
    group: 2
    description: 'These fields contain information about code libraries dynamically
      loaded into processes.


      Many operating systems refer to "shared code libraries" with different names,
      but this field set refers to all of the following:

      * Dynamic-link library (`.dll`) commonly used on Windows

      * Shared Object (`.so`) commonly used on Unix-like operating systems

      * Dynamic library (`.dylib`) commonly used on macOS'
    type: group
    default_field: true
    fields:
    - name: code_signature.digest_algorithm
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The hashing algorithm used to sign the process.

        This value can distinguish signatures when a file is signed multiple times
        by the same signer but with a different digest algorithm.'
      example: sha256
      default_field: false
    - name: code_signature.exists
      level: core
      type: boolean
      description: Boolean to capture if a signature is present.
      example: 'true'
      default_field: false
    - name: code_signature.signing_id
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The identifier used to sign the process.

        This is used to identify the application manufactured by a software vendor.
        The field is relevant to Apple *OS only.'
      example: com.apple.xpc.proxy
      default_field: false
    - name: code_signature.status
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Additional information about the certificate status.

        This is useful for logging cryptographic errors with the certificate validity
        or trust status. Leave unpopulated if the validity or trust of the certificate
        was unchecked.'
      example: ERROR_UNTRUSTED_ROOT
      default_field: false
    - name: code_signature.subject_name
      level: core
      type: keyword
      ignore_above: 1024
      description: Subject name of the code signer
      example: Microsoft Corporation
      default_field: false
    - name: code_signature.team_id
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The team identifier used to sign the process.

        This is used to identify the team or vendor of a software product. The field
        is relevant to Apple *OS only.'
      example: EQHXZ8M8AV
      default_field: false
    - name: code_signature.timestamp
      level: extended
      type: date
      description: Date and time when the code signature was generated and signed.
      example: '2021-01-01T12:10:30Z'
      default_field: false
    - name: code_signature.trusted
      level: extended
      type: boolean
      description: 'Stores the trust status of the certificate chain.

        Validating the trust of the certificate chain may be complicated, and this
        field should only be populated by tools that actively check the status.'
      example: 'true'
      default_field: false
    - name: code_signature.valid
      level: extended
      type: boolean
      description: 'Boolean to capture if the digital signature is verified against
        the binary content.

        Leave unpopulated if a certificate was unchecked.'
      example: 'true'
      default_field: false
    - name: hash.md5
      level: extended
      type: keyword
      ignore_above: 1024
      description: MD5 hash.
      default_field: false
    - name: hash.sha1
      level: extended
      type: keyword
      ignore_above: 1024
      description: SHA1 hash.
      default_field: false
    - name: hash.sha256
      level: extended
      type: keyword
      ignore_above: 1024
      description: SHA256 hash.
      default_field: false
    - name: hash.sha512
      level: extended
      type: keyword
      ignore_above: 1024
      description: SHA512 hash.
      default_field: false
    - name: hash.ssdeep
      level: extended
      type: keyword
      ignore_above: 1024
      description: SSDEEP hash.
      default_field: false
    - name: name
      level: core
      type: keyword
      ignore_above: 1024
      description: 'Name of the library.

        This generally maps to the name of the file on disk.'
      example: kernel32.dll
      default_field: false
    - name: path
      level: extended
      type: keyword
      ignore_above: 1024
      description: Full file path of the library.
      example: C:\Windows\System32\kernel32.dll
      default_field: false
    - name: pe.architecture
      level: extended
      type: keyword
      ignore_above: 1024
      description: CPU architecture target for the file.
      example: x64
      default_field: false
    - name: pe.company
      level: extended
      type: keyword
      ignore_above: 1024
      description: Internal company name of the file, provided at compile-time.
      example: Microsoft Corporation
      default_field: false
    - name: pe.description
      level: extended
      type: keyword
      ignore_above: 1024
      description: Internal description of the file, provided at compile-time.
      example: Paint
      default_field: false
    - name: pe.file_version
      level: extended
      type: keyword
      ignore_above: 1024
      description: Internal version of the file, provided at compile-time.
      example: 6.3.9600.17415
      default_field: false
    - name: pe.imphash
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'A hash of the imports in a PE file. An imphash -- or import hash
        -- can be used to fingerprint binaries even after recompilation or other code-level
        transformations have occurred, which would change more traditional hash values.

        Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.'
      example: 0c6803c4e922103c4dca5963aad36ddf
      default_field: false
    - name: pe.original_file_name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Internal name of the file, provided at compile-time.
      example: MSPAINT.EXE
      default_field: false
    - name: pe.product
      level: extended
      type: keyword
      ignore_above: 1024
      description: Internal product name of the file, provided at compile-time.
      example: "Microsoft\xAE Windows\xAE Operating System"
      default_field: false
  - name: dns
    title: DNS
    group: 2
    description: 'Fields describing DNS queries and answers.

      DNS events should either represent a single DNS query prior to getting answers
      (`dns.type:query`) or they should represent a full exchange and contain the
      query details as well as all of the answers that were provided for this query
      (`dns.type:answer`).'
    type: group
    default_field: true
    fields:
    - name: answers
      level: extended
      type: object
      description: 'An array containing an object for each answer section returned
        by the server.

        The main keys that should be present in these objects are defined by ECS.
        Records that have more information may contain more keys than what ECS defines.

        Not all DNS data sources give all details about DNS answers. At minimum, answer
        objects must contain the `data` key. If more information is available, map
        as much of it to ECS as possible, and add any additional fields to the answer
        objects as custom fields.'
    - name: answers.class
      level: extended
      type: keyword
      ignore_above: 1024
      description: The class of DNS data contained in this resource record.
      example: IN
    - name: answers.data
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The data describing the resource.

        The meaning of this data depends on the type and class of the resource record.'
      example: 10.10.10.10
    - name: answers.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The domain name to which this resource record pertains.

        If a chain of CNAME is being resolved, each answer''s `name` should be the
        one that corresponds with the answer''s `data`. It should not simply be the
        original `question.name` repeated.'
      example: www.example.com
    - name: answers.ttl
      level: extended
      type: long
      description: The time interval in seconds that this resource record may be cached
        before it should be discarded. Zero values mean that the data should not be
        cached.
      example: 180
    - name: answers.type
      level: extended
      type: keyword
      ignore_above: 1024
      description: The type of data contained in this resource record.
      example: CNAME
    - name: header_flags
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Array of 2 letter DNS header flags.

        Expected values are: AA, TC, RD, RA, AD, CD, DO.'
      example: '["RD", "RA"]'
    - name: id
      level: extended
      type: keyword
      ignore_above: 1024
      description: The DNS packet identifier assigned by the program that generated
        the query. The identifier is copied to the response.
      example: 62111
    - name: op_code
      level: extended
      type: keyword
      ignore_above: 1024
      description: The DNS operation code that specifies the kind of query in the
        message. This value is set by the originator of a query and copied into the
        response.
      example: QUERY
    - name: question.class
      level: extended
      type: keyword
      ignore_above: 1024
      description: The class of records being queried.
      example: IN
    - name: question.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The name being queried.

        If the name field contains non-printable characters (below 32 or above 126),
        those characters should be represented as escaped base 10 integers (\DDD).
        Back slashes and quotes should be escaped. Tabs, carriage returns, and line
        feeds should be converted to \t, \r, and \n respectively.'
      example: www.example.com
    - name: question.registered_domain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The highest registered domain, stripped of the subdomain.

        For example, the registered domain for "foo.example.com" is "example.com".

        This value can be determined precisely with a list like the public suffix
        list (http://publicsuffix.org). Trying to approximate this by simply taking
        the last two labels will not work well for TLDs such as "co.uk".'
      example: example.com
    - name: question.subdomain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The subdomain is all of the labels under the registered_domain.

        If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com",
        the subdomain field should contain "sub2.sub1", with no trailing period.'
      example: www
    - name: question.top_level_domain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The effective top level domain (eTLD), also known as the domain
        suffix, is the last part of the domain name. For example, the top level domain
        for example.com is "com".

        This value can be determined precisely with a list like the public suffix
        list (http://publicsuffix.org). Trying to approximate this by simply taking
        the last label will not work well for effective TLDs such as "co.uk".'
      example: co.uk
    - name: question.type
      level: extended
      type: keyword
      ignore_above: 1024
      description: The type of record being queried.
      example: AAAA
    - name: resolved_ip
      level: extended
      type: ip
      description: 'Array containing all IPs seen in `answers.data`.

        The `answers` array can be difficult to use, because of the variety of data
        formats it can contain. Extracting all IP addresses seen in there to `dns.resolved_ip`
        makes it possible to index them as IP addresses, and makes them easier to
        visualize and query for.'
      example: '["10.10.10.10", "10.10.10.11"]'
    - name: response_code
      level: extended
      type: keyword
      ignore_above: 1024
      description: The DNS response code.
      example: NOERROR
    - name: type
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The type of DNS event captured, query or answer.

        If your source of DNS events only gives you DNS queries, you should only create
        dns events of type `dns.type:query`.

        If your source of DNS events gives you answers as well, you should create
        one event per query (optionally as soon as the query is seen). And a second
        event containing all query details as well as an array of answers.'
      example: answer
  - name: ecs
    title: ECS
    group: 2
    description: Meta-information specific to ECS.
    type: group
    default_field: true
    fields:
    - name: version
      level: core
      required: true
      type: keyword
      ignore_above: 1024
      description: 'ECS version this event conforms to. `ecs.version` is a required
        field and must exist in all events.

        When querying across multiple indices -- which may conform to slightly different
        ECS versions -- this field lets integrations adjust to the schema version
        of the events.'
      example: 1.0.0
  - name: elf
    title: ELF Header
    group: 2
    description: These fields contain Linux Executable Linkable Format (ELF) metadata.
    type: group
    default_field: true
    fields:
    - name: architecture
      level: extended
      type: keyword
      ignore_above: 1024
      description: Machine architecture of the ELF file.
      example: x86-64
      default_field: false
    - name: byte_order
      level: extended
      type: keyword
      ignore_above: 1024
      description: Byte sequence of ELF file.
      example: Little Endian
      default_field: false
    - name: cpu_type
      level: extended
      type: keyword
      ignore_above: 1024
      description: CPU type of the ELF file.
      example: Intel
      default_field: false
    - name: creation_date
      level: extended
      type: date
      description: Extracted when possible from the file's metadata. Indicates when
        it was built or compiled. It can also be faked by malware creators.
      default_field: false
    - name: exports
      level: extended
      type: flattened
      description: List of exported element names and types.
      default_field: false
    - name: header.abi_version
      level: extended
      type: keyword
      ignore_above: 1024
      description: Version of the ELF Application Binary Interface (ABI).
      default_field: false
    - name: header.class
      level: extended
      type: keyword
      ignore_above: 1024
      description: Header class of the ELF file.
      default_field: false
    - name: header.data
      level: extended
      type: keyword
      ignore_above: 1024
      description: Data table of the ELF header.
      default_field: false
    - name: header.entrypoint
      level: extended
      type: long
      format: string
      description: Header entrypoint of the ELF file.
      default_field: false
    - name: header.object_version
      level: extended
      type: keyword
      ignore_above: 1024
      description: '"0x1" for original ELF files.'
      default_field: false
    - name: header.os_abi
      level: extended
      type: keyword
      ignore_above: 1024
      description: Application Binary Interface (ABI) of the Linux OS.
      default_field: false
    - name: header.type
      level: extended
      type: keyword
      ignore_above: 1024
      description: Header type of the ELF file.
      default_field: false
    - name: header.version
      level: extended
      type: keyword
      ignore_above: 1024
      description: Version of the ELF header.
      default_field: false
    - name: imports
      level: extended
      type: flattened
      description: List of imported element names and types.
      default_field: false
    - name: sections
      level: extended
      type: nested
      description: 'An array containing an object for each section of the ELF file.

        The keys that should be present in these objects are defined by sub-fields
        underneath `elf.sections.*`.'
      default_field: false
    - name: sections.chi2
      level: extended
      type: long
      format: number
      description: Chi-square probability distribution of the section.
      default_field: false
    - name: sections.entropy
      level: extended
      type: long
      format: number
      description: Shannon entropy calculation from the section.
      default_field: false
    - name: sections.flags
      level: extended
      type: keyword
      ignore_above: 1024
      description: ELF Section List flags.
      default_field: false
    - name: sections.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: ELF Section List name.
      default_field: false
    - name: sections.physical_offset
      level: extended
      type: keyword
      ignore_above: 1024
      description: ELF Section List offset.
      default_field: false
    - name: sections.physical_size
      level: extended
      type: long
      format: bytes
      description: ELF Section List physical size.
      default_field: false
    - name: sections.type
      level: extended
      type: keyword
      ignore_above: 1024
      description: ELF Section List type.
      default_field: false
    - name: sections.virtual_address
      level: extended
      type: long
      format: string
      description: ELF Section List virtual address.
      default_field: false
    - name: sections.virtual_size
      level: extended
      type: long
      format: string
      description: ELF Section List virtual size.
      default_field: false
    - name: segments
      level: extended
      type: nested
      description: 'An array containing an object for each segment of the ELF file.

        The keys that should be present in these objects are defined by sub-fields
        underneath `elf.segments.*`.'
      default_field: false
    - name: segments.sections
      level: extended
      type: keyword
      ignore_above: 1024
      description: ELF object segment sections.
      default_field: false
    - name: segments.type
      level: extended
      type: keyword
      ignore_above: 1024
      description: ELF object segment type.
      default_field: false
    - name: shared_libraries
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of shared libraries used by this ELF object.
      default_field: false
    - name: telfhash
      level: extended
      type: keyword
      ignore_above: 1024
      description: telfhash symbol hash for ELF file.
      default_field: false
  - name: error
    title: Error
    group: 2
    description: 'These fields can represent errors of any kind.

      Use them for errors that happen while fetching events or in cases where the
      event itself contains an error.'
    type: group
    default_field: true
    fields:
    - name: code
      level: core
      type: keyword
      ignore_above: 1024
      description: Error code describing the error.
    - name: id
      level: core
      type: keyword
      ignore_above: 1024
      description: Unique identifier for the error.
    - name: message
      level: core
      type: match_only_text
      description: Error message.
    - name: stack_trace
      level: extended
      type: wildcard
      multi_fields:
      - name: text
        type: match_only_text
        default_field: false
      description: The stack trace of this error in plain text.
    - name: type
      level: extended
      type: keyword
      ignore_above: 1024
      description: The type of the error, for example the class name of the exception.
      example: java.lang.NullPointerException
  - name: event
    title: Event
    group: 2
    description: 'The event fields are used for context information about the log
      or metric event itself.

      A log is defined as an event containing details of something that happened.
      Log events must include the time at which the thing happened. Examples of log
      events include a process starting on a host, a network packet being sent from
      a source to a destination, or a network connection between a client and a server
      being initiated or closed. A metric is defined as an event containing one or
      more numerical measurements and the time at which the measurement was taken.
      Examples of metric events include memory pressure measured on a host and device
      temperature. See the `event.kind` definition in this section for additional
      details about metric and state events.'
    type: group
    default_field: true
    fields:
    - name: action
      level: core
      type: keyword
      ignore_above: 1024
      description: 'The action captured by the event.

        This describes the information in the event. It is more specific than `event.category`.
        Examples are `group-add`, `process-started`, `file-created`. The value is
        normally defined by the implementer.'
      example: user-password-change
    - name: agent_id_status
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Agents are normally responsible for populating the `agent.id`
        field value. If the system receiving events is capable of validating the value
        based on authentication information for the client then this field can be
        used to reflect the outcome of that validation.

        For example if the agent''s connection is authenticated with mTLS and the
        client cert contains the ID of the agent to which the cert was issued then
        the `agent.id` value in events can be checked against the certificate. If
        the values match then `event.agent_id_status: verified` is added to the event,
        otherwise one of the other allowed values should be used.

        If no validation is performed then the field should be omitted.

        The allowed values are:

        `verified` - The `agent.id` field value matches expected value obtained from
        auth metadata.

        `mismatch` - The `agent.id` field value does not match the expected value
        obtained from auth metadata.

        `missing` - There was no `agent.id` field in the event to validate.

        `auth_metadata_missing` - There was no auth metadata or it was missing information
        about the agent ID.'
      example: verified
      default_field: false
    - name: category
      level: core
      type: keyword
      ignore_above: 1024
      description: 'This is one of four ECS Categorization Fields, and indicates the
        second level in the ECS category hierarchy.

        `event.category` represents the "big buckets" of ECS categories. For example,
        filtering on `event.category:process` yields all events relating to process
        activity. This field is closely related to `event.type`, which is used as
        a subcategory.

        This field is an array. This will allow proper categorization of some events
        that fall in multiple categories.'
      example: authentication
    - name: code
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Identification code for this event, if one exists.

        Some event sources use event codes to identify messages unambiguously, regardless
        of message language or wording adjustments over time. An example of this is
        the Windows Event ID.'
      example: 4648
    - name: created
      level: core
      type: date
      description: 'event.created contains the date/time when the event was first
        read by an agent, or by your pipeline.

        This field is distinct from @timestamp in that @timestamp typically contain
        the time extracted from the original event.

        In most situations, these two timestamps will be slightly different. The difference
        can be used to calculate the delay between your source generating an event,
        and the time when your agent first processed it. This can be used to monitor
        your agent''s or pipeline''s ability to keep up with your event source.

        In case the two timestamps are identical, @timestamp should be used.'
      example: '2016-05-23T08:05:34.857Z'
    - name: dataset
      level: core
      type: keyword
      ignore_above: 1024
      description: 'Name of the dataset.

        If an event source publishes more than one type of log or events (e.g. access
        log, error log), the dataset is used to specify which one the event comes
        from.

        It''s recommended but not required to start the dataset name with the module
        name, followed by a dot, then the dataset name.'
      example: apache.access
    - name: duration
      level: core
      type: long
      format: duration
      input_format: nanoseconds
      output_format: asMilliseconds
      output_precision: 1
      description: 'Duration of the event in nanoseconds.

        If event.start and event.end are known this value should be the difference
        between the end and start time.'
    - name: end
      level: extended
      type: date
      description: event.end contains the date when the event ended or when the activity
        was last observed.
    - name: hash
      level: extended
      type: keyword
      ignore_above: 1024
      description: Hash (perhaps logstash fingerprint) of raw field to be able to
        demonstrate log integrity.
      example: 123456789012345678901234567890ABCD
    - name: id
      level: core
      type: keyword
      ignore_above: 1024
      description: Unique ID to describe the event.
      example: 8a4f500d
    - name: ingested
      level: core
      type: date
      description: 'Timestamp when an event arrived in the central data store.

        This is different from `@timestamp`, which is when the event originally occurred.  It''s
        also different from `event.created`, which is meant to capture the first time
        an agent saw the event.

        In normal conditions, assuming no tampering, the timestamps should chronologically
        look like this: `@timestamp` < `event.created` < `event.ingested`.'
      example: '2016-05-23T08:05:35.101Z'
      default_field: false
    - name: kind
      level: core
      type: keyword
      ignore_above: 1024
      description: 'This is one of four ECS Categorization Fields, and indicates the
        highest level in the ECS category hierarchy.

        `event.kind` gives high-level information about what type of information the
        event contains, without being specific to the contents of the event. For example,
        values of this field distinguish alert events from metric events.

        The value of this field can be used to inform how these kinds of events should
        be handled. They may warrant different retention, different access control,
        it may also help understand whether the data coming in at a regular interval
        or not.'
      example: alert
    - name: module
      level: core
      type: keyword
      ignore_above: 1024
      description: 'Name of the module this data is coming from.

        If your monitoring agent supports the concept of modules or plugins to process
        events of a given source (e.g. Apache logs), `event.module` should contain
        the name of this module.'
      example: apache
    - name: original
      level: core
      type: keyword
      description: 'Raw text message of entire event. Used to demonstrate log integrity
        or where the full log message (before splitting it up in multiple parts) may
        be required, e.g. for reindex.

        This field is not indexed and doc_values are disabled. It cannot be searched,
        but it can be retrieved from `_source`. If users wish to override this and
        index this field, please see `Field data types` in the `Elasticsearch Reference`.'
      example: Sep 19 08:26:10 host CEF:0&#124;Security&#124; threatmanager&#124;1.0&#124;100&#124;
        worm successfully stopped&#124;10&#124;src=10.0.0.1 dst=2.1.2.2spt=1232
      index: false
      doc_values: false
    - name: outcome
      level: core
      type: keyword
      ignore_above: 1024
      description: 'This is one of four ECS Categorization Fields, and indicates the
        lowest level in the ECS category hierarchy.

        `event.outcome` simply denotes whether the event represents a success or a
        failure from the perspective of the entity that produced the event.

        Note that when a single transaction is described in multiple events, each
        event may populate different values of `event.outcome`, according to their
        perspective.

        Also note that in the case of a compound event (a single event that contains
        multiple logical events), this field should be populated with the value that
        best captures the overall success or failure from the perspective of the event
        producer.

        Further note that not all events will have an associated outcome. For example,
        this field is generally not populated for metric events, events with `event.type:info`,
        or any events for which an outcome does not make logical sense.'
      example: success
    - name: provider
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Source of the event.

        Event transports such as Syslog or the Windows Event Log typically mention
        the source of an event. It can be the name of the software that generated
        the event (e.g. Sysmon, httpd), or of a subsystem of the operating system
        (kernel, Microsoft-Windows-Security-Auditing).'
      example: kernel
    - name: reason
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Reason why this event happened, according to the source.

        This describes the why of a particular action or outcome captured in the event.
        Where `event.action` captures the action from the event, `event.reason` describes
        why that action was taken. For example, a web proxy with an `event.action`
        which denied the request may also populate `event.reason` with the reason
        why (e.g. `blocked site`).'
      example: Terminated an unexpected process
      default_field: false
    - name: reference
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Reference URL linking to additional information about this event.

        This URL links to a static definition of this event. Alert events, indicated
        by `event.kind:alert`, are a common use case for this field.'
      example: https://system.example.com/event/#0001234
      default_field: false
    - name: risk_score
      level: core
      type: float
      description: Risk score or priority of the event (e.g. security solutions).
        Use your system's original value here.
    - name: risk_score_norm
      level: extended
      type: float
      description: 'Normalized risk score or priority of the event, on a scale of
        0 to 100.

        This is mainly useful if you use more than one system that assigns risk scores,
        and you want to see a normalized value across all systems.'
    - name: sequence
      level: extended
      type: long
      format: string
      description: 'Sequence number of the event.

        The sequence number is a value published by some event sources, to make the
        exact ordering of events unambiguous, regardless of the timestamp precision.'
    - name: severity
      level: core
      type: long
      format: string
      description: 'The numeric severity of the event according to your event source.

        What the different severity values mean can be different between sources and
        use cases. It''s up to the implementer to make sure severities are consistent
        across events from the same source.

        The Syslog severity belongs in `log.syslog.severity.code`. `event.severity`
        is meant to represent the severity according to the event source (e.g. firewall,
        IDS). If the event source does not publish its own severity, you may optionally
        copy the `log.syslog.severity.code` to `event.severity`.'
      example: 7
    - name: start
      level: extended
      type: date
      description: event.start contains the date when the event started or when the
        activity was first observed.
    - name: timezone
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'This field should be populated when the event''s timestamp does
        not include timezone information already (e.g. default Syslog timestamps).
        It''s optional otherwise.

        Acceptable timezone formats are: a canonical ID (e.g. "Europe/Amsterdam"),
        abbreviated (e.g. "EST") or an HH:mm differential (e.g. "-05:00").'
    - name: type
      level: core
      type: keyword
      ignore_above: 1024
      description: 'This is one of four ECS Categorization Fields, and indicates the
        third level in the ECS category hierarchy.

        `event.type` represents a categorization "sub-bucket" that, when used along
        with the `event.category` field values, enables filtering events down to a
        level appropriate for single visualization.

        This field is an array. This will allow proper categorization of some events
        that fall in multiple event types.'
    - name: url
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'URL linking to an external system to continue investigation of
        this event.

        This URL links to another system where in-depth investigation of the specific
        occurrence of this event can take place. Alert events, indicated by `event.kind:alert`,
        are a common use case for this field.'
      example: https://mysystem.example.com/alert/5271dedb-f5b0-4218-87f0-4ac4870a38fe
      default_field: false
  - name: faas
    title: FaaS
    group: 2
    description: The user fields describe information about the function as a service
      that is relevant to the event.
    type: group
    default_field: true
    fields:
    - name: coldstart
      level: extended
      type: boolean
      description: Boolean value indicating a cold start of a function.
      default_field: false
    - name: execution
      level: extended
      type: keyword
      ignore_above: 1024
      description: The execution ID of the current function execution.
      example: af9d5aa4-a685-4c5f-a22b-444f80b3cc28
      default_field: false
    - name: trigger
      level: extended
      type: nested
      description: Details about the function trigger.
      default_field: false
    - name: trigger.request_id
      level: extended
      type: keyword
      ignore_above: 1024
      description: The ID of the trigger request , message, event, etc.
      example: 123456789
      default_field: false
    - name: trigger.type
      level: extended
      type: keyword
      ignore_above: 1024
      description: "The trigger for the function execution.\nExpected values are:\n\
        \  * http\n  * pubsub\n  * datasource\n  * timer\n  * other"
      example: http
      default_field: false
  - name: file
    title: File
    group: 2
    description: 'A file is defined as a set of information that has been created
      on, or has existed on a filesystem.

      File objects can be associated with host events, network events, and/or file
      events (e.g., those produced by File Integrity Monitoring [FIM] products or
      services). File fields provide details about the affected file associated with
      the event or metric.'
    type: group
    default_field: true
    fields:
    - name: accessed
      level: extended
      type: date
      description: 'Last time the file was accessed.

        Note that not all filesystems keep track of access time.'
    - name: attributes
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Array of file attributes.

        Attributes names will vary by platform. Here''s a non-exhaustive list of values
        that are expected in this field: archive, compressed, directory, encrypted,
        execute, hidden, read, readonly, system, write.'
      example: '["readonly", "system"]'
      default_field: false
    - name: code_signature.digest_algorithm
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The hashing algorithm used to sign the process.

        This value can distinguish signatures when a file is signed multiple times
        by the same signer but with a different digest algorithm.'
      example: sha256
      default_field: false
    - name: code_signature.exists
      level: core
      type: boolean
      description: Boolean to capture if a signature is present.
      example: 'true'
      default_field: false
    - name: code_signature.signing_id
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The identifier used to sign the process.

        This is used to identify the application manufactured by a software vendor.
        The field is relevant to Apple *OS only.'
      example: com.apple.xpc.proxy
      default_field: false
    - name: code_signature.status
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Additional information about the certificate status.

        This is useful for logging cryptographic errors with the certificate validity
        or trust status. Leave unpopulated if the validity or trust of the certificate
        was unchecked.'
      example: ERROR_UNTRUSTED_ROOT
      default_field: false
    - name: code_signature.subject_name
      level: core
      type: keyword
      ignore_above: 1024
      description: Subject name of the code signer
      example: Microsoft Corporation
      default_field: false
    - name: code_signature.team_id
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The team identifier used to sign the process.

        This is used to identify the team or vendor of a software product. The field
        is relevant to Apple *OS only.'
      example: EQHXZ8M8AV
      default_field: false
    - name: code_signature.timestamp
      level: extended
      type: date
      description: Date and time when the code signature was generated and signed.
      example: '2021-01-01T12:10:30Z'
      default_field: false
    - name: code_signature.trusted
      level: extended
      type: boolean
      description: 'Stores the trust status of the certificate chain.

        Validating the trust of the certificate chain may be complicated, and this
        field should only be populated by tools that actively check the status.'
      example: 'true'
      default_field: false
    - name: code_signature.valid
      level: extended
      type: boolean
      description: 'Boolean to capture if the digital signature is verified against
        the binary content.

        Leave unpopulated if a certificate was unchecked.'
      example: 'true'
      default_field: false
    - name: created
      level: extended
      type: date
      description: 'File creation time.

        Note that not all filesystems store the creation time.'
    - name: ctime
      level: extended
      type: date
      description: 'Last time the file attributes or metadata changed.

        Note that changes to the file content will update `mtime`. This implies `ctime`
        will be adjusted at the same time, since `mtime` is an attribute of the file.'
    - name: device
      level: extended
      type: keyword
      ignore_above: 1024
      description: Device that is the source of the file.
      example: sda
    - name: directory
      level: extended
      type: keyword
      ignore_above: 1024
      description: Directory where the file is located. It should include the drive
        letter, when appropriate.
      example: /home/alice
    - name: drive_letter
      level: extended
      type: keyword
      ignore_above: 1
      description: 'Drive letter where the file is located. This field is only relevant
        on Windows.

        The value should be uppercase, and not include the colon.'
      example: C
      default_field: false
    - name: elf.architecture
      level: extended
      type: keyword
      ignore_above: 1024
      description: Machine architecture of the ELF file.
      example: x86-64
      default_field: false
    - name: elf.byte_order
      level: extended
      type: keyword
      ignore_above: 1024
      description: Byte sequence of ELF file.
      example: Little Endian
      default_field: false
    - name: elf.cpu_type
      level: extended
      type: keyword
      ignore_above: 1024
      description: CPU type of the ELF file.
      example: Intel
      default_field: false
    - name: elf.creation_date
      level: extended
      type: date
      description: Extracted when possible from the file's metadata. Indicates when
        it was built or compiled. It can also be faked by malware creators.
      default_field: false
    - name: elf.exports
      level: extended
      type: flattened
      description: List of exported element names and types.
      default_field: false
    - name: elf.header.abi_version
      level: extended
      type: keyword
      ignore_above: 1024
      description: Version of the ELF Application Binary Interface (ABI).
      default_field: false
    - name: elf.header.class
      level: extended
      type: keyword
      ignore_above: 1024
      description: Header class of the ELF file.
      default_field: false
    - name: elf.header.data
      level: extended
      type: keyword
      ignore_above: 1024
      description: Data table of the ELF header.
      default_field: false
    - name: elf.header.entrypoint
      level: extended
      type: long
      format: string
      description: Header entrypoint of the ELF file.
      default_field: false
    - name: elf.header.object_version
      level: extended
      type: keyword
      ignore_above: 1024
      description: '"0x1" for original ELF files.'
      default_field: false
    - name: elf.header.os_abi
      level: extended
      type: keyword
      ignore_above: 1024
      description: Application Binary Interface (ABI) of the Linux OS.
      default_field: false
    - name: elf.header.type
      level: extended
      type: keyword
      ignore_above: 1024
      description: Header type of the ELF file.
      default_field: false
    - name: elf.header.version
      level: extended
      type: keyword
      ignore_above: 1024
      description: Version of the ELF header.
      default_field: false
    - name: elf.imports
      level: extended
      type: flattened
      description: List of imported element names and types.
      default_field: false
    - name: elf.sections
      level: extended
      type: nested
      description: 'An array containing an object for each section of the ELF file.

        The keys that should be present in these objects are defined by sub-fields
        underneath `elf.sections.*`.'
      default_field: false
    - name: elf.sections.chi2
      level: extended
      type: long
      format: number
      description: Chi-square probability distribution of the section.
      default_field: false
    - name: elf.sections.entropy
      level: extended
      type: long
      format: number
      description: Shannon entropy calculation from the section.
      default_field: false
    - name: elf.sections.flags
      level: extended
      type: keyword
      ignore_above: 1024
      description: ELF Section List flags.
      default_field: false
    - name: elf.sections.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: ELF Section List name.
      default_field: false
    - name: elf.sections.physical_offset
      level: extended
      type: keyword
      ignore_above: 1024
      description: ELF Section List offset.
      default_field: false
    - name: elf.sections.physical_size
      level: extended
      type: long
      format: bytes
      description: ELF Section List physical size.
      default_field: false
    - name: elf.sections.type
      level: extended
      type: keyword
      ignore_above: 1024
      description: ELF Section List type.
      default_field: false
    - name: elf.sections.virtual_address
      level: extended
      type: long
      format: string
      description: ELF Section List virtual address.
      default_field: false
    - name: elf.sections.virtual_size
      level: extended
      type: long
      format: string
      description: ELF Section List virtual size.
      default_field: false
    - name: elf.segments
      level: extended
      type: nested
      description: 'An array containing an object for each segment of the ELF file.

        The keys that should be present in these objects are defined by sub-fields
        underneath `elf.segments.*`.'
      default_field: false
    - name: elf.segments.sections
      level: extended
      type: keyword
      ignore_above: 1024
      description: ELF object segment sections.
      default_field: false
    - name: elf.segments.type
      level: extended
      type: keyword
      ignore_above: 1024
      description: ELF object segment type.
      default_field: false
    - name: elf.shared_libraries
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of shared libraries used by this ELF object.
      default_field: false
    - name: elf.telfhash
      level: extended
      type: keyword
      ignore_above: 1024
      description: telfhash symbol hash for ELF file.
      default_field: false
    - name: extension
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'File extension, excluding the leading dot.

        Note that when the file name has multiple extensions (example.tar.gz), only
        the last one should be captured ("gz", not "tar.gz").'
      example: png
    - name: fork_name
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'A fork is additional data associated with a filesystem object.

        On Linux, a resource fork is used to store additional data with a filesystem
        object. A file always has at least one fork for the data portion, and additional
        forks may exist.

        On NTFS, this is analogous to an Alternate Data Stream (ADS), and the default
        data stream for a file is just called $DATA. Zone.Identifier is commonly used
        by Windows to track contents downloaded from the Internet. An ADS is typically
        of the form: `C:\path\to\filename.extension:some_fork_name`, and `some_fork_name`
        is the value that should populate `fork_name`. `filename.extension` should
        populate `file.name`, and `extension` should populate `file.extension`. The
        full path, `file.path`, will include the fork name.'
      example: Zone.Identifer
      default_field: false
    - name: gid
      level: extended
      type: keyword
      ignore_above: 1024
      description: Primary group ID (GID) of the file.
      example: '1001'
    - name: group
      level: extended
      type: keyword
      ignore_above: 1024
      description: Primary group name of the file.
      example: alice
    - name: hash.md5
      level: extended
      type: keyword
      ignore_above: 1024
      description: MD5 hash.
    - name: hash.sha1
      level: extended
      type: keyword
      ignore_above: 1024
      description: SHA1 hash.
    - name: hash.sha256
      level: extended
      type: keyword
      ignore_above: 1024
      description: SHA256 hash.
    - name: hash.sha512
      level: extended
      type: keyword
      ignore_above: 1024
      description: SHA512 hash.
    - name: hash.ssdeep
      level: extended
      type: keyword
      ignore_above: 1024
      description: SSDEEP hash.
      default_field: false
    - name: inode
      level: extended
      type: keyword
      ignore_above: 1024
      description: Inode representing the file in the filesystem.
      example: '256383'
    - name: mime_type
      level: extended
      type: keyword
      ignore_above: 1024
      description: MIME type should identify the format of the file or stream of bytes
        using https://www.iana.org/assignments/media-types/media-types.xhtml[IANA
        official types], where possible. When more than one type is applicable, the
        most specific type should be used.
      default_field: false
    - name: mode
      level: extended
      type: keyword
      ignore_above: 1024
      description: Mode of the file in octal representation.
      example: '0640'
    - name: mtime
      level: extended
      type: date
      description: Last time the file content was modified.
    - name: name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Name of the file including the extension, without the directory.
      example: example.png
    - name: owner
      level: extended
      type: keyword
      ignore_above: 1024
      description: File owner's username.
      example: alice
    - name: path
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: match_only_text
        default_field: false
      description: Full path to the file, including the file name. It should include
        the drive letter, when appropriate.
      example: /home/alice/example.png
    - name: pe.architecture
      level: extended
      type: keyword
      ignore_above: 1024
      description: CPU architecture target for the file.
      example: x64
      default_field: false
    - name: pe.company
      level: extended
      type: keyword
      ignore_above: 1024
      description: Internal company name of the file, provided at compile-time.
      example: Microsoft Corporation
      default_field: false
    - name: pe.description
      level: extended
      type: keyword
      ignore_above: 1024
      description: Internal description of the file, provided at compile-time.
      example: Paint
      default_field: false
    - name: pe.file_version
      level: extended
      type: keyword
      ignore_above: 1024
      description: Internal version of the file, provided at compile-time.
      example: 6.3.9600.17415
      default_field: false
    - name: pe.imphash
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'A hash of the imports in a PE file. An imphash -- or import hash
        -- can be used to fingerprint binaries even after recompilation or other code-level
        transformations have occurred, which would change more traditional hash values.

        Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.'
      example: 0c6803c4e922103c4dca5963aad36ddf
      default_field: false
    - name: pe.original_file_name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Internal name of the file, provided at compile-time.
      example: MSPAINT.EXE
      default_field: false
    - name: pe.product
      level: extended
      type: keyword
      ignore_above: 1024
      description: Internal product name of the file, provided at compile-time.
      example: "Microsoft\xAE Windows\xAE Operating System"
      default_field: false
    - name: size
      level: extended
      type: long
      description: 'File size in bytes.

        Only relevant when `file.type` is "file".'
      example: 16384
    - name: target_path
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: match_only_text
        default_field: false
      description: Target path for symlinks.
    - name: type
      level: extended
      type: keyword
      ignore_above: 1024
      description: File type (file, dir, or symlink).
      example: file
    - name: uid
      level: extended
      type: keyword
      ignore_above: 1024
      description: The user ID (UID) or security identifier (SID) of the file owner.
      example: '1001'
    - name: x509.alternative_names
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of subject alternative names (SAN). Name types vary by certificate
        authority and certificate type but commonly contain IP addresses, DNS names
        (and wildcards), and email addresses.
      example: '*.elastic.co'
      default_field: false
    - name: x509.issuer.common_name
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of common name (CN) of issuing certificate authority.
      example: Example SHA2 High Assurance Server CA
      default_field: false
    - name: x509.issuer.country
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of country (C) codes
      example: US
      default_field: false
    - name: x509.issuer.distinguished_name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Distinguished name (DN) of issuing certificate authority.
      example: C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance
        Server CA
      default_field: false
    - name: x509.issuer.locality
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of locality names (L)
      example: Mountain View
      default_field: false
    - name: x509.issuer.organization
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of organizations (O) of issuing certificate authority.
      example: Example Inc
      default_field: false
    - name: x509.issuer.organizational_unit
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of organizational units (OU) of issuing certificate authority.
      example: www.example.com
      default_field: false
    - name: x509.issuer.state_or_province
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of state or province names (ST, S, or P)
      example: California
      default_field: false
    - name: x509.not_after
      level: extended
      type: date
      description: Time at which the certificate is no longer considered valid.
      example: 2020-07-16 03:15:39+00:00
      default_field: false
    - name: x509.not_before
      level: extended
      type: date
      description: Time at which the certificate is first considered valid.
      example: 2019-08-16 01:40:25+00:00
      default_field: false
    - name: x509.public_key_algorithm
      level: extended
      type: keyword
      ignore_above: 1024
      description: Algorithm used to generate the public key.
      example: RSA
      default_field: false
    - name: x509.public_key_curve
      level: extended
      type: keyword
      ignore_above: 1024
      description: The curve used by the elliptic curve public key algorithm. This
        is algorithm specific.
      example: nistp521
      default_field: false
    - name: x509.public_key_exponent
      level: extended
      type: long
      description: Exponent used to derive the public key. This is algorithm specific.
      example: 65537
      index: false
      doc_values: false
      default_field: false
    - name: x509.public_key_size
      level: extended
      type: long
      description: The size of the public key space in bits.
      example: 2048
      default_field: false
    - name: x509.serial_number
      level: extended
      type: keyword
      ignore_above: 1024
      description: Unique serial number issued by the certificate authority. For consistency,
        if this value is alphanumeric, it should be formatted without colons and uppercase
        characters.
      example: 55FBB9C7DEBF09809D12CCAA
      default_field: false
    - name: x509.signature_algorithm
      level: extended
      type: keyword
      ignore_above: 1024
      description: Identifier for certificate signature algorithm. We recommend using
        names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353.
      example: SHA256-RSA
      default_field: false
    - name: x509.subject.common_name
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of common names (CN) of subject.
      example: shared.global.example.net
      default_field: false
    - name: x509.subject.country
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of country (C) code
      example: US
      default_field: false
    - name: x509.subject.distinguished_name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Distinguished name (DN) of the certificate subject entity.
      example: C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net
      default_field: false
    - name: x509.subject.locality
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of locality names (L)
      example: San Francisco
      default_field: false
    - name: x509.subject.organization
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of organizations (O) of subject.
      example: Example, Inc.
      default_field: false
    - name: x509.subject.organizational_unit
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of organizational units (OU) of subject.
      default_field: false
    - name: x509.subject.state_or_province
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of state or province names (ST, S, or P)
      example: California
      default_field: false
    - name: x509.version_number
      level: extended
      type: keyword
      ignore_above: 1024
      description: Version of x509 format.
      example: 3
      default_field: false
  - name: geo
    title: Geo
    group: 2
    description: 'Geo fields can carry data about a specific location related to an
      event.

      This geolocation information can be derived from techniques such as Geo IP,
      or be user-supplied.'
    type: group
    default_field: true
    fields:
    - name: city_name
      level: core
      type: keyword
      ignore_above: 1024
      description: City name.
      example: Montreal
    - name: continent_code
      level: core
      type: keyword
      ignore_above: 1024
      description: Two-letter code representing continent's name.
      example: NA
      default_field: false
    - name: continent_name
      level: core
      type: keyword
      ignore_above: 1024
      description: Name of the continent.
      example: North America
    - name: country_iso_code
      level: core
      type: keyword
      ignore_above: 1024
      description: Country ISO code.
      example: CA
    - name: country_name
      level: core
      type: keyword
      ignore_above: 1024
      description: Country name.
      example: Canada
    - name: location
      level: core
      type: geo_point
      description: Longitude and latitude.
      example: '{ "lon": -73.614830, "lat": 45.505918 }'
    - name: name
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'User-defined description of a location, at the level of granularity
        they care about.

        Could be the name of their data centers, the floor number, if this describes
        a local physical entity, city names.

        Not typically used in automated geolocation.'
      example: boston-dc
    - name: postal_code
      level: core
      type: keyword
      ignore_above: 1024
      description: 'Postal code associated with the location.

        Values appropriate for this field may also be known as a postcode or ZIP code
        and will vary widely from country to country.'
      example: 94040
      default_field: false
    - name: region_iso_code
      level: core
      type: keyword
      ignore_above: 1024
      description: Region ISO code.
      example: CA-QC
    - name: region_name
      level: core
      type: keyword
      ignore_above: 1024
      description: Region name.
      example: Quebec
    - name: timezone
      level: core
      type: keyword
      ignore_above: 1024
      description: The time zone of the location, such as IANA time zone name.
      example: America/Argentina/Buenos_Aires
      default_field: false
  - name: group
    title: Group
    group: 2
    description: The group fields are meant to represent groups that are relevant
      to the event.
    type: group
    default_field: true
    fields:
    - name: domain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Name of the directory the group is a member of.

        For example, an LDAP or Active Directory domain name.'
    - name: id
      level: extended
      type: keyword
      ignore_above: 1024
      description: Unique identifier for the group on the system/platform.
    - name: name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Name of the group.
  - name: hash
    title: Hash
    group: 2
    description: 'The hash fields represent different bitwise hash algorithms and
      their values.

      Field names for common hashes (e.g. MD5, SHA1) are predefined. Add fields for
      other hashes by lowercasing the hash algorithm name and using underscore separators
      as appropriate (snake case, e.g. sha3_512).

      Note that this fieldset is used for common hashes that may be computed over
      a range of generic bytes. Entity-specific hashes such as ja3 or imphash are
      placed in the fieldsets to which they relate (tls and pe, respectively).'
    type: group
    default_field: true
    fields:
    - name: md5
      level: extended
      type: keyword
      ignore_above: 1024
      description: MD5 hash.
    - name: sha1
      level: extended
      type: keyword
      ignore_above: 1024
      description: SHA1 hash.
    - name: sha256
      level: extended
      type: keyword
      ignore_above: 1024
      description: SHA256 hash.
    - name: sha512
      level: extended
      type: keyword
      ignore_above: 1024
      description: SHA512 hash.
    - name: ssdeep
      level: extended
      type: keyword
      ignore_above: 1024
      description: SSDEEP hash.
      default_field: false
  - name: host
    title: Host
    group: 2
    description: 'A host is defined as a general computing instance.

      ECS host.* fields should be populated with details about the host on which the
      event happened, or from which the measurement was taken. Host types include
      hardware, virtual machines, Docker containers, and Kubernetes nodes.'
    type: group
    default_field: true
    fields:
    - name: architecture
      level: core
      type: keyword
      ignore_above: 1024
      description: Operating system architecture.
      example: x86_64
    - name: cpu.usage
      level: extended
      type: scaled_float
      description: 'Percent CPU used which is normalized by the number of CPU cores
        and it ranges from 0 to 1.

        Scaling factor: 1000.

        For example: For a two core host, this value should be the average of the
        two cores, between 0 and 1.'
      scaling_factor: 1000
      default_field: false
    - name: disk.read.bytes
      level: extended
      type: long
      description: The total number of bytes (gauge) read successfully (aggregated
        from all disks) since the last metric collection.
      default_field: false
    - name: disk.write.bytes
      level: extended
      type: long
      description: The total number of bytes (gauge) written successfully (aggregated
        from all disks) since the last metric collection.
      default_field: false
    - name: domain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Name of the domain of which the host is a member.

        For example, on Windows this could be the host''s Active Directory domain
        or NetBIOS domain name. For Linux this could be the domain of the host''s
        LDAP provider.'
      example: CONTOSO
      default_field: false
    - name: geo.city_name
      level: core
      type: keyword
      ignore_above: 1024
      description: City name.
      example: Montreal
    - name: geo.continent_code
      level: core
      type: keyword
      ignore_above: 1024
      description: Two-letter code representing continent's name.
      example: NA
      default_field: false
    - name: geo.continent_name
      level: core
      type: keyword
      ignore_above: 1024
      description: Name of the continent.
      example: North America
    - name: geo.country_iso_code
      level: core
      type: keyword
      ignore_above: 1024
      description: Country ISO code.
      example: CA
    - name: geo.country_name
      level: core
      type: keyword
      ignore_above: 1024
      description: Country name.
      example: Canada
    - name: geo.location
      level: core
      type: geo_point
      description: Longitude and latitude.
      example: '{ "lon": -73.614830, "lat": 45.505918 }'
    - name: geo.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'User-defined description of a location, at the level of granularity
        they care about.

        Could be the name of their data centers, the floor number, if this describes
        a local physical entity, city names.

        Not typically used in automated geolocation.'
      example: boston-dc
    - name: geo.postal_code
      level: core
      type: keyword
      ignore_above: 1024
      description: 'Postal code associated with the location.

        Values appropriate for this field may also be known as a postcode or ZIP code
        and will vary widely from country to country.'
      example: 94040
      default_field: false
    - name: geo.region_iso_code
      level: core
      type: keyword
      ignore_above: 1024
      description: Region ISO code.
      example: CA-QC
    - name: geo.region_name
      level: core
      type: keyword
      ignore_above: 1024
      description: Region name.
      example: Quebec
    - name: geo.timezone
      level: core
      type: keyword
      ignore_above: 1024
      description: The time zone of the location, such as IANA time zone name.
      example: America/Argentina/Buenos_Aires
      default_field: false
    - name: hostname
      level: core
      type: keyword
      ignore_above: 1024
      description: 'Hostname of the host.

        It normally contains what the `hostname` command returns on the host machine.'
    - name: id
      level: core
      type: keyword
      ignore_above: 1024
      description: 'Unique host id.

        As hostname is not always unique, use values that are meaningful in your environment.

        Example: The current usage of `beat.name`.'
    - name: ip
      level: core
      type: ip
      description: Host ip addresses.
    - name: mac
      level: core
      type: keyword
      ignore_above: 1024
      description: 'Host MAC addresses.

        The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit
        byte) is represented by two [uppercase] hexadecimal digits giving the value
        of the octet as an unsigned integer. Successive octets are separated by a
        hyphen.'
      example: '["00-00-5E-00-53-23", "00-00-5E-00-53-24"]'
    - name: name
      level: core
      type: keyword
      ignore_above: 1024
      description: 'Name of the host.

        It can contain what `hostname` returns on Unix systems, the fully qualified
        domain name, or a name specified by the user. The sender decides which value
        to use.'
    - name: network.egress.bytes
      level: extended
      type: long
      description: The number of bytes (gauge) sent out on all network interfaces
        by the host since the last metric collection.
      default_field: false
    - name: network.egress.packets
      level: extended
      type: long
      description: The number of packets (gauge) sent out on all network interfaces
        by the host since the last metric collection.
      default_field: false
    - name: network.ingress.bytes
      level: extended
      type: long
      description: The number of bytes received (gauge) on all network interfaces
        by the host since the last metric collection.
      default_field: false
    - name: network.ingress.packets
      level: extended
      type: long
      description: The number of packets (gauge) received on all network interfaces
        by the host since the last metric collection.
      default_field: false
    - name: os.family
      level: extended
      type: keyword
      ignore_above: 1024
      description: OS family (such as redhat, debian, freebsd, windows).
      example: debian
    - name: os.full
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: match_only_text
        default_field: false
      description: Operating system name, including the version or code name.
      example: Mac OS Mojave
    - name: os.kernel
      level: extended
      type: keyword
      ignore_above: 1024
      description: Operating system kernel version as a raw string.
      example: 4.4.0-112-generic
    - name: os.name
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: match_only_text
        default_field: false
      description: Operating system name, without the version.
      example: Mac OS X
    - name: os.platform
      level: extended
      type: keyword
      ignore_above: 1024
      description: Operating system platform (such centos, ubuntu, windows).
      example: darwin
    - name: os.type
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Use the `os.type` field to categorize the operating system into
        one of the broad commercial families.

        One of these following values should be used (lowercase): linux, macos, unix,
        windows.

        If the OS you''re dealing with is not in the list, the field should not be
        populated. Please let us know by opening an issue with ECS, to propose its
        addition.'
      example: macos
      default_field: false
    - name: os.version
      level: extended
      type: keyword
      ignore_above: 1024
      description: Operating system version as a raw string.
      example: 10.14.1
    - name: type
      level: core
      type: keyword
      ignore_above: 1024
      description: 'Type of host.

        For Cloud providers this can be the machine type like `t2.medium`. If vm,
        this could be the container, for example, or other information meaningful
        in your environment.'
    - name: uptime
      level: extended
      type: long
      description: Seconds the host has been up.
      example: 1325
  - name: http
    title: HTTP
    group: 2
    description: Fields related to HTTP activity. Use the `url` field set to store
      the url of the request.
    type: group
    default_field: true
    fields:
    - name: request.body.bytes
      level: extended
      type: long
      format: bytes
      description: Size in bytes of the request body.
      example: 887
    - name: request.body.content
      level: extended
      type: wildcard
      multi_fields:
      - name: text
        type: match_only_text
        default_field: false
      description: The full HTTP request body.
      example: Hello world
    - name: request.bytes
      level: extended
      type: long
      format: bytes
      description: Total size in bytes of the request (body and headers).
      example: 1437
    - name: request.id
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'A unique identifier for each HTTP request to correlate logs between
        clients and servers in transactions.

        The id may be contained in a non-standard HTTP header, such as `X-Request-ID`
        or `X-Correlation-ID`.'
      example: 123e4567-e89b-12d3-a456-426614174000
      default_field: false
    - name: request.method
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'HTTP request method.

        The value should retain its casing from the original event. For example, `GET`,
        `get`, and `GeT` are all considered valid values for this field.'
      example: POST
    - name: request.mime_type
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Mime type of the body of the request.

        This value must only be populated based on the content of the request body,
        not on the `Content-Type` header. Comparing the mime type of a request with
        the request''s Content-Type header can be helpful in detecting threats or
        misconfigured clients.'
      example: image/gif
      default_field: false
    - name: request.referrer
      level: extended
      type: keyword
      ignore_above: 1024
      description: Referrer for this HTTP request.
      example: https://blog.example.com/
    - name: response.body.bytes
      level: extended
      type: long
      format: bytes
      description: Size in bytes of the response body.
      example: 887
    - name: response.body.content
      level: extended
      type: wildcard
      multi_fields:
      - name: text
        type: match_only_text
        default_field: false
      description: The full HTTP response body.
      example: Hello world
    - name: response.bytes
      level: extended
      type: long
      format: bytes
      description: Total size in bytes of the response (body and headers).
      example: 1437
    - name: response.mime_type
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Mime type of the body of the response.

        This value must only be populated based on the content of the response body,
        not on the `Content-Type` header. Comparing the mime type of a response with
        the response''s Content-Type header can be helpful in detecting misconfigured
        servers.'
      example: image/gif
      default_field: false
    - name: response.status_code
      level: extended
      type: long
      format: string
      description: HTTP response status code.
      example: 404
    - name: version
      level: extended
      type: keyword
      ignore_above: 1024
      description: HTTP version.
      example: 1.1
  - name: interface
    title: Interface
    group: 2
    description: The interface fields are used to record ingress and egress interface
      information when reported by an observer (e.g. firewall, router, load balancer)
      in the context of the observer handling a network connection.  In the case of
      a single observer interface (e.g. network sensor on a span port) only the observer.ingress
      information should be populated.
    type: group
    default_field: true
    fields:
    - name: alias
      level: extended
      type: keyword
      ignore_above: 1024
      description: Interface alias as reported by the system, typically used in firewall
        implementations for e.g. inside, outside, or dmz logical interface naming.
      example: outside
      default_field: false
    - name: id
      level: extended
      type: keyword
      ignore_above: 1024
      description: Interface ID as reported by an observer (typically SNMP interface
        ID).
      example: 10
      default_field: false
    - name: name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Interface name as reported by the system.
      example: eth0
      default_field: false
  - name: log
    title: Log
    group: 2
    description: 'Details about the event''s logging mechanism or logging transport.

      The log.* fields are typically populated with details about the logging mechanism
      used to create and/or transport the event. For example, syslog details belong
      under `log.syslog.*`.

      The details specific to your event source are typically not logged under `log.*`,
      but rather in `event.*` or in other ECS fields.'
    type: group
    default_field: true
    fields:
    - name: file.path
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Full path to the log file this event came from, including the
        file name. It should include the drive letter, when appropriate.

        If the event wasn''t read from a log file, do not populate this field.'
      example: /var/log/fun-times.log
      default_field: false
    - name: level
      level: core
      type: keyword
      ignore_above: 1024
      description: 'Original log level of the log event.

        If the source of the event provides a log level or textual severity, this
        is the one that goes in `log.level`. If your source doesn''t specify one,
        you may put your event transport''s severity here (e.g. Syslog severity).

        Some examples are `warn`, `err`, `i`, `informational`.'
      example: error
    - name: logger
      level: core
      type: keyword
      ignore_above: 1024
      description: The name of the logger inside an application. This is usually the
        name of the class which initialized the logger, or can be a custom name.
      example: org.elasticsearch.bootstrap.Bootstrap
    - name: origin.file.line
      level: extended
      type: long
      description: The line number of the file containing the source code which originated
        the log event.
      example: 42
    - name: origin.file.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The name of the file containing the source code which originated
        the log event.

        Note that this field is not meant to capture the log file. The correct field
        to capture the log file is `log.file.path`.'
      example: Bootstrap.java
    - name: origin.function
      level: extended
      type: keyword
      ignore_above: 1024
      description: The name of the function or method which originated the log event.
      example: init
    - name: syslog
      level: extended
      type: object
      description: The Syslog metadata of the event, if the event was transmitted
        via Syslog. Please see RFCs 5424 or 3164.
    - name: syslog.facility.code
      level: extended
      type: long
      format: string
      description: 'The Syslog numeric facility of the log event, if available.

        According to RFCs 5424 and 3164, this value should be an integer between 0
        and 23.'
      example: 23
    - name: syslog.facility.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: The Syslog text-based facility of the log event, if available.
      example: local7
    - name: syslog.priority
      level: extended
      type: long
      format: string
      description: 'Syslog numeric priority of the event, if available.

        According to RFCs 5424 and 3164, the priority is 8 * facility + severity.
        This number is therefore expected to contain a value between 0 and 191.'
      example: 135
    - name: syslog.severity.code
      level: extended
      type: long
      description: 'The Syslog numeric severity of the log event, if available.

        If the event source publishing via Syslog provides a different numeric severity
        value (e.g. firewall, IDS), your source''s numeric severity should go to `event.severity`.
        If the event source does not specify a distinct severity, you can optionally
        copy the Syslog severity to `event.severity`.'
      example: 3
    - name: syslog.severity.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The Syslog numeric severity of the log event, if available.

        If the event source publishing via Syslog provides a different severity value
        (e.g. firewall, IDS), your source''s text severity should go to `log.level`.
        If the event source does not specify a distinct severity, you can optionally
        copy the Syslog severity to `log.level`.'
      example: Error
  - name: network
    title: Network
    group: 2
    description: 'The network is defined as the communication path over which a host
      or network event happens.

      The network.* fields should be populated with details about the network activity
      associated with an event.'
    type: group
    default_field: true
    fields:
    - name: application
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'When a specific application or service is identified from network
        connection details (source/dest IPs, ports, certificates, or wire format),
        this field captures the application''s or service''s name.

        For example, the original event identifies the network connection being from
        a specific web service in a `https` network connection, like `facebook` or
        `twitter`.

        The field value must be normalized to lowercase for querying.'
      example: aim
    - name: bytes
      level: core
      type: long
      format: bytes
      description: 'Total bytes transferred in both directions.

        If `source.bytes` and `destination.bytes` are known, `network.bytes` is their
        sum.'
      example: 368
    - name: community_id
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'A hash of source and destination IPs and ports, as well as the
        protocol used in a communication. This is a tool-agnostic standard to identify
        flows.

        Learn more at https://github.com/corelight/community-id-spec.'
      example: 1:hO+sN4H+MG5MY/8hIrXPqc4ZQz0=
    - name: direction
      level: core
      type: keyword
      ignore_above: 1024
      description: "Direction of the network traffic.\nRecommended values are:\n \
        \ * ingress\n  * egress\n  * inbound\n  * outbound\n  * internal\n  * external\n\
        \  * unknown\n\nWhen mapping events from a host-based monitoring context,\
        \ populate this field from the host's point of view, using the values \"ingress\"\
        \ or \"egress\".\nWhen mapping events from a network or perimeter-based monitoring\
        \ context, populate this field from the point of view of the network perimeter,\
        \ using the values \"inbound\", \"outbound\", \"internal\" or \"external\"\
        .\nNote that \"internal\" is not crossing perimeter boundaries, and is meant\
        \ to describe communication between two hosts within the perimeter. Note also\
        \ that \"external\" is meant to describe traffic between two hosts that are\
        \ external to the perimeter. This could for example be useful for ISPs or\
        \ VPN service providers."
      example: inbound
    - name: forwarded_ip
      level: core
      type: ip
      description: Host IP address when the source IP address is the proxy.
      example: 192.1.1.2
    - name: iana_number
      level: extended
      type: keyword
      ignore_above: 1024
      description: IANA Protocol Number (https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml).
        Standardized list of protocols. This aligns well with NetFlow and sFlow related
        logs which use the IANA Protocol Number.
      example: 6
    - name: inner
      level: extended
      type: object
      description: Network.inner fields are added in addition to network.vlan fields
        to describe the innermost VLAN when q-in-q VLAN tagging is present. Allowed
        fields include vlan.id and vlan.name. Inner vlan fields are typically used
        when sending traffic with multiple 802.1q encapsulations to a network sensor
        (e.g. Zeek, Wireshark.)
      default_field: false
    - name: inner.vlan.id
      level: extended
      type: keyword
      ignore_above: 1024
      description: VLAN ID as reported by the observer.
      example: 10
      default_field: false
    - name: inner.vlan.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Optional VLAN name as reported by the observer.
      example: outside
      default_field: false
    - name: name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Name given by operators to sections of their network.
      example: Guest Wifi
    - name: packets
      level: core
      type: long
      description: 'Total packets transferred in both directions.

        If `source.packets` and `destination.packets` are known, `network.packets`
        is their sum.'
      example: 24
    - name: protocol
      level: core
      type: keyword
      ignore_above: 1024
      description: 'In the OSI Model this would be the Application Layer protocol.
        For example, `http`, `dns`, or `ssh`.

        The field value must be normalized to lowercase for querying.'
      example: http
    - name: transport
      level: core
      type: keyword
      ignore_above: 1024
      description: 'Same as network.iana_number, but instead using the Keyword name
        of the transport layer (udp, tcp, ipv6-icmp, etc.)

        The field value must be normalized to lowercase for querying.'
      example: tcp
    - name: type
      level: core
      type: keyword
      ignore_above: 1024
      description: 'In the OSI Model this would be the Network Layer. ipv4, ipv6,
        ipsec, pim, etc

        The field value must be normalized to lowercase for querying.'
      example: ipv4
    - name: vlan.id
      level: extended
      type: keyword
      ignore_above: 1024
      description: VLAN ID as reported by the observer.
      example: 10
      default_field: false
    - name: vlan.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Optional VLAN name as reported by the observer.
      example: outside
      default_field: false
  - name: observer
    title: Observer
    group: 2
    description: 'An observer is defined as a special network, security, or application
      device used to detect, observe, or create network, security, or application-related
      events and metrics.

      This could be a custom hardware appliance or a server that has been configured
      to run special network, security, or application software. Examples include
      firewalls, web proxies, intrusion detection/prevention systems, network monitoring
      sensors, web application firewalls, data loss prevention systems, and APM servers.
      The observer.* fields shall be populated with details of the system, if any,
      that detects, observes and/or creates a network, security, or application event
      or metric. Message queues and ETL components used in processing events or metrics
      are not considered observers in ECS.'
    type: group
    default_field: true
    fields:
    - name: egress
      level: extended
      type: object
      description: Observer.egress holds information like interface number and name,
        vlan, and zone information to classify egress traffic.  Single armed monitoring
        such as a network sensor on a span port should only use observer.ingress to
        categorize traffic.
      default_field: false
    - name: egress.interface.alias
      level: extended
      type: keyword
      ignore_above: 1024
      description: Interface alias as reported by the system, typically used in firewall
        implementations for e.g. inside, outside, or dmz logical interface naming.
      example: outside
      default_field: false
    - name: egress.interface.id
      level: extended
      type: keyword
      ignore_above: 1024
      description: Interface ID as reported by an observer (typically SNMP interface
        ID).
      example: 10
      default_field: false
    - name: egress.interface.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Interface name as reported by the system.
      example: eth0
      default_field: false
    - name: egress.vlan.id
      level: extended
      type: keyword
      ignore_above: 1024
      description: VLAN ID as reported by the observer.
      example: 10
      default_field: false
    - name: egress.vlan.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Optional VLAN name as reported by the observer.
      example: outside
      default_field: false
    - name: egress.zone
      level: extended
      type: keyword
      ignore_above: 1024
      description: Network zone of outbound traffic as reported by the observer to
        categorize the destination area of egress traffic, e.g. Internal, External,
        DMZ, HR, Legal, etc.
      example: Public_Internet
      default_field: false
    - name: geo.city_name
      level: core
      type: keyword
      ignore_above: 1024
      description: City name.
      example: Montreal
    - name: geo.continent_code
      level: core
      type: keyword
      ignore_above: 1024
      description: Two-letter code representing continent's name.
      example: NA
      default_field: false
    - name: geo.continent_name
      level: core
      type: keyword
      ignore_above: 1024
      description: Name of the continent.
      example: North America
    - name: geo.country_iso_code
      level: core
      type: keyword
      ignore_above: 1024
      description: Country ISO code.
      example: CA
    - name: geo.country_name
      level: core
      type: keyword
      ignore_above: 1024
      description: Country name.
      example: Canada
    - name: geo.location
      level: core
      type: geo_point
      description: Longitude and latitude.
      example: '{ "lon": -73.614830, "lat": 45.505918 }'
    - name: geo.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'User-defined description of a location, at the level of granularity
        they care about.

        Could be the name of their data centers, the floor number, if this describes
        a local physical entity, city names.

        Not typically used in automated geolocation.'
      example: boston-dc
    - name: geo.postal_code
      level: core
      type: keyword
      ignore_above: 1024
      description: 'Postal code associated with the location.

        Values appropriate for this field may also be known as a postcode or ZIP code
        and will vary widely from country to country.'
      example: 94040
      default_field: false
    - name: geo.region_iso_code
      level: core
      type: keyword
      ignore_above: 1024
      description: Region ISO code.
      example: CA-QC
    - name: geo.region_name
      level: core
      type: keyword
      ignore_above: 1024
      description: Region name.
      example: Quebec
    - name: geo.timezone
      level: core
      type: keyword
      ignore_above: 1024
      description: The time zone of the location, such as IANA time zone name.
      example: America/Argentina/Buenos_Aires
      default_field: false
    - name: hostname
      level: core
      type: keyword
      ignore_above: 1024
      description: Hostname of the observer.
    - name: ingress
      level: extended
      type: object
      description: Observer.ingress holds information like interface number and name,
        vlan, and zone information to classify ingress traffic.  Single armed monitoring
        such as a network sensor on a span port should only use observer.ingress to
        categorize traffic.
      default_field: false
    - name: ingress.interface.alias
      level: extended
      type: keyword
      ignore_above: 1024
      description: Interface alias as reported by the system, typically used in firewall
        implementations for e.g. inside, outside, or dmz logical interface naming.
      example: outside
      default_field: false
    - name: ingress.interface.id
      level: extended
      type: keyword
      ignore_above: 1024
      description: Interface ID as reported by an observer (typically SNMP interface
        ID).
      example: 10
      default_field: false
    - name: ingress.interface.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Interface name as reported by the system.
      example: eth0
      default_field: false
    - name: ingress.vlan.id
      level: extended
      type: keyword
      ignore_above: 1024
      description: VLAN ID as reported by the observer.
      example: 10
      default_field: false
    - name: ingress.vlan.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Optional VLAN name as reported by the observer.
      example: outside
      default_field: false
    - name: ingress.zone
      level: extended
      type: keyword
      ignore_above: 1024
      description: Network zone of incoming traffic as reported by the observer to
        categorize the source area of ingress traffic. e.g. internal, External, DMZ,
        HR, Legal, etc.
      example: DMZ
      default_field: false
    - name: ip
      level: core
      type: ip
      description: IP addresses of the observer.
    - name: mac
      level: core
      type: keyword
      ignore_above: 1024
      description: 'MAC addresses of the observer.

        The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit
        byte) is represented by two [uppercase] hexadecimal digits giving the value
        of the octet as an unsigned integer. Successive octets are separated by a
        hyphen.'
      example: '["00-00-5E-00-53-23", "00-00-5E-00-53-24"]'
    - name: name
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Custom name of the observer.

        This is a name that can be given to an observer. This can be helpful for example
        if multiple firewalls of the same model are used in an organization.

        If no custom name is needed, the field can be left empty.'
      example: 1_proxySG
    - name: os.family
      level: extended
      type: keyword
      ignore_above: 1024
      description: OS family (such as redhat, debian, freebsd, windows).
      example: debian
    - name: os.full
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: match_only_text
        default_field: false
      description: Operating system name, including the version or code name.
      example: Mac OS Mojave
    - name: os.kernel
      level: extended
      type: keyword
      ignore_above: 1024
      description: Operating system kernel version as a raw string.
      example: 4.4.0-112-generic
    - name: os.name
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: match_only_text
        default_field: false
      description: Operating system name, without the version.
      example: Mac OS X
    - name: os.platform
      level: extended
      type: keyword
      ignore_above: 1024
      description: Operating system platform (such centos, ubuntu, windows).
      example: darwin
    - name: os.type
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Use the `os.type` field to categorize the operating system into
        one of the broad commercial families.

        One of these following values should be used (lowercase): linux, macos, unix,
        windows.

        If the OS you''re dealing with is not in the list, the field should not be
        populated. Please let us know by opening an issue with ECS, to propose its
        addition.'
      example: macos
      default_field: false
    - name: os.version
      level: extended
      type: keyword
      ignore_above: 1024
      description: Operating system version as a raw string.
      example: 10.14.1
    - name: product
      level: extended
      type: keyword
      ignore_above: 1024
      description: The product name of the observer.
      example: s200
    - name: serial_number
      level: extended
      type: keyword
      ignore_above: 1024
      description: Observer serial number.
    - name: type
      level: core
      type: keyword
      ignore_above: 1024
      description: 'The type of the observer the data is coming from.

        There is no predefined list of observer types. Some examples are `forwarder`,
        `firewall`, `ids`, `ips`, `proxy`, `poller`, `sensor`, `APM server`.'
      example: firewall
    - name: vendor
      level: core
      type: keyword
      ignore_above: 1024
      description: Vendor name of the observer.
      example: Symantec
    - name: version
      level: core
      type: keyword
      ignore_above: 1024
      description: Observer version.
  - name: orchestrator
    title: Orchestrator
    group: 2
    description: Fields that describe the resources which container orchestrators
      manage or act upon.
    type: group
    default_field: true
    fields:
    - name: api_version
      level: extended
      type: keyword
      ignore_above: 1024
      description: API version being used to carry out the action
      example: v1beta1
      default_field: false
    - name: cluster.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Name of the cluster.
      default_field: false
    - name: cluster.url
      level: extended
      type: keyword
      ignore_above: 1024
      description: URL of the API used to manage the cluster.
      default_field: false
    - name: cluster.version
      level: extended
      type: keyword
      ignore_above: 1024
      description: The version of the cluster.
      default_field: false
    - name: namespace
      level: extended
      type: keyword
      ignore_above: 1024
      description: Namespace in which the action is taking place.
      example: kube-system
      default_field: false
    - name: organization
      level: extended
      type: keyword
      ignore_above: 1024
      description: Organization affected by the event (for multi-tenant orchestrator
        setups).
      example: elastic
      default_field: false
    - name: resource.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Name of the resource being acted upon.
      example: test-pod-cdcws
      default_field: false
    - name: resource.type
      level: extended
      type: keyword
      ignore_above: 1024
      description: Type of resource being acted upon.
      example: service
      default_field: false
    - name: type
      level: extended
      type: keyword
      ignore_above: 1024
      description: Orchestrator cluster type (e.g. kubernetes, nomad or cloudfoundry).
      example: kubernetes
      default_field: false
  - name: organization
    title: Organization
    group: 2
    description: 'The organization fields enrich data with information about the company
      or entity the data is associated with.

      These fields help you arrange or filter data stored in an index by one or multiple
      organizations.'
    type: group
    default_field: true
    fields:
    - name: id
      level: extended
      type: keyword
      ignore_above: 1024
      description: Unique identifier for the organization.
    - name: name
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: match_only_text
        default_field: false
      description: Organization name.
  - name: os
    title: Operating System
    group: 2
    description: The OS fields contain information about the operating system.
    type: group
    default_field: true
    fields:
    - name: family
      level: extended
      type: keyword
      ignore_above: 1024
      description: OS family (such as redhat, debian, freebsd, windows).
      example: debian
    - name: full
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: match_only_text
        default_field: false
      description: Operating system name, including the version or code name.
      example: Mac OS Mojave
    - name: kernel
      level: extended
      type: keyword
      ignore_above: 1024
      description: Operating system kernel version as a raw string.
      example: 4.4.0-112-generic
    - name: name
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: match_only_text
        default_field: false
      description: Operating system name, without the version.
      example: Mac OS X
    - name: platform
      level: extended
      type: keyword
      ignore_above: 1024
      description: Operating system platform (such centos, ubuntu, windows).
      example: darwin
    - name: type
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Use the `os.type` field to categorize the operating system into
        one of the broad commercial families.

        One of these following values should be used (lowercase): linux, macos, unix,
        windows.

        If the OS you''re dealing with is not in the list, the field should not be
        populated. Please let us know by opening an issue with ECS, to propose its
        addition.'
      example: macos
      default_field: false
    - name: version
      level: extended
      type: keyword
      ignore_above: 1024
      description: Operating system version as a raw string.
      example: 10.14.1
  - name: package
    title: Package
    group: 2
    description: These fields contain information about an installed software package.
      It contains general information about a package, such as name, version or size.
      It also contains installation details, such as time or location.
    type: group
    default_field: true
    fields:
    - name: architecture
      level: extended
      type: keyword
      ignore_above: 1024
      description: Package architecture.
      example: x86_64
    - name: build_version
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Additional information about the build version of the installed
        package.

        For example use the commit SHA of a non-released package.'
      example: 36f4f7e89dd61b0988b12ee000b98966867710cd
      default_field: false
    - name: checksum
      level: extended
      type: keyword
      ignore_above: 1024
      description: Checksum of the installed package for verification.
      example: 68b329da9893e34099c7d8ad5cb9c940
    - name: description
      level: extended
      type: keyword
      ignore_above: 1024
      description: Description of the package.
      example: Open source programming language to build simple/reliable/efficient
        software.
    - name: install_scope
      level: extended
      type: keyword
      ignore_above: 1024
      description: Indicating how the package was installed, e.g. user-local, global.
      example: global
    - name: installed
      level: extended
      type: date
      description: Time when package was installed.
    - name: license
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'License under which the package was released.

        Use a short name, e.g. the license identifier from SPDX License List where
        possible (https://spdx.org/licenses/).'
      example: Apache License 2.0
    - name: name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Package name
      example: go
    - name: path
      level: extended
      type: keyword
      ignore_above: 1024
      description: Path where the package is installed.
      example: /usr/local/Cellar/go/1.12.9/
    - name: reference
      level: extended
      type: keyword
      ignore_above: 1024
      description: Home page or reference URL of the software in this package, if
        available.
      example: https://golang.org
      default_field: false
    - name: size
      level: extended
      type: long
      format: string
      description: Package size in bytes.
      example: 62231
    - name: type
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Type of package.

        This should contain the package file type, rather than the package manager
        name. Examples: rpm, dpkg, brew, npm, gem, nupkg, jar.'
      example: rpm
      default_field: false
    - name: version
      level: extended
      type: keyword
      ignore_above: 1024
      description: Package version
      example: 1.12.9
  - name: pe
    title: PE Header
    group: 2
    description: These fields contain Windows Portable Executable (PE) metadata.
    type: group
    default_field: true
    fields:
    - name: architecture
      level: extended
      type: keyword
      ignore_above: 1024
      description: CPU architecture target for the file.
      example: x64
      default_field: false
    - name: company
      level: extended
      type: keyword
      ignore_above: 1024
      description: Internal company name of the file, provided at compile-time.
      example: Microsoft Corporation
      default_field: false
    - name: description
      level: extended
      type: keyword
      ignore_above: 1024
      description: Internal description of the file, provided at compile-time.
      example: Paint
      default_field: false
    - name: file_version
      level: extended
      type: keyword
      ignore_above: 1024
      description: Internal version of the file, provided at compile-time.
      example: 6.3.9600.17415
      default_field: false
    - name: imphash
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'A hash of the imports in a PE file. An imphash -- or import hash
        -- can be used to fingerprint binaries even after recompilation or other code-level
        transformations have occurred, which would change more traditional hash values.

        Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.'
      example: 0c6803c4e922103c4dca5963aad36ddf
      default_field: false
    - name: original_file_name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Internal name of the file, provided at compile-time.
      example: MSPAINT.EXE
      default_field: false
    - name: product
      level: extended
      type: keyword
      ignore_above: 1024
      description: Internal product name of the file, provided at compile-time.
      example: "Microsoft\xAE Windows\xAE Operating System"
      default_field: false
  - name: process
    title: Process
    group: 2
    description: 'These fields contain information about a process.

      These fields can help you correlate metrics information with a process id/name
      from a log message.  The `process.pid` often stays in the metric itself and
      is copied to the global field for correlation.'
    type: group
    default_field: true
    fields:
    - name: args
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Array of process arguments, starting with the absolute path to
        the executable.

        May be filtered to protect sensitive information.'
      example: '["/usr/bin/ssh", "-l", "user", "10.0.0.16"]'
    - name: args_count
      level: extended
      type: long
      description: 'Length of the process.args array.

        This field can be useful for querying or performing bucket analysis on how
        many arguments were provided to start a process. More arguments may be an
        indication of suspicious activity.'
      example: 4
      default_field: false
    - name: code_signature.digest_algorithm
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The hashing algorithm used to sign the process.

        This value can distinguish signatures when a file is signed multiple times
        by the same signer but with a different digest algorithm.'
      example: sha256
      default_field: false
    - name: code_signature.exists
      level: core
      type: boolean
      description: Boolean to capture if a signature is present.
      example: 'true'
      default_field: false
    - name: code_signature.signing_id
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The identifier used to sign the process.

        This is used to identify the application manufactured by a software vendor.
        The field is relevant to Apple *OS only.'
      example: com.apple.xpc.proxy
      default_field: false
    - name: code_signature.status
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Additional information about the certificate status.

        This is useful for logging cryptographic errors with the certificate validity
        or trust status. Leave unpopulated if the validity or trust of the certificate
        was unchecked.'
      example: ERROR_UNTRUSTED_ROOT
      default_field: false
    - name: code_signature.subject_name
      level: core
      type: keyword
      ignore_above: 1024
      description: Subject name of the code signer
      example: Microsoft Corporation
      default_field: false
    - name: code_signature.team_id
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The team identifier used to sign the process.

        This is used to identify the team or vendor of a software product. The field
        is relevant to Apple *OS only.'
      example: EQHXZ8M8AV
      default_field: false
    - name: code_signature.timestamp
      level: extended
      type: date
      description: Date and time when the code signature was generated and signed.
      example: '2021-01-01T12:10:30Z'
      default_field: false
    - name: code_signature.trusted
      level: extended
      type: boolean
      description: 'Stores the trust status of the certificate chain.

        Validating the trust of the certificate chain may be complicated, and this
        field should only be populated by tools that actively check the status.'
      example: 'true'
      default_field: false
    - name: code_signature.valid
      level: extended
      type: boolean
      description: 'Boolean to capture if the digital signature is verified against
        the binary content.

        Leave unpopulated if a certificate was unchecked.'
      example: 'true'
      default_field: false
    - name: command_line
      level: extended
      type: wildcard
      multi_fields:
      - name: text
        type: match_only_text
      description: 'Full command line that started the process, including the absolute
        path to the executable, and all arguments.

        Some arguments may be filtered to protect sensitive information.'
      example: /usr/bin/ssh -l user 10.0.0.16
      default_field: false
    - name: elf.architecture
      level: extended
      type: keyword
      ignore_above: 1024
      description: Machine architecture of the ELF file.
      example: x86-64
      default_field: false
    - name: elf.byte_order
      level: extended
      type: keyword
      ignore_above: 1024
      description: Byte sequence of ELF file.
      example: Little Endian
      default_field: false
    - name: elf.cpu_type
      level: extended
      type: keyword
      ignore_above: 1024
      description: CPU type of the ELF file.
      example: Intel
      default_field: false
    - name: elf.creation_date
      level: extended
      type: date
      description: Extracted when possible from the file's metadata. Indicates when
        it was built or compiled. It can also be faked by malware creators.
      default_field: false
    - name: elf.exports
      level: extended
      type: flattened
      description: List of exported element names and types.
      default_field: false
    - name: elf.header.abi_version
      level: extended
      type: keyword
      ignore_above: 1024
      description: Version of the ELF Application Binary Interface (ABI).
      default_field: false
    - name: elf.header.class
      level: extended
      type: keyword
      ignore_above: 1024
      description: Header class of the ELF file.
      default_field: false
    - name: elf.header.data
      level: extended
      type: keyword
      ignore_above: 1024
      description: Data table of the ELF header.
      default_field: false
    - name: elf.header.entrypoint
      level: extended
      type: long
      format: string
      description: Header entrypoint of the ELF file.
      default_field: false
    - name: elf.header.object_version
      level: extended
      type: keyword
      ignore_above: 1024
      description: '"0x1" for original ELF files.'
      default_field: false
    - name: elf.header.os_abi
      level: extended
      type: keyword
      ignore_above: 1024
      description: Application Binary Interface (ABI) of the Linux OS.
      default_field: false
    - name: elf.header.type
      level: extended
      type: keyword
      ignore_above: 1024
      description: Header type of the ELF file.
      default_field: false
    - name: elf.header.version
      level: extended
      type: keyword
      ignore_above: 1024
      description: Version of the ELF header.
      default_field: false
    - name: elf.imports
      level: extended
      type: flattened
      description: List of imported element names and types.
      default_field: false
    - name: elf.sections
      level: extended
      type: nested
      description: 'An array containing an object for each section of the ELF file.

        The keys that should be present in these objects are defined by sub-fields
        underneath `elf.sections.*`.'
      default_field: false
    - name: elf.sections.chi2
      level: extended
      type: long
      format: number
      description: Chi-square probability distribution of the section.
      default_field: false
    - name: elf.sections.entropy
      level: extended
      type: long
      format: number
      description: Shannon entropy calculation from the section.
      default_field: false
    - name: elf.sections.flags
      level: extended
      type: keyword
      ignore_above: 1024
      description: ELF Section List flags.
      default_field: false
    - name: elf.sections.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: ELF Section List name.
      default_field: false
    - name: elf.sections.physical_offset
      level: extended
      type: keyword
      ignore_above: 1024
      description: ELF Section List offset.
      default_field: false
    - name: elf.sections.physical_size
      level: extended
      type: long
      format: bytes
      description: ELF Section List physical size.
      default_field: false
    - name: elf.sections.type
      level: extended
      type: keyword
      ignore_above: 1024
      description: ELF Section List type.
      default_field: false
    - name: elf.sections.virtual_address
      level: extended
      type: long
      format: string
      description: ELF Section List virtual address.
      default_field: false
    - name: elf.sections.virtual_size
      level: extended
      type: long
      format: string
      description: ELF Section List virtual size.
      default_field: false
    - name: elf.segments
      level: extended
      type: nested
      description: 'An array containing an object for each segment of the ELF file.

        The keys that should be present in these objects are defined by sub-fields
        underneath `elf.segments.*`.'
      default_field: false
    - name: elf.segments.sections
      level: extended
      type: keyword
      ignore_above: 1024
      description: ELF object segment sections.
      default_field: false
    - name: elf.segments.type
      level: extended
      type: keyword
      ignore_above: 1024
      description: ELF object segment type.
      default_field: false
    - name: elf.shared_libraries
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of shared libraries used by this ELF object.
      default_field: false
    - name: elf.telfhash
      level: extended
      type: keyword
      ignore_above: 1024
      description: telfhash symbol hash for ELF file.
      default_field: false
    - name: end
      level: extended
      type: date
      description: The time the process ended.
      example: '2016-05-23T08:05:34.853Z'
      default_field: false
    - name: entity_id
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Unique identifier for the process.

        The implementation of this is specified by the data source, but some examples
        of what could be used here are a process-generated UUID, Sysmon Process GUIDs,
        or a hash of some uniquely identifying components of a process.

        Constructing a globally unique identifier is a common practice to mitigate
        PID reuse as well as to identify a specific process over time, across multiple
        monitored hosts.'
      example: c2c455d9f99375d
      default_field: false
    - name: executable
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: match_only_text
        default_field: false
      description: Absolute path to the process executable.
      example: /usr/bin/ssh
    - name: exit_code
      level: extended
      type: long
      description: 'The exit code of the process, if this is a termination event.

        The field should be absent if there is no exit code for the event (e.g. process
        start).'
      example: 137
      default_field: false
    - name: hash.md5
      level: extended
      type: keyword
      ignore_above: 1024
      description: MD5 hash.
    - name: hash.sha1
      level: extended
      type: keyword
      ignore_above: 1024
      description: SHA1 hash.
    - name: hash.sha256
      level: extended
      type: keyword
      ignore_above: 1024
      description: SHA256 hash.
    - name: hash.sha512
      level: extended
      type: keyword
      ignore_above: 1024
      description: SHA512 hash.
    - name: hash.ssdeep
      level: extended
      type: keyword
      ignore_above: 1024
      description: SSDEEP hash.
      default_field: false
    - name: name
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: match_only_text
        default_field: false
      description: 'Process name.

        Sometimes called program name or similar.'
      example: ssh
    - name: parent.args
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Array of process arguments, starting with the absolute path to
        the executable.

        May be filtered to protect sensitive information.'
      example: '["/usr/bin/ssh", "-l", "user", "10.0.0.16"]'
      default_field: false
    - name: parent.args_count
      level: extended
      type: long
      description: 'Length of the process.args array.

        This field can be useful for querying or performing bucket analysis on how
        many arguments were provided to start a process. More arguments may be an
        indication of suspicious activity.'
      example: 4
      default_field: false
    - name: parent.code_signature.digest_algorithm
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The hashing algorithm used to sign the process.

        This value can distinguish signatures when a file is signed multiple times
        by the same signer but with a different digest algorithm.'
      example: sha256
      default_field: false
    - name: parent.code_signature.exists
      level: core
      type: boolean
      description: Boolean to capture if a signature is present.
      example: 'true'
      default_field: false
    - name: parent.code_signature.signing_id
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The identifier used to sign the process.

        This is used to identify the application manufactured by a software vendor.
        The field is relevant to Apple *OS only.'
      example: com.apple.xpc.proxy
      default_field: false
    - name: parent.code_signature.status
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Additional information about the certificate status.

        This is useful for logging cryptographic errors with the certificate validity
        or trust status. Leave unpopulated if the validity or trust of the certificate
        was unchecked.'
      example: ERROR_UNTRUSTED_ROOT
      default_field: false
    - name: parent.code_signature.subject_name
      level: core
      type: keyword
      ignore_above: 1024
      description: Subject name of the code signer
      example: Microsoft Corporation
      default_field: false
    - name: parent.code_signature.team_id
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The team identifier used to sign the process.

        This is used to identify the team or vendor of a software product. The field
        is relevant to Apple *OS only.'
      example: EQHXZ8M8AV
      default_field: false
    - name: parent.code_signature.timestamp
      level: extended
      type: date
      description: Date and time when the code signature was generated and signed.
      example: '2021-01-01T12:10:30Z'
      default_field: false
    - name: parent.code_signature.trusted
      level: extended
      type: boolean
      description: 'Stores the trust status of the certificate chain.

        Validating the trust of the certificate chain may be complicated, and this
        field should only be populated by tools that actively check the status.'
      example: 'true'
      default_field: false
    - name: parent.code_signature.valid
      level: extended
      type: boolean
      description: 'Boolean to capture if the digital signature is verified against
        the binary content.

        Leave unpopulated if a certificate was unchecked.'
      example: 'true'
      default_field: false
    - name: parent.command_line
      level: extended
      type: wildcard
      multi_fields:
      - name: text
        type: match_only_text
      description: 'Full command line that started the process, including the absolute
        path to the executable, and all arguments.

        Some arguments may be filtered to protect sensitive information.'
      example: /usr/bin/ssh -l user 10.0.0.16
      default_field: false
    - name: parent.elf.architecture
      level: extended
      type: keyword
      ignore_above: 1024
      description: Machine architecture of the ELF file.
      example: x86-64
      default_field: false
    - name: parent.elf.byte_order
      level: extended
      type: keyword
      ignore_above: 1024
      description: Byte sequence of ELF file.
      example: Little Endian
      default_field: false
    - name: parent.elf.cpu_type
      level: extended
      type: keyword
      ignore_above: 1024
      description: CPU type of the ELF file.
      example: Intel
      default_field: false
    - name: parent.elf.creation_date
      level: extended
      type: date
      description: Extracted when possible from the file's metadata. Indicates when
        it was built or compiled. It can also be faked by malware creators.
      default_field: false
    - name: parent.elf.exports
      level: extended
      type: flattened
      description: List of exported element names and types.
      default_field: false
    - name: parent.elf.header.abi_version
      level: extended
      type: keyword
      ignore_above: 1024
      description: Version of the ELF Application Binary Interface (ABI).
      default_field: false
    - name: parent.elf.header.class
      level: extended
      type: keyword
      ignore_above: 1024
      description: Header class of the ELF file.
      default_field: false
    - name: parent.elf.header.data
      level: extended
      type: keyword
      ignore_above: 1024
      description: Data table of the ELF header.
      default_field: false
    - name: parent.elf.header.entrypoint
      level: extended
      type: long
      format: string
      description: Header entrypoint of the ELF file.
      default_field: false
    - name: parent.elf.header.object_version
      level: extended
      type: keyword
      ignore_above: 1024
      description: '"0x1" for original ELF files.'
      default_field: false
    - name: parent.elf.header.os_abi
      level: extended
      type: keyword
      ignore_above: 1024
      description: Application Binary Interface (ABI) of the Linux OS.
      default_field: false
    - name: parent.elf.header.type
      level: extended
      type: keyword
      ignore_above: 1024
      description: Header type of the ELF file.
      default_field: false
    - name: parent.elf.header.version
      level: extended
      type: keyword
      ignore_above: 1024
      description: Version of the ELF header.
      default_field: false
    - name: parent.elf.imports
      level: extended
      type: flattened
      description: List of imported element names and types.
      default_field: false
    - name: parent.elf.sections
      level: extended
      type: nested
      description: 'An array containing an object for each section of the ELF file.

        The keys that should be present in these objects are defined by sub-fields
        underneath `elf.sections.*`.'
      default_field: false
    - name: parent.elf.sections.chi2
      level: extended
      type: long
      format: number
      description: Chi-square probability distribution of the section.
      default_field: false
    - name: parent.elf.sections.entropy
      level: extended
      type: long
      format: number
      description: Shannon entropy calculation from the section.
      default_field: false
    - name: parent.elf.sections.flags
      level: extended
      type: keyword
      ignore_above: 1024
      description: ELF Section List flags.
      default_field: false
    - name: parent.elf.sections.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: ELF Section List name.
      default_field: false
    - name: parent.elf.sections.physical_offset
      level: extended
      type: keyword
      ignore_above: 1024
      description: ELF Section List offset.
      default_field: false
    - name: parent.elf.sections.physical_size
      level: extended
      type: long
      format: bytes
      description: ELF Section List physical size.
      default_field: false
    - name: parent.elf.sections.type
      level: extended
      type: keyword
      ignore_above: 1024
      description: ELF Section List type.
      default_field: false
    - name: parent.elf.sections.virtual_address
      level: extended
      type: long
      format: string
      description: ELF Section List virtual address.
      default_field: false
    - name: parent.elf.sections.virtual_size
      level: extended
      type: long
      format: string
      description: ELF Section List virtual size.
      default_field: false
    - name: parent.elf.segments
      level: extended
      type: nested
      description: 'An array containing an object for each segment of the ELF file.

        The keys that should be present in these objects are defined by sub-fields
        underneath `elf.segments.*`.'
      default_field: false
    - name: parent.elf.segments.sections
      level: extended
      type: keyword
      ignore_above: 1024
      description: ELF object segment sections.
      default_field: false
    - name: parent.elf.segments.type
      level: extended
      type: keyword
      ignore_above: 1024
      description: ELF object segment type.
      default_field: false
    - name: parent.elf.shared_libraries
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of shared libraries used by this ELF object.
      default_field: false
    - name: parent.elf.telfhash
      level: extended
      type: keyword
      ignore_above: 1024
      description: telfhash symbol hash for ELF file.
      default_field: false
    - name: parent.end
      level: extended
      type: date
      description: The time the process ended.
      example: '2016-05-23T08:05:34.853Z'
      default_field: false
    - name: parent.entity_id
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Unique identifier for the process.

        The implementation of this is specified by the data source, but some examples
        of what could be used here are a process-generated UUID, Sysmon Process GUIDs,
        or a hash of some uniquely identifying components of a process.

        Constructing a globally unique identifier is a common practice to mitigate
        PID reuse as well as to identify a specific process over time, across multiple
        monitored hosts.'
      example: c2c455d9f99375d
      default_field: false
    - name: parent.executable
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: match_only_text
      description: Absolute path to the process executable.
      example: /usr/bin/ssh
      default_field: false
    - name: parent.exit_code
      level: extended
      type: long
      description: 'The exit code of the process, if this is a termination event.

        The field should be absent if there is no exit code for the event (e.g. process
        start).'
      example: 137
      default_field: false
    - name: parent.hash.md5
      level: extended
      type: keyword
      ignore_above: 1024
      description: MD5 hash.
      default_field: false
    - name: parent.hash.sha1
      level: extended
      type: keyword
      ignore_above: 1024
      description: SHA1 hash.
      default_field: false
    - name: parent.hash.sha256
      level: extended
      type: keyword
      ignore_above: 1024
      description: SHA256 hash.
      default_field: false
    - name: parent.hash.sha512
      level: extended
      type: keyword
      ignore_above: 1024
      description: SHA512 hash.
      default_field: false
    - name: parent.hash.ssdeep
      level: extended
      type: keyword
      ignore_above: 1024
      description: SSDEEP hash.
      default_field: false
    - name: parent.name
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: match_only_text
      description: 'Process name.

        Sometimes called program name or similar.'
      example: ssh
      default_field: false
    - name: parent.pe.architecture
      level: extended
      type: keyword
      ignore_above: 1024
      description: CPU architecture target for the file.
      example: x64
      default_field: false
    - name: parent.pe.company
      level: extended
      type: keyword
      ignore_above: 1024
      description: Internal company name of the file, provided at compile-time.
      example: Microsoft Corporation
      default_field: false
    - name: parent.pe.description
      level: extended
      type: keyword
      ignore_above: 1024
      description: Internal description of the file, provided at compile-time.
      example: Paint
      default_field: false
    - name: parent.pe.file_version
      level: extended
      type: keyword
      ignore_above: 1024
      description: Internal version of the file, provided at compile-time.
      example: 6.3.9600.17415
      default_field: false
    - name: parent.pe.imphash
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'A hash of the imports in a PE file. An imphash -- or import hash
        -- can be used to fingerprint binaries even after recompilation or other code-level
        transformations have occurred, which would change more traditional hash values.

        Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.'
      example: 0c6803c4e922103c4dca5963aad36ddf
      default_field: false
    - name: parent.pe.original_file_name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Internal name of the file, provided at compile-time.
      example: MSPAINT.EXE
      default_field: false
    - name: parent.pe.product
      level: extended
      type: keyword
      ignore_above: 1024
      description: Internal product name of the file, provided at compile-time.
      example: "Microsoft\xAE Windows\xAE Operating System"
      default_field: false
    - name: parent.pgid
      level: extended
      type: long
      format: string
      description: Identifier of the group of processes the process belongs to.
      default_field: false
    - name: parent.pid
      level: core
      type: long
      format: string
      description: Process id.
      example: 4242
      default_field: false
    - name: parent.start
      level: extended
      type: date
      description: The time the process started.
      example: '2016-05-23T08:05:34.853Z'
      default_field: false
    - name: parent.thread.id
      level: extended
      type: long
      format: string
      description: Thread ID.
      example: 4242
      default_field: false
    - name: parent.thread.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Thread name.
      example: thread-0
      default_field: false
    - name: parent.title
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: match_only_text
      description: 'Process title.

        The proctitle, some times the same as process name. Can also be different:
        for example a browser setting its title to the web page currently opened.'
      default_field: false
    - name: parent.uptime
      level: extended
      type: long
      description: Seconds the process has been up.
      example: 1325
      default_field: false
    - name: parent.working_directory
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: match_only_text
      description: The working directory of the process.
      example: /home/alice
      default_field: false
    - name: pe.architecture
      level: extended
      type: keyword
      ignore_above: 1024
      description: CPU architecture target for the file.
      example: x64
      default_field: false
    - name: pe.company
      level: extended
      type: keyword
      ignore_above: 1024
      description: Internal company name of the file, provided at compile-time.
      example: Microsoft Corporation
      default_field: false
    - name: pe.description
      level: extended
      type: keyword
      ignore_above: 1024
      description: Internal description of the file, provided at compile-time.
      example: Paint
      default_field: false
    - name: pe.file_version
      level: extended
      type: keyword
      ignore_above: 1024
      description: Internal version of the file, provided at compile-time.
      example: 6.3.9600.17415
      default_field: false
    - name: pe.imphash
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'A hash of the imports in a PE file. An imphash -- or import hash
        -- can be used to fingerprint binaries even after recompilation or other code-level
        transformations have occurred, which would change more traditional hash values.

        Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.'
      example: 0c6803c4e922103c4dca5963aad36ddf
      default_field: false
    - name: pe.original_file_name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Internal name of the file, provided at compile-time.
      example: MSPAINT.EXE
      default_field: false
    - name: pe.product
      level: extended
      type: keyword
      ignore_above: 1024
      description: Internal product name of the file, provided at compile-time.
      example: "Microsoft\xAE Windows\xAE Operating System"
      default_field: false
    - name: pgid
      level: extended
      type: long
      format: string
      description: Identifier of the group of processes the process belongs to.
    - name: pid
      level: core
      type: long
      format: string
      description: Process id.
      example: 4242
    - name: start
      level: extended
      type: date
      description: The time the process started.
      example: '2016-05-23T08:05:34.853Z'
    - name: thread.id
      level: extended
      type: long
      format: string
      description: Thread ID.
      example: 4242
    - name: thread.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Thread name.
      example: thread-0
    - name: title
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: match_only_text
        default_field: false
      description: 'Process title.

        The proctitle, some times the same as process name. Can also be different:
        for example a browser setting its title to the web page currently opened.'
    - name: uptime
      level: extended
      type: long
      description: Seconds the process has been up.
      example: 1325
    - name: working_directory
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: match_only_text
        default_field: false
      description: The working directory of the process.
      example: /home/alice
  - name: registry
    title: Registry
    group: 2
    description: Fields related to Windows Registry operations.
    type: group
    default_field: true
    fields:
    - name: data.bytes
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Original bytes written with base64 encoding.

        For Windows registry operations, such as SetValueEx and RegQueryValueEx, this
        corresponds to the data pointed by `lp_data`. This is optional but provides
        better recoverability and should be populated for REG_BINARY encoded values.'
      example: ZQBuAC0AVQBTAAAAZQBuAAAAAAA=
      default_field: false
    - name: data.strings
      level: core
      type: wildcard
      description: 'Content when writing string types.

        Populated as an array when writing string data to the registry. For single
        string registry types (REG_SZ, REG_EXPAND_SZ), this should be an array with
        one string. For sequences of string with REG_MULTI_SZ, this array will be
        variable length. For numeric data, such as REG_DWORD and REG_QWORD, this should
        be populated with the decimal representation (e.g `"1"`).'
      example: '["C:\rta\red_ttp\bin\myapp.exe"]'
      default_field: false
    - name: data.type
      level: core
      type: keyword
      ignore_above: 1024
      description: Standard registry type for encoding contents
      example: REG_SZ
      default_field: false
    - name: hive
      level: core
      type: keyword
      ignore_above: 1024
      description: Abbreviated name for the hive.
      example: HKLM
      default_field: false
    - name: key
      level: core
      type: keyword
      ignore_above: 1024
      description: Hive-relative path of keys.
      example: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe
      default_field: false
    - name: path
      level: core
      type: keyword
      ignore_above: 1024
      description: Full path, including hive, key and value
      example: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
        Options\winword.exe\Debugger
      default_field: false
    - name: value
      level: core
      type: keyword
      ignore_above: 1024
      description: Name of the value written.
      example: Debugger
      default_field: false
  - name: related
    title: Related
    group: 2
    description: 'This field set is meant to facilitate pivoting around a piece of
      data.

      Some pieces of information can be seen in many places in an ECS event. To facilitate
      searching for them, store an array of all seen values to their corresponding
      field in `related.`.

      A concrete example is IP addresses, which can be under host, observer, source,
      destination, client, server, and network.forwarded_ip. If you append all IPs
      to `related.ip`, you can then search for a given IP trivially, no matter where
      it appeared, by querying `related.ip:192.0.2.15`.'
    type: group
    default_field: true
    fields:
    - name: hash
      level: extended
      type: keyword
      ignore_above: 1024
      description: All the hashes seen on your event. Populating this field, then
        using it to search for hashes can help in situations where you're unsure what
        the hash algorithm is (and therefore which key name to search).
      default_field: false
    - name: hosts
      level: extended
      type: keyword
      ignore_above: 1024
      description: All hostnames or other host identifiers seen on your event. Example
        identifiers include FQDNs, domain names, workstation names, or aliases.
      default_field: false
    - name: ip
      level: extended
      type: ip
      description: All of the IPs seen on your event.
    - name: user
      level: extended
      type: keyword
      ignore_above: 1024
      description: All the user names or other user identifiers seen on the event.
      default_field: false
  - name: rule
    title: Rule
    group: 2
    description: 'Rule fields are used to capture the specifics of any observer or
      agent rules that generate alerts or other notable events.

      Examples of data sources that would populate the rule fields include: network
      admission control platforms, network or host IDS/IPS, network firewalls, web
      application firewalls, url filters, endpoint detection and response (EDR) systems,
      etc.'
    type: group
    default_field: true
    fields:
    - name: author
      level: extended
      type: keyword
      ignore_above: 1024
      description: Name, organization, or pseudonym of the author or authors who created
        the rule used to generate this event.
      example: '["Star-Lord"]'
      default_field: false
    - name: category
      level: extended
      type: keyword
      ignore_above: 1024
      description: A categorization value keyword used by the entity using the rule
        for detection of this event.
      example: Attempted Information Leak
      default_field: false
    - name: description
      level: extended
      type: keyword
      ignore_above: 1024
      description: The description of the rule generating the event.
      example: Block requests to public DNS over HTTPS / TLS protocols
      default_field: false
    - name: id
      level: extended
      type: keyword
      ignore_above: 1024
      description: A rule ID that is unique within the scope of an agent, observer,
        or other entity using the rule for detection of this event.
      example: 101
      default_field: false
    - name: license
      level: extended
      type: keyword
      ignore_above: 1024
      description: Name of the license under which the rule used to generate this
        event is made available.
      example: Apache 2.0
      default_field: false
    - name: name
      level: extended
      type: keyword
      ignore_above: 1024
      description: The name of the rule or signature generating the event.
      example: BLOCK_DNS_over_TLS
      default_field: false
    - name: reference
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Reference URL to additional information about the rule used to
        generate this event.

        The URL can point to the vendor''s documentation about the rule. If that''s
        not available, it can also be a link to a more general page describing this
        type of alert.'
      example: https://en.wikipedia.org/wiki/DNS_over_TLS
      default_field: false
    - name: ruleset
      level: extended
      type: keyword
      ignore_above: 1024
      description: Name of the ruleset, policy, group, or parent category in which
        the rule used to generate this event is a member.
      example: Standard_Protocol_Filters
      default_field: false
    - name: uuid
      level: extended
      type: keyword
      ignore_above: 1024
      description: A rule ID that is unique within the scope of a set or group of
        agents, observers, or other entities using the rule for detection of this
        event.
      example: 1100110011
      default_field: false
    - name: version
      level: extended
      type: keyword
      ignore_above: 1024
      description: The version / revision of the rule being used for analysis.
      example: 1.1
      default_field: false
  - name: server
    title: Server
    group: 2
    description: 'A Server is defined as the responder in a network connection for
      events regarding sessions, connections, or bidirectional flow records.

      For TCP events, the server is the receiver of the initial SYN packet(s) of the
      TCP connection. For other protocols, the server is generally the responder in
      the network transaction. Some systems actually use the term "responder" to refer
      the server in TCP connections. The server fields describe details about the
      system acting as the server in the network event. Server fields are usually
      populated in conjunction with client fields. Server fields are generally not
      populated for packet-level events.

      Client / server representations can add semantic context to an exchange, which
      is helpful to visualize the data in certain situations. If your context falls
      in that category, you should still ensure that source and destination are filled
      appropriately.'
    type: group
    default_field: true
    fields:
    - name: address
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Some event server addresses are defined ambiguously. The event
        will sometimes list an IP, a domain or a unix socket.  You should always store
        the raw address in the `.address` field.

        Then it should be duplicated to `.ip` or `.domain`, depending on which one
        it is.'
    - name: as.number
      level: extended
      type: long
      description: Unique number allocated to the autonomous system. The autonomous
        system number (ASN) uniquely identifies each network on the Internet.
      example: 15169
    - name: as.organization.name
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: match_only_text
        default_field: false
      description: Organization name.
      example: Google LLC
    - name: bytes
      level: core
      type: long
      format: bytes
      description: Bytes sent from the server to the client.
      example: 184
    - name: domain
      level: core
      type: keyword
      ignore_above: 1024
      description: 'The domain name of the server system.

        This value may be a host name, a fully qualified domain name, or another host
        naming format. The value may derive from the original event or be added from
        enrichment.'
      example: foo.example.com
    - name: geo.city_name
      level: core
      type: keyword
      ignore_above: 1024
      description: City name.
      example: Montreal
    - name: geo.continent_code
      level: core
      type: keyword
      ignore_above: 1024
      description: Two-letter code representing continent's name.
      example: NA
      default_field: false
    - name: geo.continent_name
      level: core
      type: keyword
      ignore_above: 1024
      description: Name of the continent.
      example: North America
    - name: geo.country_iso_code
      level: core
      type: keyword
      ignore_above: 1024
      description: Country ISO code.
      example: CA
    - name: geo.country_name
      level: core
      type: keyword
      ignore_above: 1024
      description: Country name.
      example: Canada
    - name: geo.location
      level: core
      type: geo_point
      description: Longitude and latitude.
      example: '{ "lon": -73.614830, "lat": 45.505918 }'
    - name: geo.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'User-defined description of a location, at the level of granularity
        they care about.

        Could be the name of their data centers, the floor number, if this describes
        a local physical entity, city names.

        Not typically used in automated geolocation.'
      example: boston-dc
    - name: geo.postal_code
      level: core
      type: keyword
      ignore_above: 1024
      description: 'Postal code associated with the location.

        Values appropriate for this field may also be known as a postcode or ZIP code
        and will vary widely from country to country.'
      example: 94040
      default_field: false
    - name: geo.region_iso_code
      level: core
      type: keyword
      ignore_above: 1024
      description: Region ISO code.
      example: CA-QC
    - name: geo.region_name
      level: core
      type: keyword
      ignore_above: 1024
      description: Region name.
      example: Quebec
    - name: geo.timezone
      level: core
      type: keyword
      ignore_above: 1024
      description: The time zone of the location, such as IANA time zone name.
      example: America/Argentina/Buenos_Aires
      default_field: false
    - name: ip
      level: core
      type: ip
      description: IP address of the server (IPv4 or IPv6).
    - name: mac
      level: core
      type: keyword
      ignore_above: 1024
      description: 'MAC address of the server.

        The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit
        byte) is represented by two [uppercase] hexadecimal digits giving the value
        of the octet as an unsigned integer. Successive octets are separated by a
        hyphen.'
      example: 00-00-5E-00-53-23
    - name: nat.ip
      level: extended
      type: ip
      description: 'Translated ip of destination based NAT sessions (e.g. internet
        to private DMZ)

        Typically used with load balancers, firewalls, or routers.'
    - name: nat.port
      level: extended
      type: long
      format: string
      description: 'Translated port of destination based NAT sessions (e.g. internet
        to private DMZ)

        Typically used with load balancers, firewalls, or routers.'
    - name: packets
      level: core
      type: long
      description: Packets sent from the server to the client.
      example: 12
    - name: port
      level: core
      type: long
      format: string
      description: Port of the server.
    - name: registered_domain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The highest registered server domain, stripped of the subdomain.

        For example, the registered domain for "foo.example.com" is "example.com".

        This value can be determined precisely with a list like the public suffix
        list (http://publicsuffix.org). Trying to approximate this by simply taking
        the last two labels will not work well for TLDs such as "co.uk".'
      example: example.com
    - name: subdomain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The subdomain portion of a fully qualified domain name includes
        all of the names except the host name under the registered_domain.  In a partially
        qualified domain, or if the the qualification level of the full name cannot
        be determined, subdomain contains all of the names below the registered domain.

        For example the subdomain portion of "www.east.mydomain.co.uk" is "east".
        If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com",
        the subdomain field should contain "sub2.sub1", with no trailing period.'
      example: east
      default_field: false
    - name: top_level_domain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The effective top level domain (eTLD), also known as the domain
        suffix, is the last part of the domain name. For example, the top level domain
        for example.com is "com".

        This value can be determined precisely with a list like the public suffix
        list (http://publicsuffix.org). Trying to approximate this by simply taking
        the last label will not work well for effective TLDs such as "co.uk".'
      example: co.uk
    - name: user.domain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Name of the directory the user is a member of.

        For example, an LDAP or Active Directory domain name.'
    - name: user.email
      level: extended
      type: keyword
      ignore_above: 1024
      description: User email address.
    - name: user.full_name
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: match_only_text
        default_field: false
      description: User's full name, if available.
      example: Albert Einstein
    - name: user.group.domain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Name of the directory the group is a member of.

        For example, an LDAP or Active Directory domain name.'
    - name: user.group.id
      level: extended
      type: keyword
      ignore_above: 1024
      description: Unique identifier for the group on the system/platform.
    - name: user.group.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Name of the group.
    - name: user.hash
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Unique user hash to correlate information for a user in anonymized
        form.

        Useful if `user.id` or `user.name` contain confidential information and cannot
        be used.'
    - name: user.id
      level: core
      type: keyword
      ignore_above: 1024
      description: Unique identifier of the user.
      example: S-1-5-21-202424912787-2692429404-2351956786-1000
    - name: user.name
      level: core
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: match_only_text
        default_field: false
      description: Short name or login of the user.
      example: a.einstein
    - name: user.roles
      level: extended
      type: keyword
      ignore_above: 1024
      description: Array of user roles at the time of the event.
      example: '["kibana_admin", "reporting_user"]'
      default_field: false
  - name: service
    title: Service
    group: 2
    description: 'The service fields describe the service for or from which the data
      was collected.

      These fields help you find and correlate logs for a specific service and version.'
    footnote: The service fields may be self-nested under service.origin.* and service.target.*  to
      describe origin or target services in the context of incoming or outgoing requests,  respectively.
      However, the fieldsets service.origin.* and service.target.* must not be confused
      with  the root service fieldset that is used to describe the actual service
      under observation. The fieldset service.origin.* may only be used in the context
      of incoming requests or  events to describe the originating service of the request.
      The fieldset service.target.*  may only be used in the context of outgoing requests
      or events to describe the target  service of the request.
    type: group
    default_field: true
    fields:
    - name: address
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Address where data about this service was collected from.

        This should be a URI, network address (ipv4:port or [ipv6]:port) or a resource
        path (sockets).'
      example: 172.26.0.2:5432
      default_field: false
    - name: environment
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Identifies the environment where the service is running.

        If the same service runs in different environments (production, staging, QA,
        development, etc.), the environment can identify other instances of the same
        service. Can also group services and applications from the same environment.'
      example: production
      default_field: false
    - name: ephemeral_id
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Ephemeral identifier of this service (if one exists).

        This id normally changes across restarts, but `service.id` does not.'
      example: 8a4f500f
    - name: id
      level: core
      type: keyword
      ignore_above: 1024
      description: 'Unique identifier of the running service. If the service is comprised
        of many nodes, the `service.id` should be the same for all nodes.

        This id should uniquely identify the service. This makes it possible to correlate
        logs and metrics for one specific service, no matter which particular node
        emitted the event.

        Note that if you need to see the events from one specific host of the service,
        you should filter on that `host.name` or `host.id` instead.'
      example: d37e5ebfe0ae6c4972dbe9f0174a1637bb8247f6
    - name: name
      level: core
      type: keyword
      ignore_above: 1024
      description: 'Name of the service data is collected from.

        The name of the service is normally user given. This allows for distributed
        services that run on multiple hosts to correlate the related instances based
        on the name.

        In the case of Elasticsearch the `service.name` could contain the cluster
        name. For Beats the `service.name` is by default a copy of the `service.type`
        field if no name is specified.'
      example: elasticsearch-metrics
    - name: node.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Name of a service node.

        This allows for two nodes of the same service running on the same host to
        be differentiated. Therefore, `service.node.name` should typically be unique
        across nodes of a given service.

        In the case of Elasticsearch, the `service.node.name` could contain the unique
        node name within the Elasticsearch cluster. In cases where the service doesn''t
        have the concept of a node name, the host name or container name can be used
        to distinguish running instances that make up this service. If those do not
        provide uniqueness (e.g. multiple instances of the service running on the
        same host) - the node name can be manually set.'
      example: instance-0000000016
    - name: origin.address
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Address where data about this service was collected from.

        This should be a URI, network address (ipv4:port or [ipv6]:port) or a resource
        path (sockets).'
      example: 172.26.0.2:5432
      default_field: false
    - name: origin.environment
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Identifies the environment where the service is running.

        If the same service runs in different environments (production, staging, QA,
        development, etc.), the environment can identify other instances of the same
        service. Can also group services and applications from the same environment.'
      example: production
      default_field: false
    - name: origin.ephemeral_id
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Ephemeral identifier of this service (if one exists).

        This id normally changes across restarts, but `service.id` does not.'
      example: 8a4f500f
      default_field: false
    - name: origin.id
      level: core
      type: keyword
      ignore_above: 1024
      description: 'Unique identifier of the running service. If the service is comprised
        of many nodes, the `service.id` should be the same for all nodes.

        This id should uniquely identify the service. This makes it possible to correlate
        logs and metrics for one specific service, no matter which particular node
        emitted the event.

        Note that if you need to see the events from one specific host of the service,
        you should filter on that `host.name` or `host.id` instead.'
      example: d37e5ebfe0ae6c4972dbe9f0174a1637bb8247f6
      default_field: false
    - name: origin.name
      level: core
      type: keyword
      ignore_above: 1024
      description: 'Name of the service data is collected from.

        The name of the service is normally user given. This allows for distributed
        services that run on multiple hosts to correlate the related instances based
        on the name.

        In the case of Elasticsearch the `service.name` could contain the cluster
        name. For Beats the `service.name` is by default a copy of the `service.type`
        field if no name is specified.'
      example: elasticsearch-metrics
      default_field: false
    - name: origin.node.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Name of a service node.

        This allows for two nodes of the same service running on the same host to
        be differentiated. Therefore, `service.node.name` should typically be unique
        across nodes of a given service.

        In the case of Elasticsearch, the `service.node.name` could contain the unique
        node name within the Elasticsearch cluster. In cases where the service doesn''t
        have the concept of a node name, the host name or container name can be used
        to distinguish running instances that make up this service. If those do not
        provide uniqueness (e.g. multiple instances of the service running on the
        same host) - the node name can be manually set.'
      example: instance-0000000016
      default_field: false
    - name: origin.state
      level: core
      type: keyword
      ignore_above: 1024
      description: Current state of the service.
      default_field: false
    - name: origin.type
      level: core
      type: keyword
      ignore_above: 1024
      description: 'The type of the service data is collected from.

        The type can be used to group and correlate logs and metrics from one service
        type.

        Example: If logs or metrics are collected from Elasticsearch, `service.type`
        would be `elasticsearch`.'
      example: elasticsearch
      default_field: false
    - name: origin.version
      level: core
      type: keyword
      ignore_above: 1024
      description: 'Version of the service the data was collected from.

        This allows to look at a data set only for a specific version of a service.'
      example: 3.2.4
      default_field: false
    - name: state
      level: core
      type: keyword
      ignore_above: 1024
      description: Current state of the service.
    - name: target.address
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Address where data about this service was collected from.

        This should be a URI, network address (ipv4:port or [ipv6]:port) or a resource
        path (sockets).'
      example: 172.26.0.2:5432
      default_field: false
    - name: target.environment
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Identifies the environment where the service is running.

        If the same service runs in different environments (production, staging, QA,
        development, etc.), the environment can identify other instances of the same
        service. Can also group services and applications from the same environment.'
      example: production
      default_field: false
    - name: target.ephemeral_id
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Ephemeral identifier of this service (if one exists).

        This id normally changes across restarts, but `service.id` does not.'
      example: 8a4f500f
      default_field: false
    - name: target.id
      level: core
      type: keyword
      ignore_above: 1024
      description: 'Unique identifier of the running service. If the service is comprised
        of many nodes, the `service.id` should be the same for all nodes.

        This id should uniquely identify the service. This makes it possible to correlate
        logs and metrics for one specific service, no matter which particular node
        emitted the event.

        Note that if you need to see the events from one specific host of the service,
        you should filter on that `host.name` or `host.id` instead.'
      example: d37e5ebfe0ae6c4972dbe9f0174a1637bb8247f6
      default_field: false
    - name: target.name
      level: core
      type: keyword
      ignore_above: 1024
      description: 'Name of the service data is collected from.

        The name of the service is normally user given. This allows for distributed
        services that run on multiple hosts to correlate the related instances based
        on the name.

        In the case of Elasticsearch the `service.name` could contain the cluster
        name. For Beats the `service.name` is by default a copy of the `service.type`
        field if no name is specified.'
      example: elasticsearch-metrics
      default_field: false
    - name: target.node.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Name of a service node.

        This allows for two nodes of the same service running on the same host to
        be differentiated. Therefore, `service.node.name` should typically be unique
        across nodes of a given service.

        In the case of Elasticsearch, the `service.node.name` could contain the unique
        node name within the Elasticsearch cluster. In cases where the service doesn''t
        have the concept of a node name, the host name or container name can be used
        to distinguish running instances that make up this service. If those do not
        provide uniqueness (e.g. multiple instances of the service running on the
        same host) - the node name can be manually set.'
      example: instance-0000000016
      default_field: false
    - name: target.state
      level: core
      type: keyword
      ignore_above: 1024
      description: Current state of the service.
      default_field: false
    - name: target.type
      level: core
      type: keyword
      ignore_above: 1024
      description: 'The type of the service data is collected from.

        The type can be used to group and correlate logs and metrics from one service
        type.

        Example: If logs or metrics are collected from Elasticsearch, `service.type`
        would be `elasticsearch`.'
      example: elasticsearch
      default_field: false
    - name: target.version
      level: core
      type: keyword
      ignore_above: 1024
      description: 'Version of the service the data was collected from.

        This allows to look at a data set only for a specific version of a service.'
      example: 3.2.4
      default_field: false
    - name: type
      level: core
      type: keyword
      ignore_above: 1024
      description: 'The type of the service data is collected from.

        The type can be used to group and correlate logs and metrics from one service
        type.

        Example: If logs or metrics are collected from Elasticsearch, `service.type`
        would be `elasticsearch`.'
      example: elasticsearch
    - name: version
      level: core
      type: keyword
      ignore_above: 1024
      description: 'Version of the service the data was collected from.

        This allows to look at a data set only for a specific version of a service.'
      example: 3.2.4
  - name: source
    title: Source
    group: 2
    description: 'Source fields capture details about the sender of a network exchange/packet.
      These fields are populated from a network event, packet, or other event containing
      details of a network transaction.

      Source fields are usually populated in conjunction with destination fields.
      The source and destination fields are considered the baseline and should always
      be filled if an event contains source and destination details from a network
      transaction. If the event also contains identification of the client and server
      roles, then the client and server fields should also be populated.'
    type: group
    default_field: true
    fields:
    - name: address
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Some event source addresses are defined ambiguously. The event
        will sometimes list an IP, a domain or a unix socket.  You should always store
        the raw address in the `.address` field.

        Then it should be duplicated to `.ip` or `.domain`, depending on which one
        it is.'
    - name: as.number
      level: extended
      type: long
      description: Unique number allocated to the autonomous system. The autonomous
        system number (ASN) uniquely identifies each network on the Internet.
      example: 15169
    - name: as.organization.name
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: match_only_text
        default_field: false
      description: Organization name.
      example: Google LLC
    - name: bytes
      level: core
      type: long
      format: bytes
      description: Bytes sent from the source to the destination.
      example: 184
    - name: domain
      level: core
      type: keyword
      ignore_above: 1024
      description: 'The domain name of the source system.

        This value may be a host name, a fully qualified domain name, or another host
        naming format. The value may derive from the original event or be added from
        enrichment.'
      example: foo.example.com
    - name: geo.city_name
      level: core
      type: keyword
      ignore_above: 1024
      description: City name.
      example: Montreal
    - name: geo.continent_code
      level: core
      type: keyword
      ignore_above: 1024
      description: Two-letter code representing continent's name.
      example: NA
      default_field: false
    - name: geo.continent_name
      level: core
      type: keyword
      ignore_above: 1024
      description: Name of the continent.
      example: North America
    - name: geo.country_iso_code
      level: core
      type: keyword
      ignore_above: 1024
      description: Country ISO code.
      example: CA
    - name: geo.country_name
      level: core
      type: keyword
      ignore_above: 1024
      description: Country name.
      example: Canada
    - name: geo.location
      level: core
      type: geo_point
      description: Longitude and latitude.
      example: '{ "lon": -73.614830, "lat": 45.505918 }'
    - name: geo.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'User-defined description of a location, at the level of granularity
        they care about.

        Could be the name of their data centers, the floor number, if this describes
        a local physical entity, city names.

        Not typically used in automated geolocation.'
      example: boston-dc
    - name: geo.postal_code
      level: core
      type: keyword
      ignore_above: 1024
      description: 'Postal code associated with the location.

        Values appropriate for this field may also be known as a postcode or ZIP code
        and will vary widely from country to country.'
      example: 94040
      default_field: false
    - name: geo.region_iso_code
      level: core
      type: keyword
      ignore_above: 1024
      description: Region ISO code.
      example: CA-QC
    - name: geo.region_name
      level: core
      type: keyword
      ignore_above: 1024
      description: Region name.
      example: Quebec
    - name: geo.timezone
      level: core
      type: keyword
      ignore_above: 1024
      description: The time zone of the location, such as IANA time zone name.
      example: America/Argentina/Buenos_Aires
      default_field: false
    - name: ip
      level: core
      type: ip
      description: IP address of the source (IPv4 or IPv6).
    - name: mac
      level: core
      type: keyword
      ignore_above: 1024
      description: 'MAC address of the source.

        The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit
        byte) is represented by two [uppercase] hexadecimal digits giving the value
        of the octet as an unsigned integer. Successive octets are separated by a
        hyphen.'
      example: 00-00-5E-00-53-23
    - name: nat.ip
      level: extended
      type: ip
      description: 'Translated ip of source based NAT sessions (e.g. internal client
        to internet)

        Typically connections traversing load balancers, firewalls, or routers.'
    - name: nat.port
      level: extended
      type: long
      format: string
      description: 'Translated port of source based NAT sessions. (e.g. internal client
        to internet)

        Typically used with load balancers, firewalls, or routers.'
    - name: packets
      level: core
      type: long
      description: Packets sent from the source to the destination.
      example: 12
    - name: port
      level: core
      type: long
      format: string
      description: Port of the source.
    - name: registered_domain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The highest registered source domain, stripped of the subdomain.

        For example, the registered domain for "foo.example.com" is "example.com".

        This value can be determined precisely with a list like the public suffix
        list (http://publicsuffix.org). Trying to approximate this by simply taking
        the last two labels will not work well for TLDs such as "co.uk".'
      example: example.com
    - name: subdomain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The subdomain portion of a fully qualified domain name includes
        all of the names except the host name under the registered_domain.  In a partially
        qualified domain, or if the the qualification level of the full name cannot
        be determined, subdomain contains all of the names below the registered domain.

        For example the subdomain portion of "www.east.mydomain.co.uk" is "east".
        If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com",
        the subdomain field should contain "sub2.sub1", with no trailing period.'
      example: east
      default_field: false
    - name: top_level_domain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The effective top level domain (eTLD), also known as the domain
        suffix, is the last part of the domain name. For example, the top level domain
        for example.com is "com".

        This value can be determined precisely with a list like the public suffix
        list (http://publicsuffix.org). Trying to approximate this by simply taking
        the last label will not work well for effective TLDs such as "co.uk".'
      example: co.uk
    - name: user.domain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Name of the directory the user is a member of.

        For example, an LDAP or Active Directory domain name.'
    - name: user.email
      level: extended
      type: keyword
      ignore_above: 1024
      description: User email address.
    - name: user.full_name
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: match_only_text
        default_field: false
      description: User's full name, if available.
      example: Albert Einstein
    - name: user.group.domain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Name of the directory the group is a member of.

        For example, an LDAP or Active Directory domain name.'
    - name: user.group.id
      level: extended
      type: keyword
      ignore_above: 1024
      description: Unique identifier for the group on the system/platform.
    - name: user.group.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Name of the group.
    - name: user.hash
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Unique user hash to correlate information for a user in anonymized
        form.

        Useful if `user.id` or `user.name` contain confidential information and cannot
        be used.'
    - name: user.id
      level: core
      type: keyword
      ignore_above: 1024
      description: Unique identifier of the user.
      example: S-1-5-21-202424912787-2692429404-2351956786-1000
    - name: user.name
      level: core
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: match_only_text
        default_field: false
      description: Short name or login of the user.
      example: a.einstein
    - name: user.roles
      level: extended
      type: keyword
      ignore_above: 1024
      description: Array of user roles at the time of the event.
      example: '["kibana_admin", "reporting_user"]'
      default_field: false
  - name: threat
    title: Threat
    group: 2
    description: "Fields to classify events and alerts according to a threat taxonomy\
      \ such as the MITRE ATT&CK\xAE framework.\nThese fields are for users to classify\
      \ alerts from all of their sources (e.g. IDS, NGFW, etc.) within a common taxonomy.\
      \ The threat.tactic.* fields are meant to capture the high level category of\
      \ the threat (e.g. \"impact\"). The threat.technique.* fields are meant to capture\
      \ which kind of approach is used by this detected threat, to accomplish the\
      \ goal (e.g. \"endpoint denial of service\")."
    type: group
    default_field: true
    fields:
    - name: enrichments
      level: extended
      type: nested
      description: A list of associated indicators objects enriching the event, and
        the context of that association/enrichment.
      default_field: false
    - name: enrichments.indicator
      level: extended
      type: object
      description: Object containing associated indicators enriching the event.
      default_field: false
    - name: enrichments.indicator.as.number
      level: extended
      type: long
      description: Unique number allocated to the autonomous system. The autonomous
        system number (ASN) uniquely identifies each network on the Internet.
      example: 15169
      default_field: false
    - name: enrichments.indicator.as.organization.name
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: match_only_text
      description: Organization name.
      example: Google LLC
      default_field: false
    - name: enrichments.indicator.confidence
      level: extended
      type: keyword
      ignore_above: 1024
      description: "Identifies\_the\_vendor-neutral confidence\_rating\_using\_the\
        \ None/Low/Medium/High\_scale defined in Appendix A of the STIX 2.1 framework.\
        \ Vendor-specific confidence scales may be added as custom fields.\nExpected\
        \ values are:\n  * Not Specified\n  * None\n  * Low\n  * Medium\n  * High"
      example: Medium
      default_field: false
    - name: enrichments.indicator.description
      level: extended
      type: keyword
      ignore_above: 1024
      description: Describes the type of action conducted by the threat.
      example: IP x.x.x.x was observed delivering the Angler EK.
      default_field: false
    - name: enrichments.indicator.email.address
      level: extended
      type: keyword
      ignore_above: 1024
      description: Identifies a threat indicator as an email address (irrespective
        of direction).
      example: phish@example.com
      default_field: false
    - name: enrichments.indicator.file.accessed
      level: extended
      type: date
      description: 'Last time the file was accessed.

        Note that not all filesystems keep track of access time.'
      default_field: false
    - name: enrichments.indicator.file.attributes
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Array of file attributes.

        Attributes names will vary by platform. Here''s a non-exhaustive list of values
        that are expected in this field: archive, compressed, directory, encrypted,
        execute, hidden, read, readonly, system, write.'
      example: '["readonly", "system"]'
      default_field: false
    - name: enrichments.indicator.file.code_signature.digest_algorithm
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The hashing algorithm used to sign the process.

        This value can distinguish signatures when a file is signed multiple times
        by the same signer but with a different digest algorithm.'
      example: sha256
      default_field: false
    - name: enrichments.indicator.file.code_signature.exists
      level: core
      type: boolean
      description: Boolean to capture if a signature is present.
      example: 'true'
      default_field: false
    - name: enrichments.indicator.file.code_signature.signing_id
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The identifier used to sign the process.

        This is used to identify the application manufactured by a software vendor.
        The field is relevant to Apple *OS only.'
      example: com.apple.xpc.proxy
      default_field: false
    - name: enrichments.indicator.file.code_signature.status
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Additional information about the certificate status.

        This is useful for logging cryptographic errors with the certificate validity
        or trust status. Leave unpopulated if the validity or trust of the certificate
        was unchecked.'
      example: ERROR_UNTRUSTED_ROOT
      default_field: false
    - name: enrichments.indicator.file.code_signature.subject_name
      level: core
      type: keyword
      ignore_above: 1024
      description: Subject name of the code signer
      example: Microsoft Corporation
      default_field: false
    - name: enrichments.indicator.file.code_signature.team_id
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The team identifier used to sign the process.

        This is used to identify the team or vendor of a software product. The field
        is relevant to Apple *OS only.'
      example: EQHXZ8M8AV
      default_field: false
    - name: enrichments.indicator.file.code_signature.timestamp
      level: extended
      type: date
      description: Date and time when the code signature was generated and signed.
      example: '2021-01-01T12:10:30Z'
      default_field: false
    - name: enrichments.indicator.file.code_signature.trusted
      level: extended
      type: boolean
      description: 'Stores the trust status of the certificate chain.

        Validating the trust of the certificate chain may be complicated, and this
        field should only be populated by tools that actively check the status.'
      example: 'true'
      default_field: false
    - name: enrichments.indicator.file.code_signature.valid
      level: extended
      type: boolean
      description: 'Boolean to capture if the digital signature is verified against
        the binary content.

        Leave unpopulated if a certificate was unchecked.'
      example: 'true'
      default_field: false
    - name: enrichments.indicator.file.created
      level: extended
      type: date
      description: 'File creation time.

        Note that not all filesystems store the creation time.'
      default_field: false
    - name: enrichments.indicator.file.ctime
      level: extended
      type: date
      description: 'Last time the file attributes or metadata changed.

        Note that changes to the file content will update `mtime`. This implies `ctime`
        will be adjusted at the same time, since `mtime` is an attribute of the file.'
      default_field: false
    - name: enrichments.indicator.file.device
      level: extended
      type: keyword
      ignore_above: 1024
      description: Device that is the source of the file.
      example: sda
      default_field: false
    - name: enrichments.indicator.file.directory
      level: extended
      type: keyword
      ignore_above: 1024
      description: Directory where the file is located. It should include the drive
        letter, when appropriate.
      example: /home/alice
      default_field: false
    - name: enrichments.indicator.file.drive_letter
      level: extended
      type: keyword
      ignore_above: 1
      description: 'Drive letter where the file is located. This field is only relevant
        on Windows.

        The value should be uppercase, and not include the colon.'
      example: C
      default_field: false
    - name: enrichments.indicator.file.elf.architecture
      level: extended
      type: keyword
      ignore_above: 1024
      description: Machine architecture of the ELF file.
      example: x86-64
      default_field: false
    - name: enrichments.indicator.file.elf.byte_order
      level: extended
      type: keyword
      ignore_above: 1024
      description: Byte sequence of ELF file.
      example: Little Endian
      default_field: false
    - name: enrichments.indicator.file.elf.cpu_type
      level: extended
      type: keyword
      ignore_above: 1024
      description: CPU type of the ELF file.
      example: Intel
      default_field: false
    - name: enrichments.indicator.file.elf.creation_date
      level: extended
      type: date
      description: Extracted when possible from the file's metadata. Indicates when
        it was built or compiled. It can also be faked by malware creators.
      default_field: false
    - name: enrichments.indicator.file.elf.exports
      level: extended
      type: flattened
      description: List of exported element names and types.
      default_field: false
    - name: enrichments.indicator.file.elf.header.abi_version
      level: extended
      type: keyword
      ignore_above: 1024
      description: Version of the ELF Application Binary Interface (ABI).
      default_field: false
    - name: enrichments.indicator.file.elf.header.class
      level: extended
      type: keyword
      ignore_above: 1024
      description: Header class of the ELF file.
      default_field: false
    - name: enrichments.indicator.file.elf.header.data
      level: extended
      type: keyword
      ignore_above: 1024
      description: Data table of the ELF header.
      default_field: false
    - name: enrichments.indicator.file.elf.header.entrypoint
      level: extended
      type: long
      format: string
      description: Header entrypoint of the ELF file.
      default_field: false
    - name: enrichments.indicator.file.elf.header.object_version
      level: extended
      type: keyword
      ignore_above: 1024
      description: '"0x1" for original ELF files.'
      default_field: false
    - name: enrichments.indicator.file.elf.header.os_abi
      level: extended
      type: keyword
      ignore_above: 1024
      description: Application Binary Interface (ABI) of the Linux OS.
      default_field: false
    - name: enrichments.indicator.file.elf.header.type
      level: extended
      type: keyword
      ignore_above: 1024
      description: Header type of the ELF file.
      default_field: false
    - name: enrichments.indicator.file.elf.header.version
      level: extended
      type: keyword
      ignore_above: 1024
      description: Version of the ELF header.
      default_field: false
    - name: enrichments.indicator.file.elf.imports
      level: extended
      type: flattened
      description: List of imported element names and types.
      default_field: false
    - name: enrichments.indicator.file.elf.sections
      level: extended
      type: nested
      description: 'An array containing an object for each section of the ELF file.

        The keys that should be present in these objects are defined by sub-fields
        underneath `elf.sections.*`.'
      default_field: false
    - name: enrichments.indicator.file.elf.sections.chi2
      level: extended
      type: long
      format: number
      description: Chi-square probability distribution of the section.
      default_field: false
    - name: enrichments.indicator.file.elf.sections.entropy
      level: extended
      type: long
      format: number
      description: Shannon entropy calculation from the section.
      default_field: false
    - name: enrichments.indicator.file.elf.sections.flags
      level: extended
      type: keyword
      ignore_above: 1024
      description: ELF Section List flags.
      default_field: false
    - name: enrichments.indicator.file.elf.sections.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: ELF Section List name.
      default_field: false
    - name: enrichments.indicator.file.elf.sections.physical_offset
      level: extended
      type: keyword
      ignore_above: 1024
      description: ELF Section List offset.
      default_field: false
    - name: enrichments.indicator.file.elf.sections.physical_size
      level: extended
      type: long
      format: bytes
      description: ELF Section List physical size.
      default_field: false
    - name: enrichments.indicator.file.elf.sections.type
      level: extended
      type: keyword
      ignore_above: 1024
      description: ELF Section List type.
      default_field: false
    - name: enrichments.indicator.file.elf.sections.virtual_address
      level: extended
      type: long
      format: string
      description: ELF Section List virtual address.
      default_field: false
    - name: enrichments.indicator.file.elf.sections.virtual_size
      level: extended
      type: long
      format: string
      description: ELF Section List virtual size.
      default_field: false
    - name: enrichments.indicator.file.elf.segments
      level: extended
      type: nested
      description: 'An array containing an object for each segment of the ELF file.

        The keys that should be present in these objects are defined by sub-fields
        underneath `elf.segments.*`.'
      default_field: false
    - name: enrichments.indicator.file.elf.segments.sections
      level: extended
      type: keyword
      ignore_above: 1024
      description: ELF object segment sections.
      default_field: false
    - name: enrichments.indicator.file.elf.segments.type
      level: extended
      type: keyword
      ignore_above: 1024
      description: ELF object segment type.
      default_field: false
    - name: enrichments.indicator.file.elf.shared_libraries
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of shared libraries used by this ELF object.
      default_field: false
    - name: enrichments.indicator.file.elf.telfhash
      level: extended
      type: keyword
      ignore_above: 1024
      description: telfhash symbol hash for ELF file.
      default_field: false
    - name: enrichments.indicator.file.extension
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'File extension, excluding the leading dot.

        Note that when the file name has multiple extensions (example.tar.gz), only
        the last one should be captured ("gz", not "tar.gz").'
      example: png
      default_field: false
    - name: enrichments.indicator.file.fork_name
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'A fork is additional data associated with a filesystem object.

        On Linux, a resource fork is used to store additional data with a filesystem
        object. A file always has at least one fork for the data portion, and additional
        forks may exist.

        On NTFS, this is analogous to an Alternate Data Stream (ADS), and the default
        data stream for a file is just called $DATA. Zone.Identifier is commonly used
        by Windows to track contents downloaded from the Internet. An ADS is typically
        of the form: `C:\path\to\filename.extension:some_fork_name`, and `some_fork_name`
        is the value that should populate `fork_name`. `filename.extension` should
        populate `file.name`, and `extension` should populate `file.extension`. The
        full path, `file.path`, will include the fork name.'
      example: Zone.Identifer
      default_field: false
    - name: enrichments.indicator.file.gid
      level: extended
      type: keyword
      ignore_above: 1024
      description: Primary group ID (GID) of the file.
      example: '1001'
      default_field: false
    - name: enrichments.indicator.file.group
      level: extended
      type: keyword
      ignore_above: 1024
      description: Primary group name of the file.
      example: alice
      default_field: false
    - name: enrichments.indicator.file.hash.md5
      level: extended
      type: keyword
      ignore_above: 1024
      description: MD5 hash.
      default_field: false
    - name: enrichments.indicator.file.hash.sha1
      level: extended
      type: keyword
      ignore_above: 1024
      description: SHA1 hash.
      default_field: false
    - name: enrichments.indicator.file.hash.sha256
      level: extended
      type: keyword
      ignore_above: 1024
      description: SHA256 hash.
      default_field: false
    - name: enrichments.indicator.file.hash.sha512
      level: extended
      type: keyword
      ignore_above: 1024
      description: SHA512 hash.
      default_field: false
    - name: enrichments.indicator.file.hash.ssdeep
      level: extended
      type: keyword
      ignore_above: 1024
      description: SSDEEP hash.
      default_field: false
    - name: enrichments.indicator.file.inode
      level: extended
      type: keyword
      ignore_above: 1024
      description: Inode representing the file in the filesystem.
      example: '256383'
      default_field: false
    - name: enrichments.indicator.file.mime_type
      level: extended
      type: keyword
      ignore_above: 1024
      description: MIME type should identify the format of the file or stream of bytes
        using https://www.iana.org/assignments/media-types/media-types.xhtml[IANA
        official types], where possible. When more than one type is applicable, the
        most specific type should be used.
      default_field: false
    - name: enrichments.indicator.file.mode
      level: extended
      type: keyword
      ignore_above: 1024
      description: Mode of the file in octal representation.
      example: '0640'
      default_field: false
    - name: enrichments.indicator.file.mtime
      level: extended
      type: date
      description: Last time the file content was modified.
      default_field: false
    - name: enrichments.indicator.file.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Name of the file including the extension, without the directory.
      example: example.png
      default_field: false
    - name: enrichments.indicator.file.owner
      level: extended
      type: keyword
      ignore_above: 1024
      description: File owner's username.
      example: alice
      default_field: false
    - name: enrichments.indicator.file.path
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: match_only_text
      description: Full path to the file, including the file name. It should include
        the drive letter, when appropriate.
      example: /home/alice/example.png
      default_field: false
    - name: enrichments.indicator.file.pe.architecture
      level: extended
      type: keyword
      ignore_above: 1024
      description: CPU architecture target for the file.
      example: x64
      default_field: false
    - name: enrichments.indicator.file.pe.company
      level: extended
      type: keyword
      ignore_above: 1024
      description: Internal company name of the file, provided at compile-time.
      example: Microsoft Corporation
      default_field: false
    - name: enrichments.indicator.file.pe.description
      level: extended
      type: keyword
      ignore_above: 1024
      description: Internal description of the file, provided at compile-time.
      example: Paint
      default_field: false
    - name: enrichments.indicator.file.pe.file_version
      level: extended
      type: keyword
      ignore_above: 1024
      description: Internal version of the file, provided at compile-time.
      example: 6.3.9600.17415
      default_field: false
    - name: enrichments.indicator.file.pe.imphash
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'A hash of the imports in a PE file. An imphash -- or import hash
        -- can be used to fingerprint binaries even after recompilation or other code-level
        transformations have occurred, which would change more traditional hash values.

        Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.'
      example: 0c6803c4e922103c4dca5963aad36ddf
      default_field: false
    - name: enrichments.indicator.file.pe.original_file_name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Internal name of the file, provided at compile-time.
      example: MSPAINT.EXE
      default_field: false
    - name: enrichments.indicator.file.pe.product
      level: extended
      type: keyword
      ignore_above: 1024
      description: Internal product name of the file, provided at compile-time.
      example: "Microsoft\xAE Windows\xAE Operating System"
      default_field: false
    - name: enrichments.indicator.file.size
      level: extended
      type: long
      description: 'File size in bytes.

        Only relevant when `file.type` is "file".'
      example: 16384
      default_field: false
    - name: enrichments.indicator.file.target_path
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: match_only_text
      description: Target path for symlinks.
      default_field: false
    - name: enrichments.indicator.file.type
      level: extended
      type: keyword
      ignore_above: 1024
      description: File type (file, dir, or symlink).
      example: file
      default_field: false
    - name: enrichments.indicator.file.uid
      level: extended
      type: keyword
      ignore_above: 1024
      description: The user ID (UID) or security identifier (SID) of the file owner.
      example: '1001'
      default_field: false
    - name: enrichments.indicator.file.x509.alternative_names
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of subject alternative names (SAN). Name types vary by certificate
        authority and certificate type but commonly contain IP addresses, DNS names
        (and wildcards), and email addresses.
      example: '*.elastic.co'
      default_field: false
    - name: enrichments.indicator.file.x509.issuer.common_name
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of common name (CN) of issuing certificate authority.
      example: Example SHA2 High Assurance Server CA
      default_field: false
    - name: enrichments.indicator.file.x509.issuer.country
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of country (C) codes
      example: US
      default_field: false
    - name: enrichments.indicator.file.x509.issuer.distinguished_name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Distinguished name (DN) of issuing certificate authority.
      example: C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance
        Server CA
      default_field: false
    - name: enrichments.indicator.file.x509.issuer.locality
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of locality names (L)
      example: Mountain View
      default_field: false
    - name: enrichments.indicator.file.x509.issuer.organization
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of organizations (O) of issuing certificate authority.
      example: Example Inc
      default_field: false
    - name: enrichments.indicator.file.x509.issuer.organizational_unit
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of organizational units (OU) of issuing certificate authority.
      example: www.example.com
      default_field: false
    - name: enrichments.indicator.file.x509.issuer.state_or_province
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of state or province names (ST, S, or P)
      example: California
      default_field: false
    - name: enrichments.indicator.file.x509.not_after
      level: extended
      type: date
      description: Time at which the certificate is no longer considered valid.
      example: 2020-07-16 03:15:39+00:00
      default_field: false
    - name: enrichments.indicator.file.x509.not_before
      level: extended
      type: date
      description: Time at which the certificate is first considered valid.
      example: 2019-08-16 01:40:25+00:00
      default_field: false
    - name: enrichments.indicator.file.x509.public_key_algorithm
      level: extended
      type: keyword
      ignore_above: 1024
      description: Algorithm used to generate the public key.
      example: RSA
      default_field: false
    - name: enrichments.indicator.file.x509.public_key_curve
      level: extended
      type: keyword
      ignore_above: 1024
      description: The curve used by the elliptic curve public key algorithm. This
        is algorithm specific.
      example: nistp521
      default_field: false
    - name: enrichments.indicator.file.x509.public_key_exponent
      level: extended
      type: long
      description: Exponent used to derive the public key. This is algorithm specific.
      example: 65537
      index: false
      doc_values: false
      default_field: false
    - name: enrichments.indicator.file.x509.public_key_size
      level: extended
      type: long
      description: The size of the public key space in bits.
      example: 2048
      default_field: false
    - name: enrichments.indicator.file.x509.serial_number
      level: extended
      type: keyword
      ignore_above: 1024
      description: Unique serial number issued by the certificate authority. For consistency,
        if this value is alphanumeric, it should be formatted without colons and uppercase
        characters.
      example: 55FBB9C7DEBF09809D12CCAA
      default_field: false
    - name: enrichments.indicator.file.x509.signature_algorithm
      level: extended
      type: keyword
      ignore_above: 1024
      description: Identifier for certificate signature algorithm. We recommend using
        names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353.
      example: SHA256-RSA
      default_field: false
    - name: enrichments.indicator.file.x509.subject.common_name
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of common names (CN) of subject.
      example: shared.global.example.net
      default_field: false
    - name: enrichments.indicator.file.x509.subject.country
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of country (C) code
      example: US
      default_field: false
    - name: enrichments.indicator.file.x509.subject.distinguished_name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Distinguished name (DN) of the certificate subject entity.
      example: C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net
      default_field: false
    - name: enrichments.indicator.file.x509.subject.locality
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of locality names (L)
      example: San Francisco
      default_field: false
    - name: enrichments.indicator.file.x509.subject.organization
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of organizations (O) of subject.
      example: Example, Inc.
      default_field: false
    - name: enrichments.indicator.file.x509.subject.organizational_unit
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of organizational units (OU) of subject.
      default_field: false
    - name: enrichments.indicator.file.x509.subject.state_or_province
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of state or province names (ST, S, or P)
      example: California
      default_field: false
    - name: enrichments.indicator.file.x509.version_number
      level: extended
      type: keyword
      ignore_above: 1024
      description: Version of x509 format.
      example: 3
      default_field: false
    - name: enrichments.indicator.first_seen
      level: extended
      type: date
      description: The date and time when intelligence source first reported sighting
        this indicator.
      example: '2020-11-05T17:25:47.000Z'
      default_field: false
    - name: enrichments.indicator.geo.city_name
      level: core
      type: keyword
      ignore_above: 1024
      description: City name.
      example: Montreal
      default_field: false
    - name: enrichments.indicator.geo.continent_code
      level: core
      type: keyword
      ignore_above: 1024
      description: Two-letter code representing continent's name.
      example: NA
      default_field: false
    - name: enrichments.indicator.geo.continent_name
      level: core
      type: keyword
      ignore_above: 1024
      description: Name of the continent.
      example: North America
      default_field: false
    - name: enrichments.indicator.geo.country_iso_code
      level: core
      type: keyword
      ignore_above: 1024
      description: Country ISO code.
      example: CA
      default_field: false
    - name: enrichments.indicator.geo.country_name
      level: core
      type: keyword
      ignore_above: 1024
      description: Country name.
      example: Canada
      default_field: false
    - name: enrichments.indicator.geo.location
      level: core
      type: geo_point
      description: Longitude and latitude.
      example: '{ "lon": -73.614830, "lat": 45.505918 }'
      default_field: false
    - name: enrichments.indicator.geo.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'User-defined description of a location, at the level of granularity
        they care about.

        Could be the name of their data centers, the floor number, if this describes
        a local physical entity, city names.

        Not typically used in automated geolocation.'
      example: boston-dc
      default_field: false
    - name: enrichments.indicator.geo.postal_code
      level: core
      type: keyword
      ignore_above: 1024
      description: 'Postal code associated with the location.

        Values appropriate for this field may also be known as a postcode or ZIP code
        and will vary widely from country to country.'
      example: 94040
      default_field: false
    - name: enrichments.indicator.geo.region_iso_code
      level: core
      type: keyword
      ignore_above: 1024
      description: Region ISO code.
      example: CA-QC
      default_field: false
    - name: enrichments.indicator.geo.region_name
      level: core
      type: keyword
      ignore_above: 1024
      description: Region name.
      example: Quebec
      default_field: false
    - name: enrichments.indicator.geo.timezone
      level: core
      type: keyword
      ignore_above: 1024
      description: The time zone of the location, such as IANA time zone name.
      example: America/Argentina/Buenos_Aires
      default_field: false
    - name: enrichments.indicator.ip
      level: extended
      type: ip
      description: Identifies a threat indicator as an IP address (irrespective of
        direction).
      example: 1.2.3.4
      default_field: false
    - name: enrichments.indicator.last_seen
      level: extended
      type: date
      description: The date and time when intelligence source last reported sighting
        this indicator.
      example: '2020-11-05T17:25:47.000Z'
      default_field: false
    - name: enrichments.indicator.marking.tlp
      level: extended
      type: keyword
      ignore_above: 1024
      description: "Traffic Light Protocol sharing markings. Recommended values are:\n\
        \  * WHITE\n  * GREEN\n  * AMBER\n  * RED"
      example: White
      default_field: false
    - name: enrichments.indicator.modified_at
      level: extended
      type: date
      description: The date and time when intelligence source last modified information
        for this indicator.
      example: '2020-11-05T17:25:47.000Z'
      default_field: false
    - name: enrichments.indicator.port
      level: extended
      type: long
      description: Identifies a threat indicator as a port number (irrespective of
        direction).
      example: 443
      default_field: false
    - name: enrichments.indicator.provider
      level: extended
      type: keyword
      ignore_above: 1024
      description: The name of the indicator's provider.
      example: lrz_urlhaus
      default_field: false
    - name: enrichments.indicator.reference
      level: extended
      type: keyword
      ignore_above: 1024
      description: Reference URL linking to additional information about this indicator.
      example: https://system.example.com/indicator/0001234
      default_field: false
    - name: enrichments.indicator.registry.data.bytes
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Original bytes written with base64 encoding.

        For Windows registry operations, such as SetValueEx and RegQueryValueEx, this
        corresponds to the data pointed by `lp_data`. This is optional but provides
        better recoverability and should be populated for REG_BINARY encoded values.'
      example: ZQBuAC0AVQBTAAAAZQBuAAAAAAA=
      default_field: false
    - name: enrichments.indicator.registry.data.strings
      level: core
      type: wildcard
      description: 'Content when writing string types.

        Populated as an array when writing string data to the registry. For single
        string registry types (REG_SZ, REG_EXPAND_SZ), this should be an array with
        one string. For sequences of string with REG_MULTI_SZ, this array will be
        variable length. For numeric data, such as REG_DWORD and REG_QWORD, this should
        be populated with the decimal representation (e.g `"1"`).'
      example: '["C:\rta\red_ttp\bin\myapp.exe"]'
      default_field: false
    - name: enrichments.indicator.registry.data.type
      level: core
      type: keyword
      ignore_above: 1024
      description: Standard registry type for encoding contents
      example: REG_SZ
      default_field: false
    - name: enrichments.indicator.registry.hive
      level: core
      type: keyword
      ignore_above: 1024
      description: Abbreviated name for the hive.
      example: HKLM
      default_field: false
    - name: enrichments.indicator.registry.key
      level: core
      type: keyword
      ignore_above: 1024
      description: Hive-relative path of keys.
      example: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe
      default_field: false
    - name: enrichments.indicator.registry.path
      level: core
      type: keyword
      ignore_above: 1024
      description: Full path, including hive, key and value
      example: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
        Options\winword.exe\Debugger
      default_field: false
    - name: enrichments.indicator.registry.value
      level: core
      type: keyword
      ignore_above: 1024
      description: Name of the value written.
      example: Debugger
      default_field: false
    - name: enrichments.indicator.scanner_stats
      level: extended
      type: long
      description: Count of AV/EDR vendors that successfully detected malicious file
        or URL.
      example: 4
      default_field: false
    - name: enrichments.indicator.sightings
      level: extended
      type: long
      description: Number of times this indicator was observed conducting threat activity.
      example: 20
      default_field: false
    - name: enrichments.indicator.type
      level: extended
      type: keyword
      ignore_above: 1024
      description: "Type of indicator as represented by Cyber Observable in STIX 2.0.\
        \ Recommended values:\n  * autonomous-system\n  * artifact\n  * directory\n\
        \  * domain-name\n  * email-addr\n  * file\n  * ipv4-addr\n  * ipv6-addr\n\
        \  * mac-addr\n  * mutex\n  * port\n  * process\n  * software\n  * url\n \
        \ * user-account\n  * windows-registry-key\n  * x509-certificate"
      example: ipv4-addr
      default_field: false
    - name: enrichments.indicator.url.domain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Domain of the url, such as "www.elastic.co".

        In some cases a URL may refer to an IP and/or port directly, without a domain
        name. In this case, the IP address would go to the `domain` field.

        If the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC
        2732), the `[` and `]` characters should also be captured in the `domain`
        field.'
      example: www.elastic.co
      default_field: false
    - name: enrichments.indicator.url.extension
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The field contains the file extension from the original request
        url, excluding the leading dot.

        The file extension is only set if it exists, as not every url has a file extension.

        The leading period must not be included. For example, the value must be "png",
        not ".png".

        Note that when the file name has multiple extensions (example.tar.gz), only
        the last one should be captured ("gz", not "tar.gz").'
      example: png
      default_field: false
    - name: enrichments.indicator.url.fragment
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Portion of the url after the `#`, such as "top".

        The `#` is not part of the fragment.'
      default_field: false
    - name: enrichments.indicator.url.full
      level: extended
      type: wildcard
      multi_fields:
      - name: text
        type: match_only_text
      description: If full URLs are important to your use case, they should be stored
        in `url.full`, whether this field is reconstructed or present in the event
        source.
      example: https://www.elastic.co:443/search?q=elasticsearch#top
      default_field: false
    - name: enrichments.indicator.url.original
      level: extended
      type: wildcard
      multi_fields:
      - name: text
        type: match_only_text
      description: 'Unmodified original url as seen in the event source.

        Note that in network monitoring, the observed URL may be a full URL, whereas
        in access logs, the URL is often just represented as a path.

        This field is meant to represent the URL as it was observed, complete or not.'
      example: https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch
      default_field: false
    - name: enrichments.indicator.url.password
      level: extended
      type: keyword
      ignore_above: 1024
      description: Password of the request.
      default_field: false
    - name: enrichments.indicator.url.path
      level: extended
      type: wildcard
      description: Path of the request, such as "/search".
      default_field: false
    - name: enrichments.indicator.url.port
      level: extended
      type: long
      format: string
      description: Port of the request, such as 443.
      example: 443
      default_field: false
    - name: enrichments.indicator.url.query
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The query field describes the query string of the request, such
        as "q=elasticsearch".

        The `?` is excluded from the query string. If a URL contains no `?`, there
        is no query field. If there is a `?` but no query, the query field exists
        with an empty string. The `exists` query can be used to differentiate between
        the two cases.'
      default_field: false
    - name: enrichments.indicator.url.registered_domain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The highest registered url domain, stripped of the subdomain.

        For example, the registered domain for "foo.example.com" is "example.com".

        This value can be determined precisely with a list like the public suffix
        list (http://publicsuffix.org). Trying to approximate this by simply taking
        the last two labels will not work well for TLDs such as "co.uk".'
      example: example.com
      default_field: false
    - name: enrichments.indicator.url.scheme
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Scheme of the request, such as "https".

        Note: The `:` is not part of the scheme.'
      example: https
      default_field: false
    - name: enrichments.indicator.url.subdomain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The subdomain portion of a fully qualified domain name includes
        all of the names except the host name under the registered_domain.  In a partially
        qualified domain, or if the the qualification level of the full name cannot
        be determined, subdomain contains all of the names below the registered domain.

        For example the subdomain portion of "www.east.mydomain.co.uk" is "east".
        If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com",
        the subdomain field should contain "sub2.sub1", with no trailing period.'
      example: east
      default_field: false
    - name: enrichments.indicator.url.top_level_domain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The effective top level domain (eTLD), also known as the domain
        suffix, is the last part of the domain name. For example, the top level domain
        for example.com is "com".

        This value can be determined precisely with a list like the public suffix
        list (http://publicsuffix.org). Trying to approximate this by simply taking
        the last label will not work well for effective TLDs such as "co.uk".'
      example: co.uk
      default_field: false
    - name: enrichments.indicator.url.username
      level: extended
      type: keyword
      ignore_above: 1024
      description: Username of the request.
      default_field: false
    - name: enrichments.indicator.x509.alternative_names
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of subject alternative names (SAN). Name types vary by certificate
        authority and certificate type but commonly contain IP addresses, DNS names
        (and wildcards), and email addresses.
      example: '*.elastic.co'
      default_field: false
    - name: enrichments.indicator.x509.issuer.common_name
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of common name (CN) of issuing certificate authority.
      example: Example SHA2 High Assurance Server CA
      default_field: false
    - name: enrichments.indicator.x509.issuer.country
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of country (C) codes
      example: US
      default_field: false
    - name: enrichments.indicator.x509.issuer.distinguished_name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Distinguished name (DN) of issuing certificate authority.
      example: C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance
        Server CA
      default_field: false
    - name: enrichments.indicator.x509.issuer.locality
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of locality names (L)
      example: Mountain View
      default_field: false
    - name: enrichments.indicator.x509.issuer.organization
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of organizations (O) of issuing certificate authority.
      example: Example Inc
      default_field: false
    - name: enrichments.indicator.x509.issuer.organizational_unit
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of organizational units (OU) of issuing certificate authority.
      example: www.example.com
      default_field: false
    - name: enrichments.indicator.x509.issuer.state_or_province
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of state or province names (ST, S, or P)
      example: California
      default_field: false
    - name: enrichments.indicator.x509.not_after
      level: extended
      type: date
      description: Time at which the certificate is no longer considered valid.
      example: 2020-07-16 03:15:39+00:00
      default_field: false
    - name: enrichments.indicator.x509.not_before
      level: extended
      type: date
      description: Time at which the certificate is first considered valid.
      example: 2019-08-16 01:40:25+00:00
      default_field: false
    - name: enrichments.indicator.x509.public_key_algorithm
      level: extended
      type: keyword
      ignore_above: 1024
      description: Algorithm used to generate the public key.
      example: RSA
      default_field: false
    - name: enrichments.indicator.x509.public_key_curve
      level: extended
      type: keyword
      ignore_above: 1024
      description: The curve used by the elliptic curve public key algorithm. This
        is algorithm specific.
      example: nistp521
      default_field: false
    - name: enrichments.indicator.x509.public_key_exponent
      level: extended
      type: long
      description: Exponent used to derive the public key. This is algorithm specific.
      example: 65537
      index: false
      doc_values: false
      default_field: false
    - name: enrichments.indicator.x509.public_key_size
      level: extended
      type: long
      description: The size of the public key space in bits.
      example: 2048
      default_field: false
    - name: enrichments.indicator.x509.serial_number
      level: extended
      type: keyword
      ignore_above: 1024
      description: Unique serial number issued by the certificate authority. For consistency,
        if this value is alphanumeric, it should be formatted without colons and uppercase
        characters.
      example: 55FBB9C7DEBF09809D12CCAA
      default_field: false
    - name: enrichments.indicator.x509.signature_algorithm
      level: extended
      type: keyword
      ignore_above: 1024
      description: Identifier for certificate signature algorithm. We recommend using
        names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353.
      example: SHA256-RSA
      default_field: false
    - name: enrichments.indicator.x509.subject.common_name
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of common names (CN) of subject.
      example: shared.global.example.net
      default_field: false
    - name: enrichments.indicator.x509.subject.country
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of country (C) code
      example: US
      default_field: false
    - name: enrichments.indicator.x509.subject.distinguished_name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Distinguished name (DN) of the certificate subject entity.
      example: C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net
      default_field: false
    - name: enrichments.indicator.x509.subject.locality
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of locality names (L)
      example: San Francisco
      default_field: false
    - name: enrichments.indicator.x509.subject.organization
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of organizations (O) of subject.
      example: Example, Inc.
      default_field: false
    - name: enrichments.indicator.x509.subject.organizational_unit
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of organizational units (OU) of subject.
      default_field: false
    - name: enrichments.indicator.x509.subject.state_or_province
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of state or province names (ST, S, or P)
      example: California
      default_field: false
    - name: enrichments.indicator.x509.version_number
      level: extended
      type: keyword
      ignore_above: 1024
      description: Version of x509 format.
      example: 3
      default_field: false
    - name: enrichments.matched.atomic
      level: extended
      type: keyword
      ignore_above: 1024
      description: Identifies the atomic indicator value that matched a local environment
        endpoint or network event.
      example: bad-domain.com
      default_field: false
    - name: enrichments.matched.field
      level: extended
      type: keyword
      ignore_above: 1024
      description: Identifies the field of the atomic indicator that matched a local
        environment endpoint or network event.
      example: file.hash.sha256
      default_field: false
    - name: enrichments.matched.id
      level: extended
      type: keyword
      ignore_above: 1024
      description: Identifies the _id of the indicator document enriching the event.
      example: ff93aee5-86a1-4a61-b0e6-0cdc313d01b5
      default_field: false
    - name: enrichments.matched.index
      level: extended
      type: keyword
      ignore_above: 1024
      description: Identifies the _index of the indicator document enriching the event.
      example: filebeat-8.0.0-2021.05.23-000011
      default_field: false
    - name: enrichments.matched.type
      level: extended
      type: keyword
      ignore_above: 1024
      description: Identifies the type of match that caused the event to be enriched
        with the given indicator
      example: indicator_match_rule
      default_field: false
    - name: framework
      level: extended
      type: keyword
      ignore_above: 1024
      description: Name of the threat framework used to further categorize and classify
        the tactic and technique of the reported threat. Framework classification
        can be provided by detecting systems, evaluated at ingest time, or retrospectively
        tagged to events.
      example: MITRE ATT&CK
    - name: group.alias
      level: extended
      type: keyword
      ignore_above: 1024
      description: "The alias(es) of the group for a set of related intrusion activity\
        \ that are tracked by a common name in the security community.\nWhile not\
        \ required, you can use a MITRE ATT&CK\xAE group alias(es)."
      example: '[ "Magecart Group 6" ]'
      default_field: false
    - name: group.id
      level: extended
      type: keyword
      ignore_above: 1024
      description: "The id of the group for a set of related intrusion activity that\
        \ are tracked by a common name in the security community.\nWhile not required,\
        \ you can use a MITRE ATT&CK\xAE group id."
      example: G0037
      default_field: false
    - name: group.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: "The name of the group for a set of related intrusion activity\
        \ that are tracked by a common name in the security community.\nWhile not\
        \ required, you can use a MITRE ATT&CK\xAE group name."
      example: FIN6
      default_field: false
    - name: group.reference
      level: extended
      type: keyword
      ignore_above: 1024
      description: "The reference URL of the group for a set of related intrusion\
        \ activity that are tracked by a common name in the security community.\n\
        While not required, you can use a MITRE ATT&CK\xAE group reference URL."
      example: https://attack.mitre.org/groups/G0037/
      default_field: false
    - name: indicator.as.number
      level: extended
      type: long
      description: Unique number allocated to the autonomous system. The autonomous
        system number (ASN) uniquely identifies each network on the Internet.
      example: 15169
      default_field: false
    - name: indicator.as.organization.name
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: match_only_text
      description: Organization name.
      example: Google LLC
      default_field: false
    - name: indicator.confidence
      level: extended
      type: keyword
      ignore_above: 1024
      description: "Identifies\_the\_vendor-neutral confidence\_rating\_using\_the\
        \ None/Low/Medium/High\_scale defined in Appendix A of the STIX 2.1 framework.\
        \ Vendor-specific confidence scales may be added as custom fields.\nExpected\
        \ values are:\n  * Not Specified\n  * None\n  * Low\n  * Medium\n  * High"
      example: Medium
      default_field: false
    - name: indicator.description
      level: extended
      type: keyword
      ignore_above: 1024
      description: Describes the type of action conducted by the threat.
      example: IP x.x.x.x was observed delivering the Angler EK.
      default_field: false
    - name: indicator.email.address
      level: extended
      type: keyword
      ignore_above: 1024
      description: Identifies a threat indicator as an email address (irrespective
        of direction).
      example: phish@example.com
      default_field: false
    - name: indicator.file.accessed
      level: extended
      type: date
      description: 'Last time the file was accessed.

        Note that not all filesystems keep track of access time.'
      default_field: false
    - name: indicator.file.attributes
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Array of file attributes.

        Attributes names will vary by platform. Here''s a non-exhaustive list of values
        that are expected in this field: archive, compressed, directory, encrypted,
        execute, hidden, read, readonly, system, write.'
      example: '["readonly", "system"]'
      default_field: false
    - name: indicator.file.code_signature.digest_algorithm
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The hashing algorithm used to sign the process.

        This value can distinguish signatures when a file is signed multiple times
        by the same signer but with a different digest algorithm.'
      example: sha256
      default_field: false
    - name: indicator.file.code_signature.exists
      level: core
      type: boolean
      description: Boolean to capture if a signature is present.
      example: 'true'
      default_field: false
    - name: indicator.file.code_signature.signing_id
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The identifier used to sign the process.

        This is used to identify the application manufactured by a software vendor.
        The field is relevant to Apple *OS only.'
      example: com.apple.xpc.proxy
      default_field: false
    - name: indicator.file.code_signature.status
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Additional information about the certificate status.

        This is useful for logging cryptographic errors with the certificate validity
        or trust status. Leave unpopulated if the validity or trust of the certificate
        was unchecked.'
      example: ERROR_UNTRUSTED_ROOT
      default_field: false
    - name: indicator.file.code_signature.subject_name
      level: core
      type: keyword
      ignore_above: 1024
      description: Subject name of the code signer
      example: Microsoft Corporation
      default_field: false
    - name: indicator.file.code_signature.team_id
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The team identifier used to sign the process.

        This is used to identify the team or vendor of a software product. The field
        is relevant to Apple *OS only.'
      example: EQHXZ8M8AV
      default_field: false
    - name: indicator.file.code_signature.timestamp
      level: extended
      type: date
      description: Date and time when the code signature was generated and signed.
      example: '2021-01-01T12:10:30Z'
      default_field: false
    - name: indicator.file.code_signature.trusted
      level: extended
      type: boolean
      description: 'Stores the trust status of the certificate chain.

        Validating the trust of the certificate chain may be complicated, and this
        field should only be populated by tools that actively check the status.'
      example: 'true'
      default_field: false
    - name: indicator.file.code_signature.valid
      level: extended
      type: boolean
      description: 'Boolean to capture if the digital signature is verified against
        the binary content.

        Leave unpopulated if a certificate was unchecked.'
      example: 'true'
      default_field: false
    - name: indicator.file.created
      level: extended
      type: date
      description: 'File creation time.

        Note that not all filesystems store the creation time.'
      default_field: false
    - name: indicator.file.ctime
      level: extended
      type: date
      description: 'Last time the file attributes or metadata changed.

        Note that changes to the file content will update `mtime`. This implies `ctime`
        will be adjusted at the same time, since `mtime` is an attribute of the file.'
      default_field: false
    - name: indicator.file.device
      level: extended
      type: keyword
      ignore_above: 1024
      description: Device that is the source of the file.
      example: sda
      default_field: false
    - name: indicator.file.directory
      level: extended
      type: keyword
      ignore_above: 1024
      description: Directory where the file is located. It should include the drive
        letter, when appropriate.
      example: /home/alice
      default_field: false
    - name: indicator.file.drive_letter
      level: extended
      type: keyword
      ignore_above: 1
      description: 'Drive letter where the file is located. This field is only relevant
        on Windows.

        The value should be uppercase, and not include the colon.'
      example: C
      default_field: false
    - name: indicator.file.elf.architecture
      level: extended
      type: keyword
      ignore_above: 1024
      description: Machine architecture of the ELF file.
      example: x86-64
      default_field: false
    - name: indicator.file.elf.byte_order
      level: extended
      type: keyword
      ignore_above: 1024
      description: Byte sequence of ELF file.
      example: Little Endian
      default_field: false
    - name: indicator.file.elf.cpu_type
      level: extended
      type: keyword
      ignore_above: 1024
      description: CPU type of the ELF file.
      example: Intel
      default_field: false
    - name: indicator.file.elf.creation_date
      level: extended
      type: date
      description: Extracted when possible from the file's metadata. Indicates when
        it was built or compiled. It can also be faked by malware creators.
      default_field: false
    - name: indicator.file.elf.exports
      level: extended
      type: flattened
      description: List of exported element names and types.
      default_field: false
    - name: indicator.file.elf.header.abi_version
      level: extended
      type: keyword
      ignore_above: 1024
      description: Version of the ELF Application Binary Interface (ABI).
      default_field: false
    - name: indicator.file.elf.header.class
      level: extended
      type: keyword
      ignore_above: 1024
      description: Header class of the ELF file.
      default_field: false
    - name: indicator.file.elf.header.data
      level: extended
      type: keyword
      ignore_above: 1024
      description: Data table of the ELF header.
      default_field: false
    - name: indicator.file.elf.header.entrypoint
      level: extended
      type: long
      format: string
      description: Header entrypoint of the ELF file.
      default_field: false
    - name: indicator.file.elf.header.object_version
      level: extended
      type: keyword
      ignore_above: 1024
      description: '"0x1" for original ELF files.'
      default_field: false
    - name: indicator.file.elf.header.os_abi
      level: extended
      type: keyword
      ignore_above: 1024
      description: Application Binary Interface (ABI) of the Linux OS.
      default_field: false
    - name: indicator.file.elf.header.type
      level: extended
      type: keyword
      ignore_above: 1024
      description: Header type of the ELF file.
      default_field: false
    - name: indicator.file.elf.header.version
      level: extended
      type: keyword
      ignore_above: 1024
      description: Version of the ELF header.
      default_field: false
    - name: indicator.file.elf.imports
      level: extended
      type: flattened
      description: List of imported element names and types.
      default_field: false
    - name: indicator.file.elf.sections
      level: extended
      type: nested
      description: 'An array containing an object for each section of the ELF file.

        The keys that should be present in these objects are defined by sub-fields
        underneath `elf.sections.*`.'
      default_field: false
    - name: indicator.file.elf.sections.chi2
      level: extended
      type: long
      format: number
      description: Chi-square probability distribution of the section.
      default_field: false
    - name: indicator.file.elf.sections.entropy
      level: extended
      type: long
      format: number
      description: Shannon entropy calculation from the section.
      default_field: false
    - name: indicator.file.elf.sections.flags
      level: extended
      type: keyword
      ignore_above: 1024
      description: ELF Section List flags.
      default_field: false
    - name: indicator.file.elf.sections.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: ELF Section List name.
      default_field: false
    - name: indicator.file.elf.sections.physical_offset
      level: extended
      type: keyword
      ignore_above: 1024
      description: ELF Section List offset.
      default_field: false
    - name: indicator.file.elf.sections.physical_size
      level: extended
      type: long
      format: bytes
      description: ELF Section List physical size.
      default_field: false
    - name: indicator.file.elf.sections.type
      level: extended
      type: keyword
      ignore_above: 1024
      description: ELF Section List type.
      default_field: false
    - name: indicator.file.elf.sections.virtual_address
      level: extended
      type: long
      format: string
      description: ELF Section List virtual address.
      default_field: false
    - name: indicator.file.elf.sections.virtual_size
      level: extended
      type: long
      format: string
      description: ELF Section List virtual size.
      default_field: false
    - name: indicator.file.elf.segments
      level: extended
      type: nested
      description: 'An array containing an object for each segment of the ELF file.

        The keys that should be present in these objects are defined by sub-fields
        underneath `elf.segments.*`.'
      default_field: false
    - name: indicator.file.elf.segments.sections
      level: extended
      type: keyword
      ignore_above: 1024
      description: ELF object segment sections.
      default_field: false
    - name: indicator.file.elf.segments.type
      level: extended
      type: keyword
      ignore_above: 1024
      description: ELF object segment type.
      default_field: false
    - name: indicator.file.elf.shared_libraries
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of shared libraries used by this ELF object.
      default_field: false
    - name: indicator.file.elf.telfhash
      level: extended
      type: keyword
      ignore_above: 1024
      description: telfhash symbol hash for ELF file.
      default_field: false
    - name: indicator.file.extension
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'File extension, excluding the leading dot.

        Note that when the file name has multiple extensions (example.tar.gz), only
        the last one should be captured ("gz", not "tar.gz").'
      example: png
      default_field: false
    - name: indicator.file.fork_name
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'A fork is additional data associated with a filesystem object.

        On Linux, a resource fork is used to store additional data with a filesystem
        object. A file always has at least one fork for the data portion, and additional
        forks may exist.

        On NTFS, this is analogous to an Alternate Data Stream (ADS), and the default
        data stream for a file is just called $DATA. Zone.Identifier is commonly used
        by Windows to track contents downloaded from the Internet. An ADS is typically
        of the form: `C:\path\to\filename.extension:some_fork_name`, and `some_fork_name`
        is the value that should populate `fork_name`. `filename.extension` should
        populate `file.name`, and `extension` should populate `file.extension`. The
        full path, `file.path`, will include the fork name.'
      example: Zone.Identifer
      default_field: false
    - name: indicator.file.gid
      level: extended
      type: keyword
      ignore_above: 1024
      description: Primary group ID (GID) of the file.
      example: '1001'
      default_field: false
    - name: indicator.file.group
      level: extended
      type: keyword
      ignore_above: 1024
      description: Primary group name of the file.
      example: alice
      default_field: false
    - name: indicator.file.hash.md5
      level: extended
      type: keyword
      ignore_above: 1024
      description: MD5 hash.
      default_field: false
    - name: indicator.file.hash.sha1
      level: extended
      type: keyword
      ignore_above: 1024
      description: SHA1 hash.
      default_field: false
    - name: indicator.file.hash.sha256
      level: extended
      type: keyword
      ignore_above: 1024
      description: SHA256 hash.
      default_field: false
    - name: indicator.file.hash.sha512
      level: extended
      type: keyword
      ignore_above: 1024
      description: SHA512 hash.
      default_field: false
    - name: indicator.file.hash.ssdeep
      level: extended
      type: keyword
      ignore_above: 1024
      description: SSDEEP hash.
      default_field: false
    - name: indicator.file.inode
      level: extended
      type: keyword
      ignore_above: 1024
      description: Inode representing the file in the filesystem.
      example: '256383'
      default_field: false
    - name: indicator.file.mime_type
      level: extended
      type: keyword
      ignore_above: 1024
      description: MIME type should identify the format of the file or stream of bytes
        using https://www.iana.org/assignments/media-types/media-types.xhtml[IANA
        official types], where possible. When more than one type is applicable, the
        most specific type should be used.
      default_field: false
    - name: indicator.file.mode
      level: extended
      type: keyword
      ignore_above: 1024
      description: Mode of the file in octal representation.
      example: '0640'
      default_field: false
    - name: indicator.file.mtime
      level: extended
      type: date
      description: Last time the file content was modified.
      default_field: false
    - name: indicator.file.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Name of the file including the extension, without the directory.
      example: example.png
      default_field: false
    - name: indicator.file.owner
      level: extended
      type: keyword
      ignore_above: 1024
      description: File owner's username.
      example: alice
      default_field: false
    - name: indicator.file.path
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: match_only_text
      description: Full path to the file, including the file name. It should include
        the drive letter, when appropriate.
      example: /home/alice/example.png
      default_field: false
    - name: indicator.file.pe.architecture
      level: extended
      type: keyword
      ignore_above: 1024
      description: CPU architecture target for the file.
      example: x64
      default_field: false
    - name: indicator.file.pe.company
      level: extended
      type: keyword
      ignore_above: 1024
      description: Internal company name of the file, provided at compile-time.
      example: Microsoft Corporation
      default_field: false
    - name: indicator.file.pe.description
      level: extended
      type: keyword
      ignore_above: 1024
      description: Internal description of the file, provided at compile-time.
      example: Paint
      default_field: false
    - name: indicator.file.pe.file_version
      level: extended
      type: keyword
      ignore_above: 1024
      description: Internal version of the file, provided at compile-time.
      example: 6.3.9600.17415
      default_field: false
    - name: indicator.file.pe.imphash
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'A hash of the imports in a PE file. An imphash -- or import hash
        -- can be used to fingerprint binaries even after recompilation or other code-level
        transformations have occurred, which would change more traditional hash values.

        Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.'
      example: 0c6803c4e922103c4dca5963aad36ddf
      default_field: false
    - name: indicator.file.pe.original_file_name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Internal name of the file, provided at compile-time.
      example: MSPAINT.EXE
      default_field: false
    - name: indicator.file.pe.product
      level: extended
      type: keyword
      ignore_above: 1024
      description: Internal product name of the file, provided at compile-time.
      example: "Microsoft\xAE Windows\xAE Operating System"
      default_field: false
    - name: indicator.file.size
      level: extended
      type: long
      description: 'File size in bytes.

        Only relevant when `file.type` is "file".'
      example: 16384
      default_field: false
    - name: indicator.file.target_path
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: match_only_text
      description: Target path for symlinks.
      default_field: false
    - name: indicator.file.type
      level: extended
      type: keyword
      ignore_above: 1024
      description: File type (file, dir, or symlink).
      example: file
      default_field: false
    - name: indicator.file.uid
      level: extended
      type: keyword
      ignore_above: 1024
      description: The user ID (UID) or security identifier (SID) of the file owner.
      example: '1001'
      default_field: false
    - name: indicator.file.x509.alternative_names
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of subject alternative names (SAN). Name types vary by certificate
        authority and certificate type but commonly contain IP addresses, DNS names
        (and wildcards), and email addresses.
      example: '*.elastic.co'
      default_field: false
    - name: indicator.file.x509.issuer.common_name
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of common name (CN) of issuing certificate authority.
      example: Example SHA2 High Assurance Server CA
      default_field: false
    - name: indicator.file.x509.issuer.country
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of country (C) codes
      example: US
      default_field: false
    - name: indicator.file.x509.issuer.distinguished_name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Distinguished name (DN) of issuing certificate authority.
      example: C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance
        Server CA
      default_field: false
    - name: indicator.file.x509.issuer.locality
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of locality names (L)
      example: Mountain View
      default_field: false
    - name: indicator.file.x509.issuer.organization
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of organizations (O) of issuing certificate authority.
      example: Example Inc
      default_field: false
    - name: indicator.file.x509.issuer.organizational_unit
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of organizational units (OU) of issuing certificate authority.
      example: www.example.com
      default_field: false
    - name: indicator.file.x509.issuer.state_or_province
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of state or province names (ST, S, or P)
      example: California
      default_field: false
    - name: indicator.file.x509.not_after
      level: extended
      type: date
      description: Time at which the certificate is no longer considered valid.
      example: 2020-07-16 03:15:39+00:00
      default_field: false
    - name: indicator.file.x509.not_before
      level: extended
      type: date
      description: Time at which the certificate is first considered valid.
      example: 2019-08-16 01:40:25+00:00
      default_field: false
    - name: indicator.file.x509.public_key_algorithm
      level: extended
      type: keyword
      ignore_above: 1024
      description: Algorithm used to generate the public key.
      example: RSA
      default_field: false
    - name: indicator.file.x509.public_key_curve
      level: extended
      type: keyword
      ignore_above: 1024
      description: The curve used by the elliptic curve public key algorithm. This
        is algorithm specific.
      example: nistp521
      default_field: false
    - name: indicator.file.x509.public_key_exponent
      level: extended
      type: long
      description: Exponent used to derive the public key. This is algorithm specific.
      example: 65537
      index: false
      doc_values: false
      default_field: false
    - name: indicator.file.x509.public_key_size
      level: extended
      type: long
      description: The size of the public key space in bits.
      example: 2048
      default_field: false
    - name: indicator.file.x509.serial_number
      level: extended
      type: keyword
      ignore_above: 1024
      description: Unique serial number issued by the certificate authority. For consistency,
        if this value is alphanumeric, it should be formatted without colons and uppercase
        characters.
      example: 55FBB9C7DEBF09809D12CCAA
      default_field: false
    - name: indicator.file.x509.signature_algorithm
      level: extended
      type: keyword
      ignore_above: 1024
      description: Identifier for certificate signature algorithm. We recommend using
        names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353.
      example: SHA256-RSA
      default_field: false
    - name: indicator.file.x509.subject.common_name
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of common names (CN) of subject.
      example: shared.global.example.net
      default_field: false
    - name: indicator.file.x509.subject.country
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of country (C) code
      example: US
      default_field: false
    - name: indicator.file.x509.subject.distinguished_name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Distinguished name (DN) of the certificate subject entity.
      example: C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net
      default_field: false
    - name: indicator.file.x509.subject.locality
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of locality names (L)
      example: San Francisco
      default_field: false
    - name: indicator.file.x509.subject.organization
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of organizations (O) of subject.
      example: Example, Inc.
      default_field: false
    - name: indicator.file.x509.subject.organizational_unit
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of organizational units (OU) of subject.
      default_field: false
    - name: indicator.file.x509.subject.state_or_province
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of state or province names (ST, S, or P)
      example: California
      default_field: false
    - name: indicator.file.x509.version_number
      level: extended
      type: keyword
      ignore_above: 1024
      description: Version of x509 format.
      example: 3
      default_field: false
    - name: indicator.first_seen
      level: extended
      type: date
      description: The date and time when intelligence source first reported sighting
        this indicator.
      example: '2020-11-05T17:25:47.000Z'
      default_field: false
    - name: indicator.geo.city_name
      level: core
      type: keyword
      ignore_above: 1024
      description: City name.
      example: Montreal
      default_field: false
    - name: indicator.geo.continent_code
      level: core
      type: keyword
      ignore_above: 1024
      description: Two-letter code representing continent's name.
      example: NA
      default_field: false
    - name: indicator.geo.continent_name
      level: core
      type: keyword
      ignore_above: 1024
      description: Name of the continent.
      example: North America
      default_field: false
    - name: indicator.geo.country_iso_code
      level: core
      type: keyword
      ignore_above: 1024
      description: Country ISO code.
      example: CA
      default_field: false
    - name: indicator.geo.country_name
      level: core
      type: keyword
      ignore_above: 1024
      description: Country name.
      example: Canada
      default_field: false
    - name: indicator.geo.location
      level: core
      type: geo_point
      description: Longitude and latitude.
      example: '{ "lon": -73.614830, "lat": 45.505918 }'
      default_field: false
    - name: indicator.geo.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'User-defined description of a location, at the level of granularity
        they care about.

        Could be the name of their data centers, the floor number, if this describes
        a local physical entity, city names.

        Not typically used in automated geolocation.'
      example: boston-dc
      default_field: false
    - name: indicator.geo.postal_code
      level: core
      type: keyword
      ignore_above: 1024
      description: 'Postal code associated with the location.

        Values appropriate for this field may also be known as a postcode or ZIP code
        and will vary widely from country to country.'
      example: 94040
      default_field: false
    - name: indicator.geo.region_iso_code
      level: core
      type: keyword
      ignore_above: 1024
      description: Region ISO code.
      example: CA-QC
      default_field: false
    - name: indicator.geo.region_name
      level: core
      type: keyword
      ignore_above: 1024
      description: Region name.
      example: Quebec
      default_field: false
    - name: indicator.geo.timezone
      level: core
      type: keyword
      ignore_above: 1024
      description: The time zone of the location, such as IANA time zone name.
      example: America/Argentina/Buenos_Aires
      default_field: false
    - name: indicator.ip
      level: extended
      type: ip
      description: Identifies a threat indicator as an IP address (irrespective of
        direction).
      example: 1.2.3.4
      default_field: false
    - name: indicator.last_seen
      level: extended
      type: date
      description: The date and time when intelligence source last reported sighting
        this indicator.
      example: '2020-11-05T17:25:47.000Z'
      default_field: false
    - name: indicator.marking.tlp
      level: extended
      type: keyword
      ignore_above: 1024
      description: "Traffic Light Protocol sharing markings.\nRecommended values are:\n\
        \  * WHITE\n  * GREEN\n  * AMBER\n  * RED"
      example: WHITE
      default_field: false
    - name: indicator.modified_at
      level: extended
      type: date
      description: The date and time when intelligence source last modified information
        for this indicator.
      example: '2020-11-05T17:25:47.000Z'
      default_field: false
    - name: indicator.port
      level: extended
      type: long
      description: Identifies a threat indicator as a port number (irrespective of
        direction).
      example: 443
      default_field: false
    - name: indicator.provider
      level: extended
      type: keyword
      ignore_above: 1024
      description: The name of the indicator's provider.
      example: lrz_urlhaus
      default_field: false
    - name: indicator.reference
      level: extended
      type: keyword
      ignore_above: 1024
      description: Reference URL linking to additional information about this indicator.
      example: https://system.example.com/indicator/0001234
      default_field: false
    - name: indicator.registry.data.bytes
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Original bytes written with base64 encoding.

        For Windows registry operations, such as SetValueEx and RegQueryValueEx, this
        corresponds to the data pointed by `lp_data`. This is optional but provides
        better recoverability and should be populated for REG_BINARY encoded values.'
      example: ZQBuAC0AVQBTAAAAZQBuAAAAAAA=
      default_field: false
    - name: indicator.registry.data.strings
      level: core
      type: wildcard
      description: 'Content when writing string types.

        Populated as an array when writing string data to the registry. For single
        string registry types (REG_SZ, REG_EXPAND_SZ), this should be an array with
        one string. For sequences of string with REG_MULTI_SZ, this array will be
        variable length. For numeric data, such as REG_DWORD and REG_QWORD, this should
        be populated with the decimal representation (e.g `"1"`).'
      example: '["C:\rta\red_ttp\bin\myapp.exe"]'
      default_field: false
    - name: indicator.registry.data.type
      level: core
      type: keyword
      ignore_above: 1024
      description: Standard registry type for encoding contents
      example: REG_SZ
      default_field: false
    - name: indicator.registry.hive
      level: core
      type: keyword
      ignore_above: 1024
      description: Abbreviated name for the hive.
      example: HKLM
      default_field: false
    - name: indicator.registry.key
      level: core
      type: keyword
      ignore_above: 1024
      description: Hive-relative path of keys.
      example: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe
      default_field: false
    - name: indicator.registry.path
      level: core
      type: keyword
      ignore_above: 1024
      description: Full path, including hive, key and value
      example: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
        Options\winword.exe\Debugger
      default_field: false
    - name: indicator.registry.value
      level: core
      type: keyword
      ignore_above: 1024
      description: Name of the value written.
      example: Debugger
      default_field: false
    - name: indicator.scanner_stats
      level: extended
      type: long
      description: Count of AV/EDR vendors that successfully detected malicious file
        or URL.
      example: 4
      default_field: false
    - name: indicator.sightings
      level: extended
      type: long
      description: Number of times this indicator was observed conducting threat activity.
      example: 20
      default_field: false
    - name: indicator.type
      level: extended
      type: keyword
      ignore_above: 1024
      description: "Type of indicator as represented by Cyber Observable in STIX 2.0.\n\
        Recommended values:\n  * autonomous-system\n  * artifact\n  * directory\n\
        \  * domain-name\n  * email-addr\n  * file\n  * ipv4-addr\n  * ipv6-addr\n\
        \  * mac-addr\n  * mutex\n  * port\n  * process\n  * software\n  * url\n \
        \ * user-account\n  * windows-registry-key\n  * x509-certificate"
      example: ipv4-addr
      default_field: false
    - name: indicator.url.domain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Domain of the url, such as "www.elastic.co".

        In some cases a URL may refer to an IP and/or port directly, without a domain
        name. In this case, the IP address would go to the `domain` field.

        If the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC
        2732), the `[` and `]` characters should also be captured in the `domain`
        field.'
      example: www.elastic.co
      default_field: false
    - name: indicator.url.extension
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The field contains the file extension from the original request
        url, excluding the leading dot.

        The file extension is only set if it exists, as not every url has a file extension.

        The leading period must not be included. For example, the value must be "png",
        not ".png".

        Note that when the file name has multiple extensions (example.tar.gz), only
        the last one should be captured ("gz", not "tar.gz").'
      example: png
      default_field: false
    - name: indicator.url.fragment
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Portion of the url after the `#`, such as "top".

        The `#` is not part of the fragment.'
      default_field: false
    - name: indicator.url.full
      level: extended
      type: wildcard
      multi_fields:
      - name: text
        type: match_only_text
      description: If full URLs are important to your use case, they should be stored
        in `url.full`, whether this field is reconstructed or present in the event
        source.
      example: https://www.elastic.co:443/search?q=elasticsearch#top
      default_field: false
    - name: indicator.url.original
      level: extended
      type: wildcard
      multi_fields:
      - name: text
        type: match_only_text
      description: 'Unmodified original url as seen in the event source.

        Note that in network monitoring, the observed URL may be a full URL, whereas
        in access logs, the URL is often just represented as a path.

        This field is meant to represent the URL as it was observed, complete or not.'
      example: https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch
      default_field: false
    - name: indicator.url.password
      level: extended
      type: keyword
      ignore_above: 1024
      description: Password of the request.
      default_field: false
    - name: indicator.url.path
      level: extended
      type: wildcard
      description: Path of the request, such as "/search".
      default_field: false
    - name: indicator.url.port
      level: extended
      type: long
      format: string
      description: Port of the request, such as 443.
      example: 443
      default_field: false
    - name: indicator.url.query
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The query field describes the query string of the request, such
        as "q=elasticsearch".

        The `?` is excluded from the query string. If a URL contains no `?`, there
        is no query field. If there is a `?` but no query, the query field exists
        with an empty string. The `exists` query can be used to differentiate between
        the two cases.'
      default_field: false
    - name: indicator.url.registered_domain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The highest registered url domain, stripped of the subdomain.

        For example, the registered domain for "foo.example.com" is "example.com".

        This value can be determined precisely with a list like the public suffix
        list (http://publicsuffix.org). Trying to approximate this by simply taking
        the last two labels will not work well for TLDs such as "co.uk".'
      example: example.com
      default_field: false
    - name: indicator.url.scheme
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Scheme of the request, such as "https".

        Note: The `:` is not part of the scheme.'
      example: https
      default_field: false
    - name: indicator.url.subdomain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The subdomain portion of a fully qualified domain name includes
        all of the names except the host name under the registered_domain.  In a partially
        qualified domain, or if the the qualification level of the full name cannot
        be determined, subdomain contains all of the names below the registered domain.

        For example the subdomain portion of "www.east.mydomain.co.uk" is "east".
        If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com",
        the subdomain field should contain "sub2.sub1", with no trailing period.'
      example: east
      default_field: false
    - name: indicator.url.top_level_domain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The effective top level domain (eTLD), also known as the domain
        suffix, is the last part of the domain name. For example, the top level domain
        for example.com is "com".

        This value can be determined precisely with a list like the public suffix
        list (http://publicsuffix.org). Trying to approximate this by simply taking
        the last label will not work well for effective TLDs such as "co.uk".'
      example: co.uk
      default_field: false
    - name: indicator.url.username
      level: extended
      type: keyword
      ignore_above: 1024
      description: Username of the request.
      default_field: false
    - name: indicator.x509.alternative_names
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of subject alternative names (SAN). Name types vary by certificate
        authority and certificate type but commonly contain IP addresses, DNS names
        (and wildcards), and email addresses.
      example: '*.elastic.co'
      default_field: false
    - name: indicator.x509.issuer.common_name
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of common name (CN) of issuing certificate authority.
      example: Example SHA2 High Assurance Server CA
      default_field: false
    - name: indicator.x509.issuer.country
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of country (C) codes
      example: US
      default_field: false
    - name: indicator.x509.issuer.distinguished_name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Distinguished name (DN) of issuing certificate authority.
      example: C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance
        Server CA
      default_field: false
    - name: indicator.x509.issuer.locality
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of locality names (L)
      example: Mountain View
      default_field: false
    - name: indicator.x509.issuer.organization
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of organizations (O) of issuing certificate authority.
      example: Example Inc
      default_field: false
    - name: indicator.x509.issuer.organizational_unit
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of organizational units (OU) of issuing certificate authority.
      example: www.example.com
      default_field: false
    - name: indicator.x509.issuer.state_or_province
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of state or province names (ST, S, or P)
      example: California
      default_field: false
    - name: indicator.x509.not_after
      level: extended
      type: date
      description: Time at which the certificate is no longer considered valid.
      example: 2020-07-16 03:15:39+00:00
      default_field: false
    - name: indicator.x509.not_before
      level: extended
      type: date
      description: Time at which the certificate is first considered valid.
      example: 2019-08-16 01:40:25+00:00
      default_field: false
    - name: indicator.x509.public_key_algorithm
      level: extended
      type: keyword
      ignore_above: 1024
      description: Algorithm used to generate the public key.
      example: RSA
      default_field: false
    - name: indicator.x509.public_key_curve
      level: extended
      type: keyword
      ignore_above: 1024
      description: The curve used by the elliptic curve public key algorithm. This
        is algorithm specific.
      example: nistp521
      default_field: false
    - name: indicator.x509.public_key_exponent
      level: extended
      type: long
      description: Exponent used to derive the public key. This is algorithm specific.
      example: 65537
      index: false
      doc_values: false
      default_field: false
    - name: indicator.x509.public_key_size
      level: extended
      type: long
      description: The size of the public key space in bits.
      example: 2048
      default_field: false
    - name: indicator.x509.serial_number
      level: extended
      type: keyword
      ignore_above: 1024
      description: Unique serial number issued by the certificate authority. For consistency,
        if this value is alphanumeric, it should be formatted without colons and uppercase
        characters.
      example: 55FBB9C7DEBF09809D12CCAA
      default_field: false
    - name: indicator.x509.signature_algorithm
      level: extended
      type: keyword
      ignore_above: 1024
      description: Identifier for certificate signature algorithm. We recommend using
        names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353.
      example: SHA256-RSA
      default_field: false
    - name: indicator.x509.subject.common_name
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of common names (CN) of subject.
      example: shared.global.example.net
      default_field: false
    - name: indicator.x509.subject.country
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of country (C) code
      example: US
      default_field: false
    - name: indicator.x509.subject.distinguished_name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Distinguished name (DN) of the certificate subject entity.
      example: C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net
      default_field: false
    - name: indicator.x509.subject.locality
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of locality names (L)
      example: San Francisco
      default_field: false
    - name: indicator.x509.subject.organization
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of organizations (O) of subject.
      example: Example, Inc.
      default_field: false
    - name: indicator.x509.subject.organizational_unit
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of organizational units (OU) of subject.
      default_field: false
    - name: indicator.x509.subject.state_or_province
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of state or province names (ST, S, or P)
      example: California
      default_field: false
    - name: indicator.x509.version_number
      level: extended
      type: keyword
      ignore_above: 1024
      description: Version of x509 format.
      example: 3
      default_field: false
    - name: software.alias
      level: extended
      type: keyword
      ignore_above: 1024
      description: "The alias(es) of the software for a set of related intrusion activity\
        \ that are tracked by a common name in the security community.\nWhile not\
        \ required, you can use a MITRE ATT&CK\xAE associated software description."
      example: '[ "X-Agent" ]'
      default_field: false
    - name: software.id
      level: extended
      type: keyword
      ignore_above: 1024
      description: "The id of the software used by this threat to conduct behavior\
        \ commonly modeled using MITRE ATT&CK\xAE.\nWhile not required, you can use\
        \ a MITRE ATT&CK\xAE software id."
      example: S0552
      default_field: false
    - name: software.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: "The name of the software used by this threat to conduct behavior\
        \ commonly modeled using MITRE ATT&CK\xAE.\nWhile not required, you can use\
        \ a MITRE ATT&CK\xAE software name."
      example: AdFind
      default_field: false
    - name: software.platforms
      level: extended
      type: keyword
      ignore_above: 1024
      description: "The platforms of the software used by this threat to conduct behavior\
        \ commonly modeled using MITRE ATT&CK\xAE.\nRecommended Values:\n  * AWS\n\
        \  * Azure\n  * Azure AD\n  * GCP\n  * Linux\n  * macOS\n  * Network\n  *\
        \ Office 365\n  * SaaS\n  * Windows\n\nWhile not required, you can use a MITRE\
        \ ATT&CK\xAE software platforms."
      example: '[ "Windows" ]'
      default_field: false
    - name: software.reference
      level: extended
      type: keyword
      ignore_above: 1024
      description: "The reference URL of the software used by this threat to conduct\
        \ behavior commonly modeled using MITRE ATT&CK\xAE.\nWhile not required, you\
        \ can use a MITRE ATT&CK\xAE software reference URL."
      example: https://attack.mitre.org/software/S0552/
      default_field: false
    - name: software.type
      level: extended
      type: keyword
      ignore_above: 1024
      description: "The type of software used by this threat to conduct behavior commonly\
        \ modeled using MITRE ATT&CK\xAE.\nRecommended values\n  * Malware\n  * Tool\n\
        \n While not required, you can use a MITRE ATT&CK\xAE software type."
      example: Tool
      default_field: false
    - name: tactic.id
      level: extended
      type: keyword
      ignore_above: 1024
      description: "The id of tactic used by this threat. You can use a MITRE ATT&CK\xAE\
        \ tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ )"
      example: TA0002
    - name: tactic.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: "Name of the type of tactic used by this threat. You can use a\
        \ MITRE ATT&CK\xAE tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/)"
      example: Execution
    - name: tactic.reference
      level: extended
      type: keyword
      ignore_above: 1024
      description: "The reference url of tactic used by this threat. You can use a\
        \ MITRE ATT&CK\xAE tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/\
        \ )"
      example: https://attack.mitre.org/tactics/TA0002/
    - name: technique.id
      level: extended
      type: keyword
      ignore_above: 1024
      description: "The id of technique used by this threat. You can use a MITRE ATT&CK\xAE\
        \ technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)"
      example: T1059
    - name: technique.name
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: match_only_text
        default_field: false
      description: "The name of technique used by this threat. You can use a MITRE\
        \ ATT&CK\xAE technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)"
      example: Command and Scripting Interpreter
    - name: technique.reference
      level: extended
      type: keyword
      ignore_above: 1024
      description: "The reference url of technique used by this threat. You can use\
        \ a MITRE ATT&CK\xAE technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)"
      example: https://attack.mitre.org/techniques/T1059/
    - name: technique.subtechnique.id
      level: extended
      type: keyword
      ignore_above: 1024
      description: "The full id of subtechnique used by this threat. You can use a\
        \ MITRE ATT&CK\xAE subtechnique, for example. (ex. https://attack.mitre.org/techniques/T1059/001/)"
      example: T1059.001
      default_field: false
    - name: technique.subtechnique.name
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: match_only_text
      description: "The name of subtechnique used by this threat. You can use a MITRE\
        \ ATT&CK\xAE subtechnique, for example. (ex. https://attack.mitre.org/techniques/T1059/001/)"
      example: PowerShell
      default_field: false
    - name: technique.subtechnique.reference
      level: extended
      type: keyword
      ignore_above: 1024
      description: "The reference url of subtechnique used by this threat. You can\
        \ use a MITRE ATT&CK\xAE subtechnique, for example. (ex. https://attack.mitre.org/techniques/T1059/001/)"
      example: https://attack.mitre.org/techniques/T1059/001/
      default_field: false
  - name: tls
    title: TLS
    group: 2
    description: Fields related to a TLS connection. These fields focus on the TLS
      protocol itself and intentionally avoids in-depth analysis of the related x.509
      certificate files.
    type: group
    default_field: true
    fields:
    - name: cipher
      level: extended
      type: keyword
      ignore_above: 1024
      description: String indicating the cipher used during the current connection.
      example: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
      default_field: false
    - name: client.certificate
      level: extended
      type: keyword
      ignore_above: 1024
      description: PEM-encoded stand-alone certificate offered by the client. This
        is usually mutually-exclusive of `client.certificate_chain` since this value
        also exists in that list.
      example: MII...
      default_field: false
    - name: client.certificate_chain
      level: extended
      type: keyword
      ignore_above: 1024
      description: Array of PEM-encoded certificates that make up the certificate
        chain offered by the client. This is usually mutually-exclusive of `client.certificate`
        since that value should be the first certificate in the chain.
      example: '["MII...", "MII..."]'
      default_field: false
    - name: client.hash.md5
      level: extended
      type: keyword
      ignore_above: 1024
      description: Certificate fingerprint using the MD5 digest of DER-encoded version
        of certificate offered by the client. For consistency with other hash values,
        this value should be formatted as an uppercase hash.
      example: 0F76C7F2C55BFD7D8E8B8F4BFBF0C9EC
      default_field: false
    - name: client.hash.sha1
      level: extended
      type: keyword
      ignore_above: 1024
      description: Certificate fingerprint using the SHA1 digest of DER-encoded version
        of certificate offered by the client. For consistency with other hash values,
        this value should be formatted as an uppercase hash.
      example: 9E393D93138888D288266C2D915214D1D1CCEB2A
      default_field: false
    - name: client.hash.sha256
      level: extended
      type: keyword
      ignore_above: 1024
      description: Certificate fingerprint using the SHA256 digest of DER-encoded
        version of certificate offered by the client. For consistency with other hash
        values, this value should be formatted as an uppercase hash.
      example: 0687F666A054EF17A08E2F2162EAB4CBC0D265E1D7875BE74BF3C712CA92DAF0
      default_field: false
    - name: client.issuer
      level: extended
      type: keyword
      ignore_above: 1024
      description: Distinguished name of subject of the issuer of the x.509 certificate
        presented by the client.
      example: CN=Example Root CA, OU=Infrastructure Team, DC=example, DC=com
      default_field: false
    - name: client.ja3
      level: extended
      type: keyword
      ignore_above: 1024
      description: A hash that identifies clients based on how they perform an SSL/TLS
        handshake.
      example: d4e5b18d6b55c71272893221c96ba240
      default_field: false
    - name: client.not_after
      level: extended
      type: date
      description: Date/Time indicating when client certificate is no longer considered
        valid.
      example: '2021-01-01T00:00:00.000Z'
      default_field: false
    - name: client.not_before
      level: extended
      type: date
      description: Date/Time indicating when client certificate is first considered
        valid.
      example: '1970-01-01T00:00:00.000Z'
      default_field: false
    - name: client.server_name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Also called an SNI, this tells the server which hostname to which
        the client is attempting to connect to. When this value is available, it should
        get copied to `destination.domain`.
      example: www.elastic.co
      default_field: false
    - name: client.subject
      level: extended
      type: keyword
      ignore_above: 1024
      description: Distinguished name of subject of the x.509 certificate presented
        by the client.
      example: CN=myclient, OU=Documentation Team, DC=example, DC=com
      default_field: false
    - name: client.supported_ciphers
      level: extended
      type: keyword
      ignore_above: 1024
      description: Array of ciphers offered by the client during the client hello.
      example: '["TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
        "..."]'
      default_field: false
    - name: client.x509.alternative_names
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of subject alternative names (SAN). Name types vary by certificate
        authority and certificate type but commonly contain IP addresses, DNS names
        (and wildcards), and email addresses.
      example: '*.elastic.co'
      default_field: false
    - name: client.x509.issuer.common_name
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of common name (CN) of issuing certificate authority.
      example: Example SHA2 High Assurance Server CA
      default_field: false
    - name: client.x509.issuer.country
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of country (C) codes
      example: US
      default_field: false
    - name: client.x509.issuer.distinguished_name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Distinguished name (DN) of issuing certificate authority.
      example: C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance
        Server CA
      default_field: false
    - name: client.x509.issuer.locality
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of locality names (L)
      example: Mountain View
      default_field: false
    - name: client.x509.issuer.organization
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of organizations (O) of issuing certificate authority.
      example: Example Inc
      default_field: false
    - name: client.x509.issuer.organizational_unit
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of organizational units (OU) of issuing certificate authority.
      example: www.example.com
      default_field: false
    - name: client.x509.issuer.state_or_province
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of state or province names (ST, S, or P)
      example: California
      default_field: false
    - name: client.x509.not_after
      level: extended
      type: date
      description: Time at which the certificate is no longer considered valid.
      example: 2020-07-16 03:15:39+00:00
      default_field: false
    - name: client.x509.not_before
      level: extended
      type: date
      description: Time at which the certificate is first considered valid.
      example: 2019-08-16 01:40:25+00:00
      default_field: false
    - name: client.x509.public_key_algorithm
      level: extended
      type: keyword
      ignore_above: 1024
      description: Algorithm used to generate the public key.
      example: RSA
      default_field: false
    - name: client.x509.public_key_curve
      level: extended
      type: keyword
      ignore_above: 1024
      description: The curve used by the elliptic curve public key algorithm. This
        is algorithm specific.
      example: nistp521
      default_field: false
    - name: client.x509.public_key_exponent
      level: extended
      type: long
      description: Exponent used to derive the public key. This is algorithm specific.
      example: 65537
      index: false
      doc_values: false
      default_field: false
    - name: client.x509.public_key_size
      level: extended
      type: long
      description: The size of the public key space in bits.
      example: 2048
      default_field: false
    - name: client.x509.serial_number
      level: extended
      type: keyword
      ignore_above: 1024
      description: Unique serial number issued by the certificate authority. For consistency,
        if this value is alphanumeric, it should be formatted without colons and uppercase
        characters.
      example: 55FBB9C7DEBF09809D12CCAA
      default_field: false
    - name: client.x509.signature_algorithm
      level: extended
      type: keyword
      ignore_above: 1024
      description: Identifier for certificate signature algorithm. We recommend using
        names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353.
      example: SHA256-RSA
      default_field: false
    - name: client.x509.subject.common_name
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of common names (CN) of subject.
      example: shared.global.example.net
      default_field: false
    - name: client.x509.subject.country
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of country (C) code
      example: US
      default_field: false
    - name: client.x509.subject.distinguished_name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Distinguished name (DN) of the certificate subject entity.
      example: C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net
      default_field: false
    - name: client.x509.subject.locality
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of locality names (L)
      example: San Francisco
      default_field: false
    - name: client.x509.subject.organization
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of organizations (O) of subject.
      example: Example, Inc.
      default_field: false
    - name: client.x509.subject.organizational_unit
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of organizational units (OU) of subject.
      default_field: false
    - name: client.x509.subject.state_or_province
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of state or province names (ST, S, or P)
      example: California
      default_field: false
    - name: client.x509.version_number
      level: extended
      type: keyword
      ignore_above: 1024
      description: Version of x509 format.
      example: 3
      default_field: false
    - name: curve
      level: extended
      type: keyword
      ignore_above: 1024
      description: String indicating the curve used for the given cipher, when applicable.
      example: secp256r1
      default_field: false
    - name: established
      level: extended
      type: boolean
      description: Boolean flag indicating if the TLS negotiation was successful and
        transitioned to an encrypted tunnel.
      default_field: false
    - name: next_protocol
      level: extended
      type: keyword
      ignore_above: 1024
      description: String indicating the protocol being tunneled. Per the values in
        the IANA registry (https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml#alpn-protocol-ids),
        this string should be lower case.
      example: http/1.1
      default_field: false
    - name: resumed
      level: extended
      type: boolean
      description: Boolean flag indicating if this TLS connection was resumed from
        an existing TLS negotiation.
      default_field: false
    - name: server.certificate
      level: extended
      type: keyword
      ignore_above: 1024
      description: PEM-encoded stand-alone certificate offered by the server. This
        is usually mutually-exclusive of `server.certificate_chain` since this value
        also exists in that list.
      example: MII...
      default_field: false
    - name: server.certificate_chain
      level: extended
      type: keyword
      ignore_above: 1024
      description: Array of PEM-encoded certificates that make up the certificate
        chain offered by the server. This is usually mutually-exclusive of `server.certificate`
        since that value should be the first certificate in the chain.
      example: '["MII...", "MII..."]'
      default_field: false
    - name: server.hash.md5
      level: extended
      type: keyword
      ignore_above: 1024
      description: Certificate fingerprint using the MD5 digest of DER-encoded version
        of certificate offered by the server. For consistency with other hash values,
        this value should be formatted as an uppercase hash.
      example: 0F76C7F2C55BFD7D8E8B8F4BFBF0C9EC
      default_field: false
    - name: server.hash.sha1
      level: extended
      type: keyword
      ignore_above: 1024
      description: Certificate fingerprint using the SHA1 digest of DER-encoded version
        of certificate offered by the server. For consistency with other hash values,
        this value should be formatted as an uppercase hash.
      example: 9E393D93138888D288266C2D915214D1D1CCEB2A
      default_field: false
    - name: server.hash.sha256
      level: extended
      type: keyword
      ignore_above: 1024
      description: Certificate fingerprint using the SHA256 digest of DER-encoded
        version of certificate offered by the server. For consistency with other hash
        values, this value should be formatted as an uppercase hash.
      example: 0687F666A054EF17A08E2F2162EAB4CBC0D265E1D7875BE74BF3C712CA92DAF0
      default_field: false
    - name: server.issuer
      level: extended
      type: keyword
      ignore_above: 1024
      description: Subject of the issuer of the x.509 certificate presented by the
        server.
      example: CN=Example Root CA, OU=Infrastructure Team, DC=example, DC=com
      default_field: false
    - name: server.ja3s
      level: extended
      type: keyword
      ignore_above: 1024
      description: A hash that identifies servers based on how they perform an SSL/TLS
        handshake.
      example: 394441ab65754e2207b1e1b457b3641d
      default_field: false
    - name: server.not_after
      level: extended
      type: date
      description: Timestamp indicating when server certificate is no longer considered
        valid.
      example: '2021-01-01T00:00:00.000Z'
      default_field: false
    - name: server.not_before
      level: extended
      type: date
      description: Timestamp indicating when server certificate is first considered
        valid.
      example: '1970-01-01T00:00:00.000Z'
      default_field: false
    - name: server.subject
      level: extended
      type: keyword
      ignore_above: 1024
      description: Subject of the x.509 certificate presented by the server.
      example: CN=www.example.com, OU=Infrastructure Team, DC=example, DC=com
      default_field: false
    - name: server.x509.alternative_names
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of subject alternative names (SAN). Name types vary by certificate
        authority and certificate type but commonly contain IP addresses, DNS names
        (and wildcards), and email addresses.
      example: '*.elastic.co'
      default_field: false
    - name: server.x509.issuer.common_name
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of common name (CN) of issuing certificate authority.
      example: Example SHA2 High Assurance Server CA
      default_field: false
    - name: server.x509.issuer.country
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of country (C) codes
      example: US
      default_field: false
    - name: server.x509.issuer.distinguished_name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Distinguished name (DN) of issuing certificate authority.
      example: C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance
        Server CA
      default_field: false
    - name: server.x509.issuer.locality
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of locality names (L)
      example: Mountain View
      default_field: false
    - name: server.x509.issuer.organization
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of organizations (O) of issuing certificate authority.
      example: Example Inc
      default_field: false
    - name: server.x509.issuer.organizational_unit
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of organizational units (OU) of issuing certificate authority.
      example: www.example.com
      default_field: false
    - name: server.x509.issuer.state_or_province
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of state or province names (ST, S, or P)
      example: California
      default_field: false
    - name: server.x509.not_after
      level: extended
      type: date
      description: Time at which the certificate is no longer considered valid.
      example: 2020-07-16 03:15:39+00:00
      default_field: false
    - name: server.x509.not_before
      level: extended
      type: date
      description: Time at which the certificate is first considered valid.
      example: 2019-08-16 01:40:25+00:00
      default_field: false
    - name: server.x509.public_key_algorithm
      level: extended
      type: keyword
      ignore_above: 1024
      description: Algorithm used to generate the public key.
      example: RSA
      default_field: false
    - name: server.x509.public_key_curve
      level: extended
      type: keyword
      ignore_above: 1024
      description: The curve used by the elliptic curve public key algorithm. This
        is algorithm specific.
      example: nistp521
      default_field: false
    - name: server.x509.public_key_exponent
      level: extended
      type: long
      description: Exponent used to derive the public key. This is algorithm specific.
      example: 65537
      index: false
      doc_values: false
      default_field: false
    - name: server.x509.public_key_size
      level: extended
      type: long
      description: The size of the public key space in bits.
      example: 2048
      default_field: false
    - name: server.x509.serial_number
      level: extended
      type: keyword
      ignore_above: 1024
      description: Unique serial number issued by the certificate authority. For consistency,
        if this value is alphanumeric, it should be formatted without colons and uppercase
        characters.
      example: 55FBB9C7DEBF09809D12CCAA
      default_field: false
    - name: server.x509.signature_algorithm
      level: extended
      type: keyword
      ignore_above: 1024
      description: Identifier for certificate signature algorithm. We recommend using
        names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353.
      example: SHA256-RSA
      default_field: false
    - name: server.x509.subject.common_name
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of common names (CN) of subject.
      example: shared.global.example.net
      default_field: false
    - name: server.x509.subject.country
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of country (C) code
      example: US
      default_field: false
    - name: server.x509.subject.distinguished_name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Distinguished name (DN) of the certificate subject entity.
      example: C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net
      default_field: false
    - name: server.x509.subject.locality
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of locality names (L)
      example: San Francisco
      default_field: false
    - name: server.x509.subject.organization
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of organizations (O) of subject.
      example: Example, Inc.
      default_field: false
    - name: server.x509.subject.organizational_unit
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of organizational units (OU) of subject.
      default_field: false
    - name: server.x509.subject.state_or_province
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of state or province names (ST, S, or P)
      example: California
      default_field: false
    - name: server.x509.version_number
      level: extended
      type: keyword
      ignore_above: 1024
      description: Version of x509 format.
      example: 3
      default_field: false
    - name: version
      level: extended
      type: keyword
      ignore_above: 1024
      description: Numeric part of the version parsed from the original string.
      example: '1.2'
      default_field: false
    - name: version_protocol
      level: extended
      type: keyword
      ignore_above: 1024
      description: Normalized lowercase protocol name parsed from original string.
      example: tls
      default_field: false
  - name: span.id
    level: extended
    type: keyword
    ignore_above: 1024
    description: 'Unique identifier of the span within the scope of its trace.

      A span represents an operation within a transaction, such as a request to another
      service, or a database query.'
    example: 3ff9a8981b7ccd5a
  - name: trace.id
    level: extended
    type: keyword
    ignore_above: 1024
    description: 'Unique identifier of the trace.

      A trace groups multiple events like transactions that belong together. For example,
      a user request handled by multiple inter-connected services.'
    example: 4bf92f3577b34da6a3ce929d0e0e4736
    default_field: true
  - name: transaction.id
    level: extended
    type: keyword
    ignore_above: 1024
    description: 'Unique identifier of the transaction within the scope of its trace.

      A transaction is the highest level of work measured within a service, such as
      a request to a server.'
    example: 00f067aa0ba902b7
    default_field: true
  - name: url
    title: URL
    group: 2
    description: URL fields provide support for complete or partial URLs, and supports
      the breaking down into scheme, domain, path, and so on.
    type: group
    default_field: true
    fields:
    - name: domain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Domain of the url, such as "www.elastic.co".

        In some cases a URL may refer to an IP and/or port directly, without a domain
        name. In this case, the IP address would go to the `domain` field.

        If the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC
        2732), the `[` and `]` characters should also be captured in the `domain`
        field.'
      example: www.elastic.co
    - name: extension
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The field contains the file extension from the original request
        url, excluding the leading dot.

        The file extension is only set if it exists, as not every url has a file extension.

        The leading period must not be included. For example, the value must be "png",
        not ".png".

        Note that when the file name has multiple extensions (example.tar.gz), only
        the last one should be captured ("gz", not "tar.gz").'
      example: png
    - name: fragment
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Portion of the url after the `#`, such as "top".

        The `#` is not part of the fragment.'
    - name: full
      level: extended
      type: wildcard
      multi_fields:
      - name: text
        type: match_only_text
        default_field: false
      description: If full URLs are important to your use case, they should be stored
        in `url.full`, whether this field is reconstructed or present in the event
        source.
      example: https://www.elastic.co:443/search?q=elasticsearch#top
    - name: original
      level: extended
      type: wildcard
      multi_fields:
      - name: text
        type: match_only_text
        default_field: false
      description: 'Unmodified original url as seen in the event source.

        Note that in network monitoring, the observed URL may be a full URL, whereas
        in access logs, the URL is often just represented as a path.

        This field is meant to represent the URL as it was observed, complete or not.'
      example: https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch
    - name: password
      level: extended
      type: keyword
      ignore_above: 1024
      description: Password of the request.
    - name: path
      level: extended
      type: wildcard
      description: Path of the request, such as "/search".
    - name: port
      level: extended
      type: long
      format: string
      description: Port of the request, such as 443.
      example: 443
    - name: query
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The query field describes the query string of the request, such
        as "q=elasticsearch".

        The `?` is excluded from the query string. If a URL contains no `?`, there
        is no query field. If there is a `?` but no query, the query field exists
        with an empty string. The `exists` query can be used to differentiate between
        the two cases.'
    - name: registered_domain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The highest registered url domain, stripped of the subdomain.

        For example, the registered domain for "foo.example.com" is "example.com".

        This value can be determined precisely with a list like the public suffix
        list (http://publicsuffix.org). Trying to approximate this by simply taking
        the last two labels will not work well for TLDs such as "co.uk".'
      example: example.com
    - name: scheme
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Scheme of the request, such as "https".

        Note: The `:` is not part of the scheme.'
      example: https
    - name: subdomain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The subdomain portion of a fully qualified domain name includes
        all of the names except the host name under the registered_domain.  In a partially
        qualified domain, or if the the qualification level of the full name cannot
        be determined, subdomain contains all of the names below the registered domain.

        For example the subdomain portion of "www.east.mydomain.co.uk" is "east".
        If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com",
        the subdomain field should contain "sub2.sub1", with no trailing period.'
      example: east
      default_field: false
    - name: top_level_domain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The effective top level domain (eTLD), also known as the domain
        suffix, is the last part of the domain name. For example, the top level domain
        for example.com is "com".

        This value can be determined precisely with a list like the public suffix
        list (http://publicsuffix.org). Trying to approximate this by simply taking
        the last label will not work well for effective TLDs such as "co.uk".'
      example: co.uk
    - name: username
      level: extended
      type: keyword
      ignore_above: 1024
      description: Username of the request.
  - name: user
    title: User
    group: 2
    description: 'The user fields describe information about the user that is relevant
      to the event.

      Fields can have one entry or multiple entries. If a user has more than one id,
      provide an array that includes all of them.'
    type: group
    default_field: true
    fields:
    - name: changes.domain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Name of the directory the user is a member of.

        For example, an LDAP or Active Directory domain name.'
      default_field: false
    - name: changes.email
      level: extended
      type: keyword
      ignore_above: 1024
      description: User email address.
      default_field: false
    - name: changes.full_name
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: match_only_text
      description: User's full name, if available.
      example: Albert Einstein
      default_field: false
    - name: changes.group.domain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Name of the directory the group is a member of.

        For example, an LDAP or Active Directory domain name.'
      default_field: false
    - name: changes.group.id
      level: extended
      type: keyword
      ignore_above: 1024
      description: Unique identifier for the group on the system/platform.
      default_field: false
    - name: changes.group.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Name of the group.
      default_field: false
    - name: changes.hash
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Unique user hash to correlate information for a user in anonymized
        form.

        Useful if `user.id` or `user.name` contain confidential information and cannot
        be used.'
      default_field: false
    - name: changes.id
      level: core
      type: keyword
      ignore_above: 1024
      description: Unique identifier of the user.
      example: S-1-5-21-202424912787-2692429404-2351956786-1000
      default_field: false
    - name: changes.name
      level: core
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: match_only_text
      description: Short name or login of the user.
      example: a.einstein
      default_field: false
    - name: changes.roles
      level: extended
      type: keyword
      ignore_above: 1024
      description: Array of user roles at the time of the event.
      example: '["kibana_admin", "reporting_user"]'
      default_field: false
    - name: domain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Name of the directory the user is a member of.

        For example, an LDAP or Active Directory domain name.'
    - name: effective.domain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Name of the directory the user is a member of.

        For example, an LDAP or Active Directory domain name.'
      default_field: false
    - name: effective.email
      level: extended
      type: keyword
      ignore_above: 1024
      description: User email address.
      default_field: false
    - name: effective.full_name
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: match_only_text
      description: User's full name, if available.
      example: Albert Einstein
      default_field: false
    - name: effective.group.domain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Name of the directory the group is a member of.

        For example, an LDAP or Active Directory domain name.'
      default_field: false
    - name: effective.group.id
      level: extended
      type: keyword
      ignore_above: 1024
      description: Unique identifier for the group on the system/platform.
      default_field: false
    - name: effective.group.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Name of the group.
      default_field: false
    - name: effective.hash
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Unique user hash to correlate information for a user in anonymized
        form.

        Useful if `user.id` or `user.name` contain confidential information and cannot
        be used.'
      default_field: false
    - name: effective.id
      level: core
      type: keyword
      ignore_above: 1024
      description: Unique identifier of the user.
      example: S-1-5-21-202424912787-2692429404-2351956786-1000
      default_field: false
    - name: effective.name
      level: core
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: match_only_text
      description: Short name or login of the user.
      example: a.einstein
      default_field: false
    - name: effective.roles
      level: extended
      type: keyword
      ignore_above: 1024
      description: Array of user roles at the time of the event.
      example: '["kibana_admin", "reporting_user"]'
      default_field: false
    - name: email
      level: extended
      type: keyword
      ignore_above: 1024
      description: User email address.
    - name: full_name
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: match_only_text
        default_field: false
      description: User's full name, if available.
      example: Albert Einstein
    - name: group.domain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Name of the directory the group is a member of.

        For example, an LDAP or Active Directory domain name.'
    - name: group.id
      level: extended
      type: keyword
      ignore_above: 1024
      description: Unique identifier for the group on the system/platform.
    - name: group.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Name of the group.
    - name: hash
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Unique user hash to correlate information for a user in anonymized
        form.

        Useful if `user.id` or `user.name` contain confidential information and cannot
        be used.'
    - name: id
      level: core
      type: keyword
      ignore_above: 1024
      description: Unique identifier of the user.
      example: S-1-5-21-202424912787-2692429404-2351956786-1000
    - name: name
      level: core
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: match_only_text
        default_field: false
      description: Short name or login of the user.
      example: a.einstein
    - name: roles
      level: extended
      type: keyword
      ignore_above: 1024
      description: Array of user roles at the time of the event.
      example: '["kibana_admin", "reporting_user"]'
      default_field: false
    - name: target.domain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Name of the directory the user is a member of.

        For example, an LDAP or Active Directory domain name.'
      default_field: false
    - name: target.email
      level: extended
      type: keyword
      ignore_above: 1024
      description: User email address.
      default_field: false
    - name: target.full_name
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: match_only_text
      description: User's full name, if available.
      example: Albert Einstein
      default_field: false
    - name: target.group.domain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Name of the directory the group is a member of.

        For example, an LDAP or Active Directory domain name.'
      default_field: false
    - name: target.group.id
      level: extended
      type: keyword
      ignore_above: 1024
      description: Unique identifier for the group on the system/platform.
      default_field: false
    - name: target.group.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Name of the group.
      default_field: false
    - name: target.hash
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Unique user hash to correlate information for a user in anonymized
        form.

        Useful if `user.id` or `user.name` contain confidential information and cannot
        be used.'
      default_field: false
    - name: target.id
      level: core
      type: keyword
      ignore_above: 1024
      description: Unique identifier of the user.
      example: S-1-5-21-202424912787-2692429404-2351956786-1000
      default_field: false
    - name: target.name
      level: core
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: match_only_text
      description: Short name or login of the user.
      example: a.einstein
      default_field: false
    - name: target.roles
      level: extended
      type: keyword
      ignore_above: 1024
      description: Array of user roles at the time of the event.
      example: '["kibana_admin", "reporting_user"]'
      default_field: false
  - name: user_agent
    title: User agent
    group: 2
    description: 'The user_agent fields normally come from a browser request.

      They often show up in web service logs coming from the parsed user agent string.'
    type: group
    default_field: true
    fields:
    - name: device.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Name of the device.
      example: iPhone
    - name: name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Name of the user agent.
      example: Safari
    - name: original
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: match_only_text
      description: Unparsed user_agent string.
      example: Mozilla/5.0 (iPhone; CPU iPhone OS 12_1 like Mac OS X) AppleWebKit/605.1.15
        (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1
    - name: os.family
      level: extended
      type: keyword
      ignore_above: 1024
      description: OS family (such as redhat, debian, freebsd, windows).
      example: debian
    - name: os.full
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: match_only_text
        default_field: false
      description: Operating system name, including the version or code name.
      example: Mac OS Mojave
    - name: os.kernel
      level: extended
      type: keyword
      ignore_above: 1024
      description: Operating system kernel version as a raw string.
      example: 4.4.0-112-generic
    - name: os.name
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: match_only_text
        default_field: false
      description: Operating system name, without the version.
      example: Mac OS X
    - name: os.platform
      level: extended
      type: keyword
      ignore_above: 1024
      description: Operating system platform (such centos, ubuntu, windows).
      example: darwin
    - name: os.type
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Use the `os.type` field to categorize the operating system into
        one of the broad commercial families.

        One of these following values should be used (lowercase): linux, macos, unix,
        windows.

        If the OS you''re dealing with is not in the list, the field should not be
        populated. Please let us know by opening an issue with ECS, to propose its
        addition.'
      example: macos
      default_field: false
    - name: os.version
      level: extended
      type: keyword
      ignore_above: 1024
      description: Operating system version as a raw string.
      example: 10.14.1
    - name: version
      level: extended
      type: keyword
      ignore_above: 1024
      description: Version of the user agent.
      example: 12.0
  - name: vlan
    title: VLAN
    group: 2
    description: 'The VLAN fields are used to identify 802.1q tag(s) of a packet,
      as well as ingress and egress VLAN associations of an observer in relation to
      a specific packet or connection.

      Network.vlan fields are used to record a single VLAN tag, or the outer tag in
      the case of q-in-q encapsulations, for a packet or connection as observed, typically
      provided by a network sensor (e.g. Zeek, Wireshark) passively reporting on traffic.

      Network.inner VLAN fields are used to report inner q-in-q 802.1q tags (multiple
      802.1q encapsulations) as observed, typically provided by a network sensor  (e.g.
      Zeek, Wireshark) passively reporting on traffic. Network.inner VLAN fields should
      only be used in addition to network.vlan fields to indicate q-in-q tagging.

      Observer.ingress and observer.egress VLAN values are used to record observer
      specific information when observer events contain discrete ingress and egress
      VLAN information, typically provided by firewalls, routers, or load balancers.'
    type: group
    default_field: true
    fields:
    - name: id
      level: extended
      type: keyword
      ignore_above: 1024
      description: VLAN ID as reported by the observer.
      example: 10
      default_field: false
    - name: name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Optional VLAN name as reported by the observer.
      example: outside
      default_field: false
  - name: vulnerability
    title: Vulnerability
    group: 2
    description: The vulnerability fields describe information about a vulnerability
      that is relevant to an event.
    type: group
    default_field: true
    fields:
    - name: category
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The type of system or architecture that the vulnerability affects.
        These may be platform-specific (for example, Debian or SUSE) or general (for
        example, Database or Firewall). For example (https://qualysguard.qualys.com/qwebhelp/fo_portal/knowledgebase/vulnerability_categories.htm[Qualys
        vulnerability categories])

        This field must be an array.'
      example: '["Firewall"]'
      default_field: false
    - name: classification
      level: extended
      type: keyword
      ignore_above: 1024
      description: The classification of the vulnerability scoring system. For example
        (https://www.first.org/cvss/)
      example: CVSS
      default_field: false
    - name: description
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: match_only_text
      description: The description of the vulnerability that provides additional context
        of the vulnerability. For example (https://cve.mitre.org/about/faqs.html#cve_entry_descriptions_created[Common
        Vulnerabilities and Exposure CVE description])
      example: In macOS before 2.12.6, there is a vulnerability in the RPC...
      default_field: false
    - name: enumeration
      level: extended
      type: keyword
      ignore_above: 1024
      description: The type of identifier used for this vulnerability. For example
        (https://cve.mitre.org/about/)
      example: CVE
      default_field: false
    - name: id
      level: extended
      type: keyword
      ignore_above: 1024
      description: The identification (ID) is the number portion of a vulnerability
        entry. It includes a unique identification number for the vulnerability. For
        example (https://cve.mitre.org/about/faqs.html#what_is_cve_id)[Common Vulnerabilities
        and Exposure CVE ID]
      example: CVE-2019-00001
      default_field: false
    - name: reference
      level: extended
      type: keyword
      ignore_above: 1024
      description: A resource that provides additional information, context, and mitigations
        for the identified vulnerability.
      example: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6111
      default_field: false
    - name: report_id
      level: extended
      type: keyword
      ignore_above: 1024
      description: The report or scan identification number.
      example: 20191018.0001
      default_field: false
    - name: scanner.vendor
      level: extended
      type: keyword
      ignore_above: 1024
      description: The name of the vulnerability scanner vendor.
      example: Tenable
      default_field: false
    - name: score.base
      level: extended
      type: float
      description: 'Scores can range from 0.0 to 10.0, with 10.0 being the most severe.

        Base scores cover an assessment for exploitability metrics (attack vector,
        complexity, privileges, and user interaction), impact metrics (confidentiality,
        integrity, and availability), and scope. For example (https://www.first.org/cvss/specification-document)'
      example: 5.5
      default_field: false
    - name: score.environmental
      level: extended
      type: float
      description: 'Scores can range from 0.0 to 10.0, with 10.0 being the most severe.

        Environmental scores cover an assessment for any modified Base metrics, confidentiality,
        integrity, and availability requirements. For example (https://www.first.org/cvss/specification-document)'
      example: 5.5
      default_field: false
    - name: score.temporal
      level: extended
      type: float
      description: 'Scores can range from 0.0 to 10.0, with 10.0 being the most severe.

        Temporal scores cover an assessment for code maturity, remediation level,
        and confidence. For example (https://www.first.org/cvss/specification-document)'
      default_field: false
    - name: score.version
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The National Vulnerability Database (NVD) provides qualitative
        severity rankings of "Low", "Medium", and "High" for CVSS v2.0 base score
        ranges in addition to the severity ratings for CVSS v3.0 as they are defined
        in the CVSS v3.0 specification.

        CVSS is owned and managed by FIRST.Org, Inc. (FIRST), a US-based non-profit
        organization, whose mission is to help computer security incident response
        teams across the world. For example (https://nvd.nist.gov/vuln-metrics/cvss)'
      example: 2.0
      default_field: false
    - name: severity
      level: extended
      type: keyword
      ignore_above: 1024
      description: The severity of the vulnerability can help with metrics and internal
        prioritization regarding remediation. For example (https://nvd.nist.gov/vuln-metrics/cvss)
      example: Critical
      default_field: false
  - name: x509
    title: x509 Certificate
    group: 2
    description: 'This implements the common core fields for x509 certificates. This
      information is likely logged with TLS sessions, digital signatures found in
      executable binaries, S/MIME information in email bodies, or analysis of files
      on disk.

      When the certificate relates to a file, use the fields at `file.x509`. When
      hashes of the DER-encoded certificate are available, the `hash` data set should
      be populated as well (e.g. `file.hash.sha256`).

      Events that contain certificate information about network connections, should
      use the x509 fields under the relevant TLS fields: `tls.server.x509` and/or
      `tls.client.x509`.'
    type: group
    default_field: true
    fields:
    - name: alternative_names
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of subject alternative names (SAN). Name types vary by certificate
        authority and certificate type but commonly contain IP addresses, DNS names
        (and wildcards), and email addresses.
      example: '*.elastic.co'
      default_field: false
    - name: issuer.common_name
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of common name (CN) of issuing certificate authority.
      example: Example SHA2 High Assurance Server CA
      default_field: false
    - name: issuer.country
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of country (C) codes
      example: US
      default_field: false
    - name: issuer.distinguished_name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Distinguished name (DN) of issuing certificate authority.
      example: C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance
        Server CA
      default_field: false
    - name: issuer.locality
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of locality names (L)
      example: Mountain View
      default_field: false
    - name: issuer.organization
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of organizations (O) of issuing certificate authority.
      example: Example Inc
      default_field: false
    - name: issuer.organizational_unit
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of organizational units (OU) of issuing certificate authority.
      example: www.example.com
      default_field: false
    - name: issuer.state_or_province
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of state or province names (ST, S, or P)
      example: California
      default_field: false
    - name: not_after
      level: extended
      type: date
      description: Time at which the certificate is no longer considered valid.
      example: 2020-07-16 03:15:39+00:00
      default_field: false
    - name: not_before
      level: extended
      type: date
      description: Time at which the certificate is first considered valid.
      example: 2019-08-16 01:40:25+00:00
      default_field: false
    - name: public_key_algorithm
      level: extended
      type: keyword
      ignore_above: 1024
      description: Algorithm used to generate the public key.
      example: RSA
      default_field: false
    - name: public_key_curve
      level: extended
      type: keyword
      ignore_above: 1024
      description: The curve used by the elliptic curve public key algorithm. This
        is algorithm specific.
      example: nistp521
      default_field: false
    - name: public_key_exponent
      level: extended
      type: long
      description: Exponent used to derive the public key. This is algorithm specific.
      example: 65537
      index: false
      doc_values: false
      default_field: false
    - name: public_key_size
      level: extended
      type: long
      description: The size of the public key space in bits.
      example: 2048
      default_field: false
    - name: serial_number
      level: extended
      type: keyword
      ignore_above: 1024
      description: Unique serial number issued by the certificate authority. For consistency,
        if this value is alphanumeric, it should be formatted without colons and uppercase
        characters.
      example: 55FBB9C7DEBF09809D12CCAA
      default_field: false
    - name: signature_algorithm
      level: extended
      type: keyword
      ignore_above: 1024
      description: Identifier for certificate signature algorithm. We recommend using
        names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353.
      example: SHA256-RSA
      default_field: false
    - name: subject.common_name
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of common names (CN) of subject.
      example: shared.global.example.net
      default_field: false
    - name: subject.country
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of country (C) code
      example: US
      default_field: false
    - name: subject.distinguished_name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Distinguished name (DN) of the certificate subject entity.
      example: C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net
      default_field: false
    - name: subject.locality
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of locality names (L)
      example: San Francisco
      default_field: false
    - name: subject.organization
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of organizations (O) of subject.
      example: Example, Inc.
      default_field: false
    - name: subject.organizational_unit
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of organizational units (OU) of subject.
      default_field: false
    - name: subject.state_or_province
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of state or province names (ST, S, or P)
      example: California
      default_field: false
    - name: version_number
      level: extended
      type: keyword
      ignore_above: 1024
      description: Version of x509 format.
      example: 3
      default_field: false
- key: beat
  anchor: beat-common
  title: Beat
  description: >
    Contains common beat fields available in all event types.
  fields:
    - name: agent.hostname
      type: alias
      path: agent.name
      description: >
        Deprecated - use agent.name or agent.id to identify an agent.

    - name: beat.timezone
      type: alias
      path: event.timezone
      migration: true

    - name: fields
      type: object
      object_type: keyword
      description: >
        Contains user configurable fields.

    - name: beat.name
      type: alias
      path: host.name
      migration: true

    - name: beat.hostname
      type: alias
      path: agent.name
      migration: true

    - name: timeseries.instance
      type: keyword
      description: Time series instance id
- key: cloud
  title: Cloud provider metadata
  description: >
    Metadata from cloud providers added by the add_cloud_metadata processor.
  fields:
    
    - name: cloud.image.id
      default_field: true
      example: ami-abcd1234
      description: >
        Image ID for the cloud instance.

    # Alias for old fields
    - name: meta.cloud.provider
      default_field: true
      type: alias
      path: cloud.provider
      migration: true

    - name: meta.cloud.instance_id
      default_field: true
      type: alias
      path: cloud.instance.id
      migration: true

    - name: meta.cloud.instance_name
      default_field: true
      type: alias
      path: cloud.instance.name
      migration: true

    - name: meta.cloud.machine_type
      default_field: true
      type: alias
      path: cloud.machine.type
      migration: true

    - name: meta.cloud.availability_zone
      default_field: true
      type: alias
      path: cloud.availability_zone
      migration: true

    - name: meta.cloud.project_id
      default_field: true
      type: alias
      path: cloud.project.id
      migration: true

    - name: meta.cloud.region
      default_field: true
      type: alias
      path: cloud.region
      migration: true

    
- key: docker
  title: Docker
  description: >
    Docker stats collected from Docker.
  short_config: false
  anchor: docker-processor
  fields:
    - name: docker
      default_field: true
      type: group
      fields:
        - name: container.id
          type: alias
          path: container.id
          migration: true

        - name: container.image
          type: alias
          path: container.image.name
          migration: true

        - name: container.name
          type: alias
          path: container.name
          migration: true

        - name: container.labels  # TODO: How to map these?
          type: object
          object_type: keyword
          description: >
            Image labels.
- key: host
  default_field: true
  title: Host
  description: >
    Info collected for the host machine.
  anchor: host-processor
  fields:

    # ECS fields are in fields.ecs.yml.
    # These are the non-ECS fields.
    - name: host
      default_field: true
      type: group
      fields:

        - name: containerized
          type: boolean
          description: >
            If the host is a container.

        - name: os.build
          type: keyword
          example: "18D109"
          description: >
            OS build information.

        - name: os.codename
          type: keyword
          example: "stretch"
          description: >
            OS codename, if any.
- key: kubernetes
  title: Kubernetes
  description: >
    Kubernetes metadata added by the kubernetes processor
  short_config: false
  anchor: kubernetes-processor
  fields:
    - name: kubernetes
      default_field: true
      type: group
      fields:
        - name: pod.name
          type: keyword
          description: >
            Kubernetes pod name

        - name: pod.uid
          type: keyword
          description: >
            Kubernetes Pod UID

        - name: pod.ip
          type: ip
          description: >
            Kubernetes Pod IP

        - name: namespace
          type: keyword
          description: >
            Kubernetes namespace

        - name: node.name
          type: keyword
          description: >
            Kubernetes node name

        - name: node.hostname
          type: keyword
          description: >
            Kubernetes hostname as reported by the node’s kernel

        - name: labels.*
          type: object
          object_type: keyword
          object_type_mapping_type: "*"
          description: >
            Kubernetes labels map

        - name: annotations.*
          type: object
          object_type: keyword
          object_type_mapping_type: "*"
          description: >
            Kubernetes annotations map

        - name: selectors.*
          type: object
          object_type: keyword
          object_type_mapping_type: "*"
          description: >
            Kubernetes selectors map

        - name: replicaset.name
          type: keyword
          description: >
            Kubernetes replicaset name

        - name: deployment.name
          type: keyword
          description: >
            Kubernetes deployment name

        - name: statefulset.name
          type: keyword
          description: >
            Kubernetes statefulset name

        - name: container.name
          type: keyword
          description: >
            Kubernetes container name (different than the name from the runtime)
- key: process
  title: Process
  description: >
    Process metadata fields
  fields:
    - name: process
      default_field: true
      type: group
      fields:
        - name: exe
          type: alias
          path: process.executable
          migration: true
        - name: owner
          type: group
          description: Process owner information.
          fields:
            - name: id
              type: keyword
              ignore_above: 1024
              description: Unique identifier of the user.
            - name: name
              type: keyword
              ignore_above: 1024
              multi_fields:
              - name: text
                type: text
                norms: false
              description: Short name or login of the user.
              example: albert

- key: jolokia-autodiscover
  title: Jolokia Discovery autodiscover provider
  description: >
    Metadata from Jolokia Discovery added by the jolokia provider.
  fields:
    - name: jolokia.agent.version
      default_field: true
      type: keyword
      description: >
        Version number of jolokia agent.
    - name: jolokia.agent.id
      default_field: true
      type: keyword
      description: >
        Each agent has a unique id which can be either provided during startup of the agent in form of a configuration parameter or being autodetected. If autodected, the id has several parts: The IP, the process id, hashcode of the agent and its type.
    - name: jolokia.server.product
      default_field: true
      type: keyword
      description: >
        The container product if detected.
    - name: jolokia.server.version
      default_field: true
      type: keyword
      description: >
        The container's version (if detected).
    - name: jolokia.server.vendor
      default_field: true
      type: keyword
      description: >
        The vendor of the container the agent is running in.
    - name: jolokia.url
      default_field: true
      type: keyword
      description: >
        The URL how this agent can be contacted.
    - name: jolokia.secured
      default_field: true
      type: boolean
      description: >
        Whether the agent was configured for authentication or not.
- key: common
  title: Common
  description: >
    Contains common fields available in all event types.
  fields:

    - name: metricset.module
      description: >
        The name of the module that generated the event.
      type: alias
      path: event.module
      migration: true

    - name: metricset.name
      description: >
        The name of the metricset that generated the event.

    - name: metricset.period
      type: integer
      description: >
        Current data collection period for this event in milliseconds.

    - name: service.hostname
      description: >
        Host name of the machine where the service is running.

    - name: type
      required: true
      example: metricsets
      description: >
        The document type. Always set to "doc".

    - name: systemd.fragment_path
      type: keyword
      description: the location of the systemd unit path
    - name: systemd.unit
      type: keyword
      description: the unit name of the systemd service
- key: aerospike
  title: "Aerospike"
  description: >
    Aerospike module
  release: ga
  fields:
    - name: aerospike
      type: group
      description: >
      fields:
        - name: namespace
          type: group
          description: >
            namespace
          release: ga
          fields:
            - name: client
              type: group
              description: >
                Client stats.
              fields:
                - name: delete
                  type: group
                  description: >
                    Client delete transactions stats.
                  fields:
                    - name: error
                      type: long
                      description: >
                        Number of client delete transactions that failed with an error.
                    - name: not_found
                      type: long
                      description: >
                        Number of client delete transactions that resulted in a not found.
                    - name: success
                      type: long
                      description: >
                        Number of successful client delete transactions.
                    - name: timeout
                      type: long
                      description: >
                        Number of client delete transactions that timed out.
                - name: read
                  type: group
                  description: >
                    Client read transactions stats.
                  fields:
                    - name: error
                      type: long
                      description: >
                        Number of client read transaction errors.
                    - name: not_found
                      type: long
                      description: >
                        Number of client read transaction that resulted in not found.
                    - name: success
                      type: long
                      description: >
                        Number of successful client read transactions.
                    - name: timeout
                      type: long
                      description: >
                        Number of client read transaction that timed out.
                - name: write
                  type: group
                  description: >
                    Client write transactions stats.
                  fields:
                    - name: error
                      type: long
                      description: >
                        Number of client write transactions that failed with an error.
                    - name: success
                      type: long
                      description: >
                        Number of successful client write transactions.
                    - name: timeout
                      type: long
                      description: >
                        Number of client write transactions that timed out.
            - name: device
              type: group
              description: >
                Disk storage stats
              fields:
                - name: available.pct
                  type: scaled_float
                  format: percent
                  description: >
                    Measures the minimum contiguous disk space across all disks in a namespace.
                - name: free.pct
                  type: scaled_float
                  format: percent
                  description: >
                    Percentage of disk capacity free for this namespace.
                - name: total.bytes
                  type: long
                  format: bytes
                  description: >
                    Total bytes of disk space allocated to this namespace on this node.
                - name: used.bytes
                  type: long
                  format: bytes
                  description: >
                    Total bytes of disk space used by this namespace on this node.
            - name: hwm_breached
              type: boolean
              description: >
                If true, Aerospike has breached 'high-water-[disk|memory]-pct' for this namespace.
            - name: memory
              type: group
              description: >
                Memory storage stats.
              fields:
                - name: free.pct
                  type: scaled_float
                  format: percent
                  description: >
                    Percentage of memory capacity free for this namespace on this node.
                - name: used.data.bytes
                  type: long
                  format: bytes
                  description: >
                    Amount of memory occupied by data for this namespace on this node.
                - name: used.index.bytes
                  type: long
                  format: bytes
                  description: >
                    Amount of memory occupied by the index for this namespace on this node.
                - name: used.sindex.bytes
                  type: long
                  format: bytes
                  description: >
                    Amount of memory occupied by secondary indexes for this namespace on this node.
                - name: used.total.bytes
                  type: long
                  format: bytes
                  description: >
                    Total bytes of memory used by this namespace on this node.
            - name: name
              type: keyword
              description: >
                Namespace name
            - name: node.host
              type: keyword
              description: >
                Node host
            - name: node.name
              type: keyword
              description: >
                Node name
            - name: objects
              type: group
              description: >
                Records stats.
              fields:
                - name: master
                  type: long
                  description: >
                    Number of records on this node which are active masters.
                - name: total
                  type: long
                  description: >
                    Number of records in this namespace for this node.
            - name: stop_writes
              type: boolean
              description: >
                If true this namespace is currently not allowing writes.
- key: apache
  title: "Apache"
  description: >
    Apache HTTPD server metricsets collected from the Apache web server.
  short_config: false
  release: ga
  settings: ["ssl", "http"]
  fields:
    - name: apache
      type: group
      description: >
        `apache` contains the metrics that were scraped from Apache.
      fields:
        - name: status
          type: group
          release: ga
          description: >
            `status` contains the metrics that were scraped from the Apache status page.
          fields:
            - name: hostname
              type: keyword
              description: >
                Apache hostname.
            - name: total_accesses
              type: long
              description: >
                Total number of access requests.
            - name: total_kbytes
              type: long
              description: >
                Total number of kilobytes served.
            - name: requests_per_sec
              type: scaled_float
              description: >
                Requests per second.
            - name: bytes_per_sec
              type: scaled_float
              description: >
                Bytes per second.
            - name: bytes_per_request
              type: scaled_float
              description: >
                Bytes per request.
            - name: workers.busy
              type: long
              description: >
                Number of busy workers.
            - name: workers.idle
              type: long
              description: >
                Number of idle workers.
            - name: uptime
              type: group
              description: >
                Uptime stats.
              fields:
                - name: server_uptime
                  type: long
                  description: >
                    Server uptime in seconds.
                - name: uptime
                  type: long
                  description: >
                    Server uptime.
            - name: cpu
              type: group
              description: >
                CPU stats.
              fields:
                - name: load
                  type: scaled_float
                  description: >
                    CPU Load.
                - name: user
                  type: scaled_float
                  description: >
                    CPU user load.
                - name: system
                  type: scaled_float
                  description: >
                    System cpu.
                - name: children_user
                  type: scaled_float
                  description: >
                    CPU of children user.
                - name: children_system
                  type: scaled_float
                  description: >
                    CPU of children system.
            - name: connections
              type: group
              description: >
                Connection stats.
              fields:
                - name: total
                  type: long
                  description: >
                    Total connections.
                - name: async.writing
                  type: long
                  description: >
                    Async connection writing.
                - name: async.keep_alive
                  type: long
                  description: >
                    Async keeped alive connections.
                - name: async.closing
                  type: long
                  description: >
                    Async closed connections.
            - name: load
              type: group
              description: >
                Load averages.
              fields:
                - name: "1"
                  type: scaled_float
                  scaling_factor: 100
                  description: >
                    Load average for the last minute.
                - name: "5"
                  type: scaled_float
                  scaling_factor: 100
                  description: >
                    Load average for the last 5 minutes.
                - name: "15"
                  type: scaled_float
                  scaling_factor: 100
                  description: >
                    Load average for the last 15 minutes.
            - name: scoreboard
              type: group
              description: >
                Scoreboard metrics.
              fields:
                - name: starting_up
                  type: long
                  description: >
                    Starting up.
                - name: reading_request
                  type: long
                  description: >
                    Reading requests.
                - name: sending_reply
                  type: long
                  description: >
                    Sending Reply.
                - name: keepalive
                  type: long
                  description: >
                    Keep alive.
                - name: dns_lookup
                  type: long
                  description: >
                    Dns Lookups.
                - name: closing_connection
                  type: long
                  description: >
                    Closing connections.
                - name: logging
                  type: long
                  description: >
                    Logging
                - name: gracefully_finishing
                  type: long
                  description: >
                    Gracefully finishing.
                - name: idle_cleanup
                  type: long
                  description: >
                    Idle cleanups.
                - name: open_slot
                  type: long
                  description: >
                    Open slots.
                - name: waiting_for_connection
                  type: long
                  description: >
                    Waiting for connections.
                - name: total
                  type: long
                  description: >
                    Total.
- key: beat
  title: "Beat"
  description: >
    Beat module
  release: ga
  settings: ["ssl", "http"]
  short_config: false
  fields:
    - name: beats_stats
      type: group
      fields:
        - name: apm-server
          type: group
          fields:
            - name: processor
              type: group
              fields:
                - name: span.transformations
                  type: alias
                  path: beat.stats.apm_server.processor.span.transformations
                - name: error
                  type: group
                  fields:
                    - name: spans
                      type: alias
                      path: beat.stats.apm_server.processor.error.spans
                    - name: stacktraces
                      type: alias
                      path: beat.stats.apm_server.processor.error.stacktraces
                    - name: frames
                      type: alias
                      path: beat.stats.apm_server.processor.error.frames
                    - name: transformations
                      type: alias
                      path: beat.stats.apm_server.processor.error.transformations
                    - name: decoding.errors
                      type: alias
                      path: beat.stats.apm_server.processor.error.decoding.errors
                    - name: decoding.count
                      type: alias
                      path: beat.stats.apm_server.processor.error.decoding.count
                    - name: validation.errors
                      type: alias
                      path: beat.stats.apm_server.processor.error.validation.errors
                    - name: validation.count
                      type: alias
                      path: beat.stats.apm_server.processor.error.validation.count
                - name: transaction
                  type: group
                  fields:
                    - name: spans
                      type: alias
                      path: beat.stats.apm_server.processor.transaction.spans
                    - name: stacktraces
                      type: alias
                      path: beat.stats.apm_server.processor.transaction.stacktraces
                    - name: frames
                      type: alias
                      path: beat.stats.apm_server.processor.transaction.frames
                    - name: transactions
                      type: alias
                      path: beat.stats.apm_server.processor.transaction.transactions
                    - name: transformations
                      type: alias
                      path: beat.stats.apm_server.processor.transaction.transformations
                    - name: decoding.errors
                      type: alias
                      path: beat.stats.apm_server.processor.transaction.decoding.errors
                    - name: decoding.count
                      type: alias
                      path: beat.stats.apm_server.processor.transaction.decoding.count
                    - name: validation.errors
                      type: alias
                      path: beat.stats.apm_server.processor.transaction.validation.errors
                    - name: validation.count
                      type: alias
                      path: beat.stats.apm_server.processor.transaction.validation.count
                - name: sourcemap
                  type: group
                  fields:
                    - name: counter
                      type: alias
                      path: beat.stats.apm_server.processor.sourcemap.counter
                    - name: decoding.errors
                      type: alias
                      path: beat.stats.apm_server.processor.sourcemap.decoding.errors
                    - name: decoding.count
                      type: alias
                      path: beat.stats.apm_server.processor.sourcemap.decoding.count
                    - name: validation.errors
                      type: alias
                      path: beat.stats.apm_server.processor.sourcemap.validation.errors
                    - name: validation.count
                      type: alias
                      path: beat.stats.apm_server.processor.sourcemap.validation.count
                - name: metric
                  type: group
                  fields:
                    - name: transformations
                      type: alias
                      path: beat.stats.apm_server.processor.metric.transformations
                    - name: decoding
                      type: group
                      fields:
                        - name: errors
                          type: alias
                          path: beat.stats.apm_server.processor.metric.decoding.errors
                        - name: count
                          type: alias
                          path: beat.stats.apm_server.processor.metric.decoding.count
                    - name: validation
                      type: group
                      fields:
                        - name: errors
                          type: alias
                          path: beat.stats.apm_server.processor.metric.validation.errors
                        - name: count
                          type: alias
                          path: beat.stats.apm_server.processor.metric.validation.count
            - name: decoder
              type: group
              fields:
                - name: deflate
                  type: group
                  fields:
                    - name: content-length
                      type: alias
                      path: beat.stats.apm_server.decoder.deflate.content-length
                    - name: count
                      type: alias
                      path: beat.stats.apm_server.decoder.deflate.count
                - name: gzip
                  type: group
                  fields:
                    - name: content-length
                      type: alias
                      path: beat.stats.apm_server.decoder.gzip.content-length
                    - name: count
                      type: alias
                      path: beat.stats.apm_server.decoder.gzip.count
                - name: uncompressed
                  type: group
                  fields:
                    - name: content-length
                      type: alias
                      path: beat.stats.apm_server.decoder.uncompressed.content-length
                    - name: count
                      type: alias
                      path: beat.stats.apm_server.decoder.uncompressed.count
                - name: reader
                  type: group
                  fields:
                    - name: size
                      type: alias
                      path: beat.stats.apm_server.decoder.reader.size
                    - name: count
                      type: alias
                      path: beat.stats.apm_server.decoder.reader.count
                - name: missing-content-length.count
                  type: alias
                  path: beat.stats.apm_server.decoder.missing-content-length.count
            - name: server
              type: group
              fields:
                - name: request.count
                  type: alias
                  path: beat.stats.apm_server.server.request.count
                - name: concurrent.wait.ms
                  type: alias
                  path: beat.stats.apm_server.server.concurrent.wait.ms
                - name: response
                  type: group
                  fields:
                    - name: count
                      type: alias
                      path: beat.stats.apm_server.server.response.count
                    - name: valid
                      type: group
                      fields:
                        - name: ok
                          type: alias
                          path: beat.stats.apm_server.server.response.valid.ok
                        - name: accepted
                          type: alias
                          path: beat.stats.apm_server.server.response.valid.accepted
                        - name: count
                          type: alias
                          path: beat.stats.apm_server.server.response.valid.count
                    - name: errors
                      type: group
                      fields:
                        - name: count
                          type: alias
                          path: beat.stats.apm_server.server.response.errors.count
                        - name: toolarge
                          type: alias
                          path: beat.stats.apm_server.server.response.errors.toolarge
                        - name: validate
                          type: alias
                          path: beat.stats.apm_server.server.response.errors.validate
                        - name: ratelimit
                          type: alias
                          path: beat.stats.apm_server.server.response.errors.ratelimit
                        - name: queue
                          type: alias
                          path: beat.stats.apm_server.server.response.errors.queue
                        - name: closed
                          type: alias
                          path: beat.stats.apm_server.server.response.errors.closed
                        - name: forbidden
                          type: alias
                          path: beat.stats.apm_server.server.response.errors.forbidden
                        - name: concurrency
                          type: alias
                          path: beat.stats.apm_server.server.response.errors.concurrency
                        - name: unauthorized
                          type: alias
                          path: beat.stats.apm_server.server.response.errors.unauthorized
                        - name: internal
                          type: alias
                          path: beat.stats.apm_server.server.response.errors.internal
                        - name: decode
                          type: alias
                          path: beat.stats.apm_server.server.response.errors.decode
                        - name: method
                          type: alias
                          path: beat.stats.apm_server.server.response.errors.method
            - name: acm.request.count
              type: alias
              path: beat.stats.apm_server.acm.request.count
            - name: acm.response
              type: group
              fields:
                - name: request.count
                  type: alias
                  path: beat.stats.apm_server.acm.response.request.count
                - name: unset
                  type: alias
                  path: beat.stats.apm_server.acm.response.unset
                - name: count
                  type: alias
                  path: beat.stats.apm_server.acm.response.count
                - name: valid
                  type: group
                  fields:
                    - name: notmodified
                      type: alias
                      path: beat.stats.apm_server.acm.response.valid.notmodified
                    - name: count
                      type: alias
                      path: beat.stats.apm_server.acm.response.valid.count
                    - name: ok
                      type: alias
                      path: beat.stats.apm_server.acm.response.valid.ok
                    - name: accepted
                      type: alias
                      path: beat.stats.apm_server.acm.response.valid.accepted
                - name: errors
                  type: group
                  fields:
                    - name: validate
                      type: alias
                      path: beat.stats.apm_server.acm.response.errors.validate
                    - name: internal
                      type: alias
                      path: beat.stats.apm_server.acm.response.errors.internal
                    - name: queue
                      type: alias
                      path: beat.stats.apm_server.acm.response.errors.queue
                    - name: count
                      type: alias
                      path: beat.stats.apm_server.acm.response.errors.count
                    - name: decode
                      type: alias
                      path: beat.stats.apm_server.acm.response.errors.decode
                    - name: toolarge
                      type: alias
                      path: beat.stats.apm_server.acm.response.errors.toolarge
                    - name: unavailable
                      type: alias
                      path: beat.stats.apm_server.acm.response.errors.unavailable
                    - name: forbidden
                      type: alias
                      path: beat.stats.apm_server.acm.response.errors.forbidden
                    - name: method
                      type: alias
                      path: beat.stats.apm_server.acm.response.errors.method
                    - name: notfound
                      type: alias
                      path: beat.stats.apm_server.acm.response.errors.notfound
                    - name: invalidquery
                      type: alias
                      path: beat.stats.apm_server.acm.response.errors.invalidquery
                    - name: ratelimit
                      type: alias
                      path: beat.stats.apm_server.acm.response.errors.ratelimit
                    - name: closed
                      type: alias
                      path: beat.stats.apm_server.acm.response.errors.closed
                    - name: unauthorized
                      type: alias
                      path: beat.stats.apm_server.acm.response.errors.unauthorized
        - name: beat
          type: group
          fields:
            - name: host
              type: alias
              path: beat.stats.info.host
            - name: name
              type: alias
              path: beat.stats.info.name
            - name: type
              type: alias
              path: beat.stats.info.type
            - name: uuid
              type: alias
              path: beat.stats.info.uuid
            - name: version
              type: alias
              path: beat.stats.info.version
        - name: metrics
          type: group
          fields:
            - name: system
              type: group
              fields:
                - name: cpu.cores
                  type: alias
                  path: beat.stats.system.cpu.cores
                - name: load.1
                  type: alias
                  path: beat.stats.system.load.1
                - name: load.5
                  type: alias
                  path: beat.stats.system.load.5
                - name: load.15
                  type: alias
                  path: beat.stats.system.load.15
                - name: load.norm
                  type: group
                  fields:
                    - name: "1"
                      type: alias
                      path: beat.stats.system.load.norm.1
                    - name: "15"
                      type: alias
                      path: beat.stats.system.load.norm.15
                    - name: "5"
                      type: alias
                      path: beat.stats.system.load.norm.5
            - name: libbeat
              type: group
              fields:
                - name: pipeline
                  type: group
                  fields:
                    - name: clients
                      type: alias
                      path: beat.stats.libbeat.pipeline.clients
                    - name: queue.acked
                      type: alias
                      path: beat.stats.libbeat.pipeline.queue.acked
                    - name: event
                      type: group
                      fields:
                        - name: active
                          type: alias
                          path: beat.stats.libbeat.pipeline.events.active
                        - name: dropped
                          type: alias
                          path: beat.stats.libbeat.pipeline.events.dropped
                        - name: failed
                          type: alias
                          path: beat.stats.libbeat.pipeline.events.failed
                        - name: filtered
                          type: alias
                          path: beat.stats.libbeat.pipeline.events.filtered
                        - name: published
                          type: alias
                          path: beat.stats.libbeat.pipeline.events.published
                        - name: retry
                          type: alias
                          path: beat.stats.libbeat.pipeline.events.retry
                        - name: total
                          type: alias
                          path: beat.stats.libbeat.pipeline.events.total
                - name: output
                  type: group
                  fields:
                    - name: events
                      type: group
                      fields:
                        - name: acked
                          type: alias
                          path: beat.stats.libbeat.output.events.acked
                        - name: active
                          type: alias
                          path: beat.stats.libbeat.output.events.active
                        - name: batches
                          type: alias
                          path: beat.stats.libbeat.output.events.batches
                        - name: dropped
                          type: alias
                          path: beat.stats.libbeat.output.events.dropped
                        - name: duplicated
                          type: alias
                          path: beat.stats.libbeat.output.events.duplicates
                        - name: failed
                          type: alias
                          path: beat.stats.libbeat.output.events.failed
                        - name: toomany
                          type: alias
                          path: beat.stats.libbeat.output.events.toomany
                        - name: total
                          type: alias
                          path: beat.stats.libbeat.output.events.total
                    - name: read.bytes
                      type: alias
                      path: beat.stats.libbeat.output.read.bytes
                    - name: read.errors
                      type: alias
                      path: beat.stats.libbeat.output.read.errors
                    - name: type
                      type: alias
                      path: beat.stats.libbeat.output.type
                    - name: write.bytes
                      type: alias
                      path: beat.stats.libbeat.output.write.bytes
                    - name: write.errors
                      type: alias
                      path: beat.stats.libbeat.output.write.errors
                - name: config
                  type: group
                  fields:
                    - name: module.running
                      type: alias
                      path: beat.stats.libbeat.config.running
                    - name: module.starts
                      type: alias
                      path: beat.stats.libbeat.config.starts
                    - name: module.stops
                      type: alias
                      path: beat.stats.libbeat.config.stops
            - name: beat
              type: group
              fields:
                - name: info.ephemeral_id
                  type: alias
                  path: beat.stats.info.ephemeral_id
                - name: info.uptime.ms
                  type: alias
                  path: beat.stats.info.uptime.ms
                - name: handles
                  type: group
                  fields:
                    - name: limit.hard
                      type: alias
                      path: beat.stats.handles.limit.hard
                    - name: limit.soft
                      type: alias
                      path: beat.stats.handles.limit.soft
                    - name: open
                      type: alias
                      path: beat.stats.handles.open
                - name: memstats
                  type: group
                  fields:
                    - name: gc_next
                      type: alias
                      path: beat.stats.memstats.gc_next
                    - name: memory_alloc
                      type: alias
                      path: beat.stats.memstats.memory.alloc
                    - name: memory_total
                      type: alias
                      path: beat.stats.memstats.memory.total
                    - name: rss
                      type: alias
                      path: beat.stats.memstats.rss
                - name: cgroup
                  type: group
                  fields:
                    - name: cpu
                      type: group
                      fields:
                        - name: id
                          type: alias
                          path: beat.stats.cgroup.cpu.id
                        - name: cfs.period.us
                          type: alias
                          path: beat.stats.cgroup.cpu.cfs.period.us
                        - name: cfs.quota.us
                          type: alias
                          path: beat.stats.cgroup.cpu.cfs.quota.us
                        - name: stats
                          type: group
                          fields:
                            - name: periods
                              type: alias
                              path: beat.stats.cgroup.cpu.stats.periods
                            - name: throttled.periods
                              type: alias
                              path: beat.stats.cgroup.cpu.stats.throttled.periods
                            - name: throttled.ns
                              type: alias
                              path: beat.stats.cgroup.cpu.stats.throttled.ns
                    - name: cpuacct.id
                      type: alias
                      path: beat.stats.cgroup.cpuacct.id
                    - name: cpuacct.total.ns
                      type: alias
                      path: beat.stats.cgroup.cpuacct.total.ns
                    - name: memory.id
                      type: alias
                      path: beat.stats.cgroup.memory.id
                    - name: mem.limit.bytes
                      type: alias
                      path: beat.stats.cgroup.memory.mem.limit.bytes
                    - name: mem.usage.bytes
                      type: alias
                      path: beat.stats.cgroup.memory.mem.usage.bytes
                - name: cpu
                  type: group
                  fields:
                    - name: system.ticks
                      type: alias
                      path: beat.stats.cpu.system.ticks
                    - name: system.time.ms
                      type: alias
                      path: beat.stats.cpu.system.time.ms
                    - name: total.value
                      type: alias
                      path: beat.stats.cpu.total.value
                    - name: total.ticks
                      type: alias
                      path: beat.stats.cpu.total.ticks
                    - name: total.time.ms
                      type: alias
                      path: beat.stats.cpu.total.time.ms
                    - name: user.ticks
                      type: alias
                      path: beat.stats.cpu.user.ticks
                    - name: user.time.ms
                      type: alias
                      path: beat.stats.cpu.user.time.ms

    - name: beats_state
      type: group
      fields:
        - name: beat
          type: group
          fields:
            - name: host
              type: alias
              path: beat.state.beat.host
            - name: name
              type: alias
              path: beat.state.beat.name
            - name: type
              type: alias
              path: beat.state.beat.type
            - name: uuid
              type: alias
              path: beat.state.beat.uuid
            - name: version
              type: alias
              path: beat.state.beat.version
        - name: timestamp
          type: alias
          path: "@timestamp"
        - name: state
          type: group
          fields:
            - name: beat.name
              type: alias
              path: beat.state.beat.name
            - name: host
              type: group
              fields:
                - name: architecture
                  type: alias
                  path: host.architecture
                - name: hostname
                  type: alias
                  path: host.hostname
                - name: name
                  type: alias
                  path: host.name
                - name: os
                  type: group
                  fields:
                    - name: platform
                      type: alias
                      path: beat.state.host.os.platform
                    - name: version
                      type: alias
                      path: beat.state.host.os.version
            - name: input.count
              type: alias
              path: beat.state.input.count
            - name: input.names
              type: alias
              path: beat.state.input.names
            - name: module.count
              type: alias
              path: beat.state.module.count
            - name: module.names
              type: alias
              path: beat.state.module.names
            - name: output.name
              type: alias
              path: beat.state.output.name
            - name: service
              type: group
              fields:
                - name: id
                  type: alias
                  path: beat.state.service.id
                - name: name
                  type: alias
                  path: beat.state.service.name
                - name: version
                  type: alias
                  path: beat.state.service.version
    - name: beat
      type: group
      description: >
      fields:
        - name: id
          type: keyword
          description: >
            Beat ID.
        - name: type
          type: keyword
          description: >
            Beat type.
        - name: elasticsearch.cluster.id
          type: keyword
        - name: state
          type: group
          description: >
            Beat state
          release: ga
          fields:
            - name: service
              type: group
              fields:
                - name: id
                  type: keyword
                - name: name
                  type: keyword
                - name: version
                  type: keyword
            - name: input
              type: group
              fields:
                - name: count
                  type: long
                - name: names
                  type: keyword
            - name: beat
              type: group
              fields:
                - name: host
                  type: keyword
                - name: name
                  type: keyword
                - name: type
                  type: keyword
                - name: uuid
                  type: keyword
                - name: version
                  type: keyword
            - name: cluster.uuid
              type: keyword
            - name: host
              type: group
              fields:
                - name: containerized
                  type: keyword
                - name: os
                  type: group
                  fields:
                    - name: kernel
                      type: keyword
                    - name: name
                      type: keyword
                    - name: platform
                      type: keyword
                    - name: version
                      type: keyword
            - name: management.enabled
              type: boolean
              description: >
                Is central management enabled?
            - name: module.count
              type: integer
              description: >
                Number of modules enabled
            - name: module.names
              type: keyword
            - name: output.name
              type: keyword
              description: >
                Name of output used by Beat
            - name: queue.name
              type: keyword
              description: >
                Name of queue being used by Beat
        - name: stats
          type: group
          description: >
            Beat stats
          release: ga
          fields:
            - name: apm_server
              type: group
              fields:
                - name: processor
                  type: group
                  fields:
                    - name: span.transformations
                      type: long
                    - name: error
                      type: group
                      fields:
                        - name: spans
                          type: long
                        - name: stacktraces
                          type: long
                        - name: frames
                          type: long
                        - name: transformations
                          type: long
                        - name: decoding.errors
                          type: long
                        - name: decoding.count
                          type: long
                        - name: validation.errors
                          type: long
                        - name: validation.count
                          type: long
                    - name: transaction
                      type: group
                      fields:
                        - name: spans
                          type: long
                        - name: stacktraces
                          type: long
                        - name: frames
                          type: long
                        - name: transactions
                          type: long
                        - name: transformations
                          type: long
                        - name: decoding.errors
                          type: long
                        - name: decoding.count
                          type: long
                        - name: validation.errors
                          type: long
                        - name: validation.count
                          type: long
                    - name: sourcemap
                      type: group
                      fields:
                        - name: counter
                          type: long
                        - name: decoding.errors
                          type: long
                        - name: decoding.count
                          type: long
                        - name: validation.errors
                          type: long
                        - name: validation.count
                          type: long
                    - name: metric
                      type: group
                      fields:
                        - name: transformations
                          type: long
                        - name: decoding
                          type: group
                          fields:
                            - name: errors
                              type: long
                            - name: count
                              type: long
                        - name: validation
                          type: group
                          fields:
                            - name: errors
                              type: long
                            - name: count
                              type: long
        
                - name: decoder
                  type: group
                  fields:
                    - name: deflate
                      type: group
                      fields:
                        - name: content-length
                          type: long
                        - name: count
                          type: long
                    - name: gzip
                      type: group
                      fields:
                        - name: content-length
                          type: long
                        - name: count
                          type: long
                    - name: uncompressed
                      type: group
                      fields:
                        - name: content-length
                          type: long
                        - name: count
                          type: long
                    - name: reader
                      type: group
                      fields:
                        - name: size
                          type: long
                        - name: count
                          type: long
                    - name: missing-content-length.count
                      type: long
                - name: server
                  type: group
                  fields:
                    - name: request.count
                      type: long
                    - name: concurrent.wait.ms
                      type: long
                    - name: response
                      type: group
                      fields:
                        - name: count
                          type: long
                        - name: valid
                          type: group
                          fields:
                            - name: ok
                              type: long
                            - name: accepted
                              type: long
                            - name: count
                              type: long
                        - name: errors
                          type: group
                          fields:
                            - name: count
                              type: long
                            - name: toolarge
                              type: long
                            - name: validate
                              type: long
                            - name: ratelimit
                              type: long
                            - name: queue
                              type: long
                            - name: closed
                              type: long
                            - name: forbidden
                              type: long
                            - name: concurrency
                              type: long
                            - name: unauthorized
                              type: long
                            - name: internal
                              type: long
                            - name: decode
                              type: long
                            - name: method
                              type: long
                - name: acm.request.count
                  type: long
                - name: acm.response
                  type: group
                  fields:
                    - name: request.count
                      type: long
                    - name: count
                      type: long
                    - name: unset
                      type: long
                    - name: valid
                      type: group
                      fields:
                        - name: notmodified
                          type: long
                        - name: count
                          type: long
                        - name: ok
                          type: long
                        - name: accepted
                          type: long
                    - name: errors
                      type: group
                      fields:
                        - name: validate
                          type: long
                        - name: internal
                          type: long
                        - name: queue
                          type: long
                        - name: count
                          type: long
                        - name: decode
                          type: long
                        - name: toolarge
                          type: long
                        - name: unavailable
                          type: long
                        - name: forbidden
                          type: long
                        - name: method
                          type: long
                        - name: notfound
                          type: long
                        - name: invalidquery
                          type: long
                        - name: ratelimit
                          type: long
                        - name: closed
                          type: long
                        - name: unauthorized
                          type: long
            - name: info
              type: group
              fields:
                - name: name
                  type: keyword
                - name: host
                  type: keyword
                - name: type
                  type: keyword
                - name: uuid
                  type: keyword
                - name: version
                  type: keyword
            - name: beat
              type: group
              fields:
                - name: name
                  type: keyword
                - name: host
                  type: keyword
                - name: type
                  type: keyword
                - name: uuid
                  type: keyword
                - name: version
                  type: keyword
            - name: system
              type: group
              fields:
                - name: cpu.cores
                  type: long
                - name: load
                  type: group
                  fields:
                    - name: "1"
                      type: double
                    - name: "15"
                      type: double
                    - name: "5"
                      type: double
                    - name: norm
                      type: group
                      fields:
                        - name: "1"
                          type: double
                        - name: "15"
                          type: double
                        - name: "5"
                          type: double
            - name: cpu
              type: group
              fields:
                - name: system.ticks
                  type: long
                - name: system.time.ms
                  type: long
                - name: total.value
                  type: long
                - name: total.ticks
                  type: long
                - name: total.time.ms
                  type: long
                - name: user.ticks
                  type: long
                - name: user.time.ms
                  type: long
            - name: info
              type: group
              fields:
                - name: ephemeral_id
                  type: keyword
                - name: uptime.ms
                  type: long
            - name: cgroup
              type: group
              fields:
                - name: cpu
                  type: group
                  fields:
                    - name: cfs.period.us
                      type: long
                    - name: cfs.quota.us
                      type: long
                    - name: id
                      type: keyword
                    - name: stats
                      type: group
                      fields:
                        - name: periods
                          type: long
                        - name: throttled.periods
                          type: long
                        - name: throttled.ns
                          type: long
                - name: cpuacct.id
                  type: keyword
                - name: cpuacct.total.ns
                  type: long
                - name: memory
                  type: group
                  fields:
                    - name: id
                      type: keyword
                    - name: mem.limit.bytes
                      type: long
                    - name: mem.usage.bytes
                      type: long
            - name: memstats
              type: group
              fields:
                - name: gc_next
                  type: long
                - name: memory.alloc
                  type: long
                - name: memory.total
                  type: long
                - name: rss
                  type: long
            - name: handles
              type: group
              fields:
                - name: open
                  type: long
                - name: limit.hard
                  type: long
                - name: limit.soft
                  type: long
            - name: uptime.ms
              type: long
              description: >
                Beat uptime
            - name: runtime.goroutines
              type: long
              description: >
                Number of goroutines running in Beat
            - name: libbeat
              type: group
              description: >
                Fields common to all Beats
              fields:
                - name: pipeline
                  type: group
                  fields:
                    - name: clients
                      type: long
                    - name: queue.acked
                      type: long
                    - name: events
                      type: group
                      fields:
                        - name: active
                          type: long
                        - name: dropped
                          type: long
                        - name: failed
                          type: long
                        - name: filtered
                          type: long
                        - name: published
                          type: long
                        - name: retry
                          type: long
                        - name: total
                          type: long
                - name: config
                  type: group
                  fields:
                    - name: running
                      type: long
                    - name: starts
                      type: long
                    - name: stops
                      type: long
                    - name: reloads
                      type: long
                - name: output
                  type: group
                  description: >
                    Output stats
                  fields:
                    - name: type
                      type: keyword
                      description: >
                        Type of output
                    - name: events
                      type: group
                      description: >
                        Event counters
                      fields:
                        - name: acked
                          type: long
                          description: >
                            Number of events acknowledged
                        - name: active
                          type: long
                          description: >
                            Number of active events
                        - name: batches
                          type: long
                          description: >
                            Number of event batches
                        - name: dropped
                          type: long
                          description: >
                            Number of events dropped
                        - name: duplicates
                          type: long
                          description: >
                            Number of events duplicated
                        - name: failed
                          type: long
                          description: >
                            Number of events failed
                        - name: toomany
                          type: long
                          description: >
                            Number of too many events
                        - name: total
                          type: long
                          description: >
                            Total number of events
                    - name: read
                      type: group
                      description: >
                        Read stats
                      fields:
                        - name: bytes
                          type: long
                          description: >
                            Number of bytes read
                        - name: errors
                          type: long
                          description: >
                            Number of read errors
                    - name: write
                      type: group
                      description: >
                        Write stats
                      fields:
                        - name: bytes
                          type: long
                          description: >
                            Number of bytes written
                        - name: errors
                          type: long
                          description: >
                            Number of write errors
- key: ceph
  title: "Ceph"
  description: >
    Ceph module
  short_config: false
  release: ga
  settings: ["ssl", "http"]
  fields:
    - name: ceph
      type: group
      description: >
        `ceph` contains the metrics that were scraped from CEPH.
      fields:
        - name: cluster_disk
          type: group
          description: >
            cluster_disk
          release: ga
          fields:
            - name: available.bytes
              type: long
              description: >
                Available bytes of the cluster
              format: bytes
            - name: total.bytes
              type: long
              description: >
                Total bytes of the cluster
              format: bytes
            - name: used.bytes
              type: long
              description: >
                Used bytes of the cluster
              format: bytes
        - name: cluster_health
          type: group
          description: >
            cluster_health
          release: ga
          fields:
            - name: overall_status
              type: keyword
              description: >
                Overall status of the cluster
            - name: timechecks.epoch
              type: long
              description: >
                Map version
            - name: timechecks.round.value
              type: long
              description: >
                timecheck round
            - name: timechecks.round.status
              type: keyword
              description: >
                Status of the round
        - name: cluster_status
          type: group
          release: ga
          description: >
            cluster_status
          fields:
            - name: version
              type: long
              description: >
                Ceph Status version
            - name: traffic.read_bytes
              type: long
              format: bytes
              description: >
                Cluster read throughput per second
            - name: traffic.write_bytes
              type: long
              format: bytes
              description: >
                Cluster write throughput per second
            - name: traffic.read_op_per_sec
              type: long
              description: >
                Cluster read iops per second
            - name: traffic.write_op_per_sec
              type: long
              description: >
                Cluster write iops per second
            - name: misplace.total
              type: long
              description: >
                Cluster misplace pg number
            - name: misplace.objects
              type: long
              description: >
                Cluster misplace objects number
            - name: misplace.ratio
              type: scaled_float
              format: percent
              description: >
                Cluster misplace ratio
            - name: degraded.total
              type: long
              description: >
                Cluster degraded pg number
            - name: degraded.objects
              type: long
              description: >
                Cluster degraded objects number
            - name: degraded.ratio
              type: scaled_float
              format: percent
              description: >
                Cluster degraded ratio
            - name: pg.data_bytes
              type: long
              format: bytes
              description: >
                Cluster pg data bytes
            - name: pg.avail_bytes
              type: long
              format: bytes
              description: >
                Cluster available bytes
            - name: pg.total_bytes
              type: long
              format: bytes
              description: >
                Cluster total bytes
            - name: pg.used_bytes
              type: long
              format: bytes
              description: >
                Cluster used bytes
            - name: pg_state.state_name
              type: long
              description: >
                Pg state description
            - name: pg_state.count
              type: long
              description: >
                Shows how many pgs are in state of pg_state.state_name
            - name: pg_state.version
              type: long
              description: >
                Cluster status version
            - name: osd.full
              type: boolean
              description: >
                Is osd full
            - name: osd.nearfull
              type: boolean
              description: >
                Is osd near full
            - name: osd.num_osds
              type: long
              description: >
                Shows how many osds in the cluster
            - name: osd.num_up_osds
              type: long
              description: >
                Shows how many osds are on the state of UP
            - name: osd.num_in_osds
              type: long
              description: >
                Shows how many osds are on the state of IN
            - name: osd.num_remapped_pgs
              type: long
              description: >
                Shows how many osds are on the state of REMAPPED
            - name: osd.epoch
              type: long
              description: >
                epoch number
        - name: mgr_cluster_disk
          type: group
          description: >
            see: cluster_disk
          release: beta
          fields:
        - name: mgr_cluster_health
          type: group
          description: >
            see: cluster_health
          release: beta
          fields:
        - name: mgr_osd_perf
          type: group
          description: >
            OSD performance metrics of Ceph cluster
          release: beta
          fields:
            - name: id
              type: long
              description: OSD ID
            - name: stats.commit_latency_ms
              type: long
              description: Commit latency in ms
            - name: stats.apply_latency_ms
              type: long
              description: Apply latency in ms
            - name: stats.commit_latency_ns
              type: long
              description: Commit latency in ns
            - name: stats.apply_latency_ns
              type: long
              description: Apply latency in ns
        - name: mgr_osd_pool_stats
          type: group
          description: >
            OSD pool stats of Ceph cluster
          release: beta
          fields:
            - name: pool_name
              type: keyword
              description: Pool name
            - name: pool_id
              type: long
              description: Pool ID
            - name: client_io_rate
              type: object
              description: Client I/O rates
              fields:
                - name: read_bytes_sec
                  type: long
                  keyword: Bytes read per second
                - name: write_bytes_sec
                  type: long
                  keyword: Bytes written per second
                - name: read_op_per_sec
                  type: long
                  keyword: Read operations per second
                - name: write_op_per_sec
                  type: long
                  keyword: Write operations per second
        - name: mgr_osd_tree
          type: group
          description: >
            see: osd_tree
          release: beta
          fields:
        - name: mgr_pool_disk
          type: group
          description: >
            see: pool_disk
          release: beta
          fields:
        - name: monitor_health
          type: group
          release: ga
          description: >
            monitor_health stats data
          fields:
            - name: available.pct
              type: long
              description: >
                Available percent of the MON
            - name: health
              type: keyword
              description: >
                Health of the MON
            - name: available.kb
              type: long
              description: >
                Available KB of the MON
            - name: total.kb
              type: long
              description: >
                Total KB of the MON
            - name: used.kb
              type: long
              description: >
                Used KB of the MON
            - name: last_updated
              type: date
              description: >
                Time when was updated
            - name: name
              type: keyword
              description: >
                Name of the MON
            - name: store_stats.log.bytes
              type: long
              description: >
                Log bytes of MON
              format: bytes
            - name: store_stats.misc.bytes
              type: long
              description: >
                Misc bytes of MON
              format: bytes
            - name: store_stats.sst.bytes
              type: long
              description: >
                SST bytes of MON
              format: bytes
            - name: store_stats.total.bytes
              type: long
              description: >
                Total bytes of MON
              format: bytes
            - name: store_stats.last_updated
              type: long
              description: >
                Last updated
        - name: osd_df
          type: group
          release: ga
          description: >
            ceph osd disk usage information
          fields:
            - name: id
              type: long
              description: >
                osd node id
            - name: name
              type: keyword
              description: >
                osd node name
            - name: device_class
              type: keyword
              description: >
                osd node type, illegal type include hdd, ssd etc.
            - name: total.byte
              type: long
              format: bytes
              description: >
                osd disk total volume
            - name: used.byte
              type: long
              format: bytes
              description: >
                osd disk usage volume
            - name: available.bytes
              type: long
              format: bytes
              description: >
                osd disk available volume
            - name: pg_num
              type: long
              description: >
                shows how many pg located on this osd
            - name: used.pct
              type: scaled_float
              format: percent
              description: >
                osd disk usage percentage
        - name: osd_tree
          type: group
          description: >
            ceph osd tree info
          release: ga
          fields:
            - name: id
              type: long
              description: >
                osd or bucket node id
            - name: name
              type: keyword
              description: >
                osd or bucket node name
            - name: type
              type: keyword
              description: >
                osd or bucket node type, illegal type include osd, host, root etc.
            - name: type_id
              type: long
              description: >
                osd or bucket node typeID
            - name: children
              type: keyword
              description: >
                bucket children list, separated by comma.
            - name: crush_weight
              type: float
              description: >
                osd node crush weight
            - name: depth
              type: long
              description: >
                node depth
            - name: exists
              type: boolean
              description: >
                is node still exist or not(1-yes, 0-no)
            - name: primary_affinity
              type: float
              description: >
                the weight of reading data from primary osd
            - name: reweight
              type: long
              description: >
                the reweight of osd
            - name: status
              type: keyword
              description: >
                status of osd, it should be up or down
            - name: device_class
              type: keyword
              description: >
                the device class of osd, like hdd, ssd etc.
            - name: father
              type: keyword
              description: >
                the parent node of this osd or bucket node
        - name: pool_disk
          type: group
          description: >
            pool_disk
          release: ga
          fields:
            - name: id
              type: long
              description: >
                Id of the pool
            - name: name
              type: keyword
              description: >
                Name of the pool
            - name: stats.available.bytes
              type: long
              description: >
                Available bytes of the pool
              format: bytes
            - name: stats.objects
              type: long
              description: >
                Number of objects of the pool
            - name: stats.used.bytes
              type: long
              description: >
                Used bytes of the pool
              format: bytes
            - name: stats.used.kb
              type: long
              description: >
                Used kb of the pool
- key: consul
  title: "Consul"
  description: >
    Consul module
  release: beta
  settings: ["ssl", "http"]
  fields:
    - name: consul
      type: group
      fields:
        - name: agent
          type: group
          release: beta
          description: >
            Agent Metricset fetches metrics information from a Consul instance running as Agent
          fields:
            - name: autopilot
              type: group
              fields:
                - name: healthy
                  type: boolean
                  description: Overall health of the local server cluster
            - name: runtime
              type: group
              description: Runtime related metrics
              fields:
                - name: sys
                  type: group
                  fields:
                    - name: bytes
                      type: long
                      description: Number of bytes of memory obtained from the OS.
                - name: malloc_count
                  type: long
                  description: Heap objects allocated
                - name: heap_objects
                  type: long
                  description: Objects allocated on the heap and is a general memory pressure indicator. This may burst from time to time but should return to a steady state value.
                - name: goroutines
                  type: long
                  description: Running goroutines and is a general load pressure indicator. This may burst from time to time but should return to a steady state value.
                - name: alloc
                  type: group
                  fields:
                    - name: bytes
                      type: long
                      description: Bytes allocated by the Consul process.
                - name: garbage_collector
                  type: group
                  description: Garbage collector metrics
                  fields:
                    - name: runs
                      type: long
                      description: Garbage collector total executions
                    - name: pause
                      type: group
                      description: Time that the garbage collector has paused the app
                      fields:
                        - name: current
                          type: group
                          fields:
                            - name: ns
                              type: long
                              description: Garbage collector pause time in nanoseconds
                        - name: total
                          type: group
                          fields:
                            - name: ns
                              type: long
                              description: Nanoseconds consumed by stop-the-world garbage collection pauses since Consul started.
- key: couchbase
  title: "Couchbase"
  description: >
    Metrics collected from Couchbase servers.
  short_config: false
  release: ga
  settings: ["ssl", "http"]
  fields:
    - name: couchbase
      type: group
      description: >
        `couchbase` contains the metrics that were scraped from Couchbase.
      fields:
        - name: bucket
          type: group
          description: >
            Couchbase bucket metrics.
          release: ga
          fields:
            - name: name
              type: keyword
              description: >
                Name of the bucket.
            - name: type
              type: keyword
              description: >
                Type of the bucket.
            - name: data.used.bytes
              format: bytes
              type: long
              description: >
                Size of user data within buckets of the specified state that are resident in RAM.
            - name: disk.fetches
              type: double
              description: >
                Number of disk fetches.
            - name: disk.used.bytes
              format: bytes
              type: long
              description: >
                Amount of disk used (bytes).
            - name: memory.used.bytes
              format: bytes
              type: long
              description: >
                Amount of memory used by the bucket (bytes).
            - name: quota.ram.bytes
              format: bytes
              type: long
              description: >
                Amount of RAM used by the bucket (bytes).
            - name: quota.use.pct
              format: percent
              type: scaled_float
              description: >
                Percentage of RAM used (for active objects) against the configured bucket size (%).
            - name: ops_per_sec
              type: double
              description: >
                Number of operations per second.
            - name: item_count
              type: long
              description: >
                Number of items associated with the bucket.
        - name: cluster
          type: group
          description: >
            Couchbase cluster metrics.
          release: ga
          fields:
            - name: hdd.free.bytes
              format: bytes
              type: long
              description: >
                Free hard drive space in the cluster (bytes).
            - name: hdd.quota.total.bytes
              format: bytes
              type: long
              description: >
                Hard drive quota total for the cluster (bytes).
            - name: hdd.total.bytes
              format: bytes
              type: long
              description: >
                Total hard drive space available to the cluster (bytes).
            - name: hdd.used.value.bytes
              format: bytes
              type: long
              description: >
                Hard drive space used by the cluster (bytes).
            - name: hdd.used.by_data.bytes
              format: bytes
              type: long
              description: >
                Hard drive space used by the data in the cluster (bytes).
            - name: max_bucket_count
              type: long
              description: >
                Max bucket count setting.
            - name: quota.index_memory.mb
              type: double
              description: >
                Memory quota setting for the Index service (Mbyte).
            - name: quota.memory.mb
              type: double
              description: >
                Memory quota setting for the cluster (Mbyte).
            - name: ram.quota.total.value.bytes
              format: bytes
              type: long
              description: >
                RAM quota total for the cluster (bytes).
            - name: ram.quota.total.per_node.bytes
              format: bytes
              type: long
              description: >
                RAM quota used by the current node in the cluster (bytes).
            - name: ram.quota.used.value.bytes
              format: bytes
              type: long
              description: >
                RAM quota used by the cluster (bytes).
            - name: ram.quota.used.per_node.bytes
              format: bytes
              type: long
              description: >
                Ram quota used by the current node in the cluster (bytes)
            - name: ram.total.bytes
              format: bytes
              type: long
              description: >
                Total RAM available to cluster (bytes).
            - name: ram.used.value.bytes
              format: bytes
              type: long
              description: >
                RAM used by the cluster (bytes).
            - name: ram.used.by_data.bytes
              format: bytes
              type: long
              description: >
                RAM used by the data in the cluster (bytes).
        - name: node
          type: group
          description: >
            Couchbase node metrics.
          release: ga
          fields:
            - name: cmd_get
              type: double
              description: >
                Number of get commands
            - name: couch.docs.disk_size.bytes
              format: bytes
              type: long
              description: >
                Amount of disk space used by Couch docs (bytes).
            - name: couch.docs.data_size.bytes
              format: bytes
              type: long
              description: >
                Data size of Couch docs associated with a node (bytes).
            - name: couch.spatial.data_size.bytes
              type: long
              description: >
                Size of object data for spatial views (bytes).
            - name: couch.spatial.disk_size.bytes
              type: long
              description: >
                Amount of disk space used by spatial views (bytes).
            - name: couch.views.disk_size.bytes
              type: long
              description: >
                Amount of disk space used by Couch views (bytes).
            - name: couch.views.data_size.bytes
              type: long
              description: >
                Size of object data for Couch views (bytes).
            - name: cpu_utilization_rate.pct
              type: scaled_float
              description: >
                The CPU utilization rate (%).
            - name: current_items.value
              type: long
              description: >
                Number of current items.
            - name: current_items.total
              type: long
              description: >
                Total number of items associated with the node.
            - name: ep_bg_fetched
              type: long
              description: >
                Number of disk fetches performed since the server was started.
            - name: get_hits
              type: double
              description: >
                Number of get hits.
            - name: hostname
              type: keyword
              description: >
                The hostname of the node.
            - name: mcd_memory.allocated.bytes
              format: bytes
              type: long
              description: >
                Amount of memcached memory allocated (bytes).
            - name: mcd_memory.reserved.bytes
              type: long
              description: >
                Amount of memcached memory reserved (bytes).
            - name: memory.free.bytes
              type: long
              description: >
                Amount of memory free for the node (bytes).
            - name: memory.total.bytes
              type: long
              description: >
                Total memory available to the node (bytes).
            - name: memory.used.bytes
              type: long
              description: >
                Memory used by the node (bytes).
            - name: ops
              type: double
              description: >
                Number of operations performed on Couchbase.
            - name: swap.total.bytes
              type: long
              description: >
                Total swap size allocated (bytes).
            - name: swap.used.bytes
              type: long
              description: >
                Amount of swap space used (bytes).
            - name: uptime.sec
              type: long
              description: >
                Time during which the node was in operation (sec).
            - name: vb_replica_curr_items
              type: long
              description: >
                Number of items/documents that are replicas.
- key: couchdb
  title: "CouchDB"
  description: >
    couchdb module
  release: ga
  settings: ["ssl", "http"]
  fields:
    - name: couchdb
      type: group
      description: Couchdb metrics
      fields:
        - name: server
          type: group
          description: >
            Contains CouchDB server stats
          release: ga
          fields:
            - name: httpd
              type: group
              description: >
                HTTP statistics
              fields:
                - name: view_reads
                  type: long
                  description: >
                     Number of view reads
        
                - name: bulk_requests
                  type: long
                  description: >
                    Number of bulk requests
        
                - name: clients_requesting_changes
                  type: long
                  description: >
                    Number of clients for continuous _changes
        
                - name: temporary_view_reads
                  type: long
                  description: >
                    Number of temporary view reads
        
                - name: requests
                  type: long
                  description: >
                    Number of HTTP requests
        
            - name: httpd_request_methods
              type: group
              description: >
                HTTP request methods
              fields:
                - name: COPY
                  type: long
                  description: >
                    Number of HTTP COPY requests
        
                - name: HEAD
                  type: long
                  description: >
                    Number of HTTP HEAD requests
        
                - name: POST
                  type: long
                  description: >
                    Number of HTTP POST requests
        
                - name: DELETE
                  type: long
                  description: >
                    Number of HTTP DELETE requests
        
                - name: GET
                  type: long
                  description: >
                    Number of HTTP GET requests
        
                - name: PUT
                  type: long
                  description: >
                    Number of HTTP PUT requests
        
            - name: httpd_status_codes
              type: group
              description: >
                HTTP status codes statistics
              fields:
                - name: "200"
                  type: long
                  description: >
                    Number of HTTP 200 OK responses
        
                - name: "201"
                  type: long
                  description: >
                    Number of HTTP 201 Created responses
        
                - name: "202"
                  type: long
                  description: >
                    Number of HTTP 202 Accepted responses
        
                - name: "301"
                  type: long
                  description: >
                    Number of HTTP 301 Moved Permanently responses
        
                - name: "304"
                  type: long
                  description: >
                    Number of HTTP 304 Not Modified responses
        
                - name: "400"
                  type: long
                  description: >
                    Number of HTTP 400 Bad Request responses
        
                - name: "401"
                  type: long
                  description: >
                    Number of HTTP 401 Unauthorized responses
        
                - name: "403"
                  type: long
                  description: >
                    Number of HTTP 403 Forbidden responses
        
                - name: "404"
                  type: long
                  description: >
                     Number of HTTP 404 Not Found responses
        
                - name: "405"
                  type: long
                  description: >
                    Number of HTTP 405 Method Not Allowed responses
        
                - name: "409"
                  type: long
                  description: >
                    Number of HTTP 409 Conflict responses
        
                - name: "412"
                  type: long
                  description: >
                    Number of HTTP 412 Precondition Failed responses
        
                - name: "500"
                  type: long
                  description: >
                    Number of HTTP 500 Internal Server Error responses
        
            - name: couchdb
              type: group
              description: >
                couchdb statistics
              fields:
                - name: database_writes
                  type: long
                  description: >
                    Number of times a database was changed
        
                - name: open_databases
                  type: long
                  description: >
                    Number of open databases
        
                - name: auth_cache_misses
                  type: long
                  description: >
                    Number of authentication cache misses
        
                - name: request_time
                  type: long
                  description: >
                    Length of a request inside CouchDB without MochiWeb
        
                - name: database_reads
                  type: long
                  description: >
                    Number of times a document was read from a database
        
                - name: auth_cache_hits
                  type: long
                  description: >
                    Number of authentication cache hits
        
                - name: open_os_files
                  type: long
                  description: >
                    Number of file descriptors CouchDB has open
- key: docker
  title: "Docker"
  description: >
    Docker stats collected from Docker.
  release: ga
  settings: ["ssl"]
  short_config: false
  fields:
    - name: docker
      type: group
      description: >
        Information and statistics about docker's running containers.
      fields:
        - name: container
          type: group
          description: >
            Docker container metrics.
          release: ga
          fields:
            - name: command
              type: keyword
              description: >
                Command that was executed in the Docker container.
            - name: created
              type: date
              description: >
                Date when the container was created.
            - name: status
              type: keyword
              description: >
                Container status.
            - name: ip_addresses
              type: ip
              description: >
                Container IP addresses.
            - name: size
              type: group
              description: >
                Container size metrics.
              fields:
                - name: root_fs
                  type: long
                  description: >
                     Total size of all the files in the container.
                - name: rw
                  type: long
                  description: >
                     Size of the files that have been created or changed since creation.
            - name: tags
              type: keyword
              description: >
                Image tags.
        - name: cpu
          type: group
          description: >
            Runtime CPU metrics.
          release: ga
          fields:
            - name: kernel.pct
              type: scaled_float
              format: percent
              description: >
                Percentage of time in kernel space.
            - name: kernel.norm.pct
              type: scaled_float
              format: percent
              description: >
                Percentage of time in kernel space normalized by the number of CPU cores.
            - name: kernel.ticks
              type: long
              description: >
                CPU ticks in kernel space.
            - name: system.pct
              type: scaled_float
              format: percent
              description: >
                Percentage of total CPU time in the system.
            - name: system.norm.pct
              type: scaled_float
              format: percent
              description: >
                Percentage of total CPU time in the system normalized by the number of CPU cores.
            - name: system.ticks
              type: long
              description: >
                CPU system ticks.
            - name: user.pct
              type: scaled_float
              format: percent
              description: >
                Percentage of time in user space.
            - name: user.norm.pct
              type: scaled_float
              format: percent
              description: >
                Percentage of time in user space normalized by the number of CPU cores.
            - name: user.ticks
              type: long
              description: >
                CPU ticks in user space.
            - name: total.pct
              type: scaled_float
              format: percent
              description: >
                Total CPU usage.
            - name: total.norm.pct
              type: scaled_float
              format: percent
              description: >
                Total CPU usage normalized by the number of CPU cores.
            - name: core.*.pct
              type: object
              object_type: scaled_float
              format: percent
              description: >
                Percentage of CPU time in this core.
            - name: core.*.norm.pct
              type: object
              object_type: scaled_float
              format: percent
              description: >
                Percentage of CPU time in this core, normalized by the number of CPU cores.
            - name: core.*.ticks
              type: object
              object_type: long
              description: >
                Number of CPU ticks in this core.
        - name: diskio
          type: group
          description: >
            Disk I/O metrics.
          release: ga
          fields:
            - name: read
              type: group
              description: >
                Accumulated reads during the life of the container
              fields:
                - name: ops
                  type: long
                  description: >
                    Number of reads during the life of the container
                - name: bytes
                  type: long
                  format: bytes
                  description: >
                    Bytes read during the life of the container
                - name: rate
                  type: long
                  description: >
                    Number of current reads per second
                - name: service_time
                  type: long
                  description: >
                    Total time to service IO requests, in nanoseconds
                - name: wait_time
                  type: long
                  description: >
                    Total time requests spent waiting in queues for service, in nanoseconds
                - name: queued
                  type: long
                  description: >
                    Total number of queued requests
            - name: write
              type: group
              description: >
                Accumulated writes during the life of the container
              fields:
                - name: ops
                  type: long
                  description: >
                    Number of writes during the life of the container
                - name: bytes
                  type: long
                  format: bytes
                  description: >
                    Bytes written during the life of the container
                - name: rate
                  type: long
                  description: >
                    Number of current writes per second
                - name: service_time
                  type: long
                  description: >
                    Total time to service IO requests, in nanoseconds
                - name: wait_time
                  type: long
                  description: >
                    Total time requests spent waiting in queues for service, in nanoseconds
                - name: queued
                  type: long
                  description: >
                    Total number of queued requests
            - name: summary
              type: group
              description: >
                Accumulated reads and writes during the life of the container
              fields:
                - name: ops
                  type: long
                  description: >
                    Number of I/O operations during the life of the container
                - name: bytes
                  type: long
                  format: bytes
                  description: >
                    Bytes read and written during the life of the container
                - name: rate
                  type: long
                  description: >
                    Number of current operations per second
                - name: service_time
                  type: long
                  description: >
                    Total time to service IO requests, in nanoseconds
                - name: wait_time
                  type: long
                  description: >
                    Total time requests spent waiting in queues for service, in nanoseconds
                - name: queued
                  type: long
                  description: >
                    Total number of queued requests
        - name: event
          type: group
          description: >
            Docker event
          release: ga
          fields:
            - name: status
              type: keyword
              description: >
                Event status
            - name: id
              type: keyword
              description: >
                Event id when available
            - name: from
              type: keyword
              description: >
                Event source
            - name: type
              type: keyword
              description: >
                The type of object emitting the event
            - name: action
              type: keyword
              description: >
                The type of event
            - name: actor
              type: group
              description: >
                Actor
              fields:
                - name: id
                  type: keyword
                  description: >
                    The ID of the object emitting the event
                - name: attributes
                  type: object
                  object_type: keyword
                  description: >
                    Various key/value attributes of the object, depending on its type
        - name: healthcheck
          type: group
          description: >
            Docker healthcheck metrics.
        
            Healthcheck data will only be available from docker containers where the
            docker `HEALTHCHECK` instruction has been used to build the docker image.
          release: ga
          fields:
            - name: failingstreak
              type: integer
              description: >
                concurent failed check
            - name: status
              type: keyword
              description: >
                Healthcheck status code
            - name: event
              type: group
              description: >
                event fields.
              fields:
                - name: end_date
                  type: date
                  description: >
                    Healthcheck end date
                - name: start_date
                  type: date
                  description: >
                    Healthcheck start date
                - name: output
                  type: keyword
                  description: >
                    Healthcheck output
                - name: exit_code
                  type: integer
                  description: >
                    Healthcheck status code
        - name: image
          type: group
          description: >
            Docker image metrics.
          release: ga
          fields:
            - name: id
              type: group
              description: >
                The image layers identifier.
              fields:
                - name: current
                  type: keyword
                  description: >
                     Unique image identifier given upon its creation.
                - name: parent
                  type: keyword
                  description: >
                     Identifier of the image, if it exists, from which the current image directly descends.
            - name: created
              type: date
              description: >
                Date and time when the image was created.
            - name: size
              type: group
              description: >
                Image size layers.
              fields:
                - name: virtual
                  type: long
                  description: >
                     Size of the image.
                - name: regular
                  type: long
                  description: >
                     Total size of the all cached images associated to the current image.
        
            - name: labels
              type: object
              object_type: keyword
              description: >
                Image labels.
        
            - name: tags
              type: keyword
              description: >
                Image tags.
        - name: info
          type: group
          description: >
            Info metrics based on https://docs.docker.com/engine/reference/api/docker_remote_api_v1.24/#/display-system-wide-information.
          release: ga
          fields:
            - name: containers
              type: group
              description: >
                Overall container stats.
              fields:
                - name: paused
                  type: long
                  description: >
                    Total number of paused containers.
                - name: running
                  type: long
                  description: >
                    Total number of running containers.
                - name: stopped
                  type: long
                  description: >
                    Total number of stopped containers.
                - name: total
                  type: long
                  description: >
                    Total number of existing containers.
            - name: id
              type: keyword
              description: >
                Unique Docker host identifier.
        
            - name: images
              type: long
              description: >
                Total number of existing images.
        - name: memory
          type: group
          description: >
            Memory metrics.
          release: ga
          fields:
            - name: stats.*
              type: object
              object_type: long
              object_type_mapping_type: "*"
              description: >
                Raw memory stats from the cgroups memory.stat interface
            - name: commit
              type: group
              description: >
                Committed bytes on Windows
              fields:
                - name: total
                  type: long
                  format: bytes
                  description: >
                    Total bytes
                - name: peak
                  type: long
                  format: bytes
                  description: >
                    Peak committed bytes on Windows
            - name: private_working_set.total
              type: long
              format: bytes
              description: >
                private working sets on Windows
            - name: fail.count
              type: scaled_float
              description: >
                Fail counter.
            - name: limit
              type: long
              format: bytes
              description: >
                Memory limit.
            - name: rss
              type: group
              description: >
                RSS memory stats.
              fields:
                - name: total
                  type: long
                  format: bytes
                  description: >
                    Total memory resident set size.
                - name: pct
                  type: scaled_float
                  format: percent
                  description: >
                    Memory resident set size percentage.
            - name: usage
              type: group
              description: >
                Usage memory stats.
              fields:
                - name: max
                  type: long
                  format: bytes
                  description: >
                    Max memory usage.
                - name: pct
                  type: scaled_float
                  format: percent
                  description: >
                    Memory usage percentage.
                - name: total
                  type: long
                  format: bytes
                  description: >
                    Total memory usage.
        
        - name: network
          type: group
          description: >
            Network metrics.
          release: ga
          fields:
        
            - name: interface
              type: keyword
              description: >
                Network interface name.
            - name: inbound
              type: group
              description: >
                Incoming network stats since the container started.
              fields:
                - name: bytes
                  type: long
                  format: bytes
                  description: >
                    Total number of incoming bytes.
                - name: dropped
                  type: long
                  description: >
                    Total number of dropped incoming packets.
                - name: errors
                  type: long
                  description: >
                    Total errors on incoming packets.
                - name: packets
                  type: long
                  description: >
                    Total number of incoming packets.
            - name: outbound
              type: group
              description: >
                Outgoing network stats since the container started.
              fields:
                - name: bytes
                  type: long
                  format: bytes
                  description: >
                    Total number of outgoing bytes.
                - name: dropped
                  type: long
                  description: >
                    Total number of dropped outgoing packets.
                - name: errors
                  type: long
                  description: >
                    Total errors on outgoing packets.
                - name: packets
                  type: long
                  description: >
                    Total number of outgoing packets.
        - name: network_summary
          type: group
          release: beta
          description: >
            network_summary
          fields:
            - name: ip.*
              type: object
              description: >
                IP counters
            - name: tcp.*
              type: object
              description: >
                TCP counters
            - name: udp.*
              type: object
              description: >
                UDP counters
            - name: udp_lite.*
              type: object
              description: >
                UDP Lite counters
            - name: icmp.*
              type: object
              description: >
                ICMP counters
            - name: namespace.pid
              type: long
              description: >
                The root PID of the container, corresponding to /proc/[pid]/net
            - name: namespace.id
              type: long
              description: >
                The ID of the network namespace used by the container, corresponding to /proc/[pid]/ns/net
- key: dropwizard
  title: "Dropwizard"
  description: >
    Stats collected from Dropwizard.
  release: ga
  settings: ["ssl", "http"]
  short_config: false
  fields:
    - name: dropwizard
      type: group
      description: >
      fields:
        - release: ga
- key: elasticsearch
  title: "Elasticsearch"
  description: >
    Elasticsearch module
  release: ga
  settings: ["ssl", "http"]
  short_config: false
  fields:
    - name: index_recovery
      type: group
      fields:
        - name: shards.start_time_in_millis
          type: alias
          path: elasticsearch.index.recovery.start_time.ms
        - name: shards.stop_time_in_millis
          type: alias
          path: elasticsearch.index.recovery.stop_time.ms
        - name: shards.total_time_in_millis
          type: alias
          path: elasticsearch.index.recovery.total_time.ms
    - name: stack_stats
      type: group
      fields:
        - name: apm.found
          type: alias
          path: elasticsearch.cluster.stats.stack.apm.found
        - name: xpack.ccr.enabled
          type: alias
          path: elasticsearch.cluster.stats.stack.xpack.ccr.enabled
        - name: xpack.ccr.available
          type: alias
          path: elasticsearch.cluster.stats.stack.xpack.ccr.available
    - name: license
      type: group
      fields:
        - name: status
          type: alias
          path: elasticsearch.cluster.stats.license.status
        - name: type
          type: alias
          path: elasticsearch.cluster.stats.license.type
    - name: shard
      type: group
      fields:
        - name: primary
          type: alias
          path: elasticsearch.shard.primary
        - name: state
          type: alias
          path: elasticsearch.shard.state
        - name: index
          type: alias
          path: elasticsearch.index.name
        - name: node
          type: alias
          path: elasticsearch.node.id
        - name: shard
          type: alias
          path: elasticsearch.shard.number
    - name: cluster_stats
      type: group
      fields:
        - name: indices
          type: group
          fields:
            - name: count
              type: alias
              path: elasticsearch.cluster.stats.indices.total
            - name: shards.total
              type: alias
              path: elasticsearch.cluster.stats.indices.shards.count
        - name: nodes
          type: group
          fields:
            - name: count.total
              type: alias
              path: elasticsearch.cluster.stats.nodes.count
            - name: jvm
              type: group
              fields:
                - name: max_uptime_in_millis
                  type: alias
                  path: elasticsearch.cluster.stats.nodes.jvm.max_uptime.ms
                - name: mem.heap_used_in_bytes
                  type: alias
                  path: elasticsearch.cluster.stats.nodes.jvm.memory.heap.used.bytes
                - name: mem.heap_max_in_bytes
                  type: alias
                  path: elasticsearch.cluster.stats.nodes.jvm.memory.heap.max.bytes
    - name: cluster_state
      type: group
      fields:
        - name: nodes_hash
          type: alias
          path: elasticsearch.cluster.stats.state.nodes_hash
        - name: version
          type: alias
          path: elasticsearch.cluster.stats.state.version
        - name: master_node
          type: alias
          path: elasticsearch.cluster.stats.state.master_node
        - name: state_uuid
          type: alias
          path: elasticsearch.cluster.stats.state.state_uuid
        - name: status
          type: alias
          path: elasticsearch.cluster.stats.status
    - name: timestamp
      type: alias
      path: "@timestamp"
    - name: cluster_uuid
      type: alias
      path: elasticsearch.cluster.id
    - name: source_node
      type: group
      fields:
        - name: uuid
          type: alias
          path: elasticsearch.node.id
        - name: name
          type: alias
          path: elasticsearch.node.name
    - name: job_stats.job_id
      type: alias
      path: elasticsearch.ml.job.id
    - name: job_stats.forecasts_stats.total
      type: alias
      path: elasticsearch.ml.job.forecasts_stats.total
    - name: index_stats
      type: group
      fields:
        - name: index
          path: elasticsearch.index.name
          type: alias
        - name: primaries
          type: group
          fields:
            - name: store.size_in_bytes
              type: alias
              path: elasticsearch.index.primaries.store.size_in_bytes
            - name: docs.count
              type: alias
              path: elasticsearch.index.primaries.docs.count
            - name: segments.count
              type: alias
              path: elasticsearch.index.primaries.segments.count
            - name: refresh.total_time_in_millis
              type: alias
              path: elasticsearch.index.primaries.refresh.total_time_in_millis
            - name: merges.total_size_in_bytes
              type: alias
              path: elasticsearch.index.primaries.merges.total_size_in_bytes
            - name: indexing
              type: group
              fields:
                - name: index_total
                  type: alias
                  path: elasticsearch.index.primaries.indexing.index_total
                - name: index_time_in_millis
                  type: alias
                  path: elasticsearch.index.primaries.indexing.index_time_in_millis
                - name: throttle_time_in_millis
                  type: alias
                  path: elasticsearch.index.primaries.indexing.throttle_time_in_millis
        - name: total
          type: group
          fields:
            - name: query_cache.memory_size_in_bytes
              type: alias
              path: elasticsearch.index.total.query_cache.memory_size_in_bytes
            - name: fielddata.memory_size_in_bytes
              type: alias
              path: elasticsearch.index.total.fielddata.memory_size_in_bytes
            - name: request_cache.memory_size_in_bytes
              type: alias
              path: elasticsearch.index.total.request_cache.memory_size_in_bytes
            - name: merges.total_size_in_bytes
              type: alias
              path: elasticsearch.index.total.merges.total_size_in_bytes
            - name: refresh.total_time_in_millis
              type: alias
              path: elasticsearch.index.total.refresh.total_time_in_millis
            - name: store.size_in_bytes
              type: alias
              path: elasticsearch.index.total.store.size_in_bytes
            - name: indexing
              type: group
              fields:
                - name: index_total
                  type: alias
                  path: elasticsearch.index.total.indexing.index_total
                - name: index_time_in_millis
                  type: alias
                  path: elasticsearch.index.total.indexing.index_time_in_millis
                - name: throttle_time_in_millis
                  type: alias
                  path: elasticsearch.index.total.indexing.throttle_time_in_millis
            - name: search
              type: group
              fields:
                - name: query_total
                  type: alias
                  path: elasticsearch.index.total.search.query_total
                - name: query_time_in_millis
                  type: alias
                  path: elasticsearch.index.total.search.query_time_in_millis
            - name: segments
              type: group
              fields:
                - name: terms_memory_in_bytes
                  type: alias
                  path: elasticsearch.index.total.segments.terms_memory_in_bytes
                - name: points_memory_in_bytes
                  type: alias
                  path: elasticsearch.index.total.segments.points_memory_in_bytes
                - name: count
                  type: alias
                  path: elasticsearch.index.total.segments.count
                - name: doc_values_memory_in_bytes
                  type: alias
                  path: elasticsearch.index.total.segments.doc_values_memory_in_bytes
                - name: norms_memory_in_bytes
                  type: alias
                  path: elasticsearch.index.total.segments.norms_memory_in_bytes
                - name: stored_fields_memory_in_bytes
                  type: alias
                  path: elasticsearch.index.total.segments.stored_fields_memory_in_bytes
                - name: fixed_bit_set_memory_in_bytes
                  type: alias
                  path: elasticsearch.index.total.segments.fixed_bit_set_memory_in_bytes
                - name: term_vectors_memory_in_bytes
                  type: alias
                  path: elasticsearch.index.total.segments.term_vectors_memory_in_bytes
                - name: version_map_memory_in_bytes
                  type: alias
                  path: elasticsearch.index.total.segments.version_map_memory_in_bytes
                - name: index_writer_memory_in_bytes
                  type: alias
                  path: elasticsearch.index.total.segments.index_writer_memory_in_bytes
                - name: memory_in_bytes
                  type: alias
                  path: elasticsearch.index.total.segments.memory_in_bytes

    - name: ccr_auto_follow_stats
      type: group
      fields:
        - name: number_of_failed_follow_indices
          type: alias
          path: elasticsearch.ccr.auto_follow.failed.follow_indices.count
        - name: number_of_failed_remote_cluster_state_requests
          type: alias
          path: elasticsearch.ccr.auto_follow.failed.remote_cluster_state_requests.count
        - name: number_of_successful_follow_indices
          type: alias
          path: elasticsearch.ccr.auto_follow.success.follow_indices.count
        - name: follower.failed_read_requests
          type: alias
          path: elasticsearch.ccr.requests.failed.read.count
    - name: ccr_stats
      type: group
      fields:
        - name: shard_id
          type: alias
          path: elasticsearch.ccr.follower.shard.number
        - name: remote_cluster
          type: alias
          path: elasticsearch.ccr.remote_cluster
        - name: leader_index
          type: alias
          path: elasticsearch.ccr.leader.index
        - name: follower_index
          type: alias
          path: elasticsearch.ccr.follower.index
        - name: leader_global_checkpoint
          type: alias
          path: elasticsearch.ccr.leader.global_checkpoint
        - name: leader_max_seq_no
          type: alias
          path: elasticsearch.ccr.leader.max_seq_no
        - name: follower_global_checkpoint
          type: alias
          path: elasticsearch.ccr.follower.global_checkpoint
        - name: follower_max_seq_no
          type: alias
          path: elasticsearch.ccr.follower.max_seq_no
        - name: last_requested_seq_no
          type: alias
          path: elasticsearch.ccr.last_requested_seq_no
        - name: outstanding_read_requests
          type: alias
          path: elasticsearch.ccr.requests.outstanding.read.count
        - name: outstanding_write_requests
          type: alias
          path: elasticsearch.ccr.requests.outstanding.write.count
        - name: write_buffer_operation_count
          type: alias
          path: elasticsearch.ccr.write_buffer.operation.count
        - name: write_buffer_size_in_bytes
          type: alias
          path: elasticsearch.ccr.write_buffer.size.bytes
        - name: follower_mapping_version
          type: alias
          path: elasticsearch.ccr.follower.mapping_version
        - name: follower_settings_version
          type: alias
          path: elasticsearch.ccr.follower.settings_version
        - name: follower_aliases_version
          type: alias
          path: elasticsearch.ccr.follower.aliases_version
        - name: total_read_time_millis
          type: alias
          path: elasticsearch.ccr.total_time.read.ms
        - name: total_read_remote_exec_time_millis
          type: alias
          path: elasticsearch.ccr.total_time.read.remote_exec.ms
        - name: successful_read_requests
          type: alias
          path: elasticsearch.ccr.requests.successful.read.count
        - name: failed_read_requests
          type: alias
          path: elasticsearch.ccr.requests.failed.read.count
        - name: operations_read
          type: alias
          path: elasticsearch.ccr.follower.operations.read.count
        - name: operations_written
          type: alias
          path: elasticsearch.ccr.follower.operations_written
        - name: bytes_read
          type: alias
          path: elasticsearch.ccr.bytes_read
        - name: total_write_time_millis
          type: alias
          path: elasticsearch.ccr.total_time.write.ms
        - name: successful_write_requests
          type: alias
          path: elasticsearch.ccr.requests.successful.write.count
        - name: failed_write_requests
          type: alias
          path: elasticsearch.ccr.requests.failed.write.count

    - name: node_stats
      type: group
      fields:
        - name: fs
          type: group
          fields:
            - name: total
              type: group
              fields:
                - name: available_in_bytes
                  path: elasticsearch.node.stats.fs.summary.available.bytes
                  type: alias
                - name: total_in_bytes
                  path: elasticsearch.node.stats.fs.summary.total.bytes
                  type: alias
            - name: summary
              type: group
              fields:
                - name: available.bytes
                  path: elasticsearch.node.stats.fs.summary.available.bytes
                  type: alias
                - name: total.bytes
                  path: elasticsearch.node.stats.fs.summary.total.bytes
                  type: alias
            - name: io_stats
              type: group
              fields:
                - name: total
                  type: group
                  fields:
                    - name: operations
                      path: elasticsearch.node.stats.fs.io_stats.total.operations.count
                      type: alias
                    - name: read_operations
                      path: elasticsearch.node.stats.fs.io_stats.total.read.operations.count
                      type: alias
                    - name: write_operations
                      path: elasticsearch.node.stats.fs.io_stats.total.write.operations.count
                      type: alias
        - name: indices
          type: group
          fields:
            - name: store
              type: group
              fields:
                - name: size_in_bytes
                  type: alias
                  path: elasticsearch.node.stats.indices.store.size.bytes
                - name: size.bytes
                  type: alias
                  path: elasticsearch.node.stats.indices.store.size.bytes
            - name: docs.count
              type: alias
              path: elasticsearch.node.stats.indices.docs.count
            - name: indexing
              type: group
              fields:
                - name: index_time_in_millis
                  path: elasticsearch.node.stats.indices.indexing.index_time.ms
                  type: alias
                - name: index_total
                  path: elasticsearch.node.stats.indices.indexing.index_total.count
                  type: alias
                - name: throttle_time_in_millis
                  path: elasticsearch.node.stats.indices.indexing.throttle_time.ms
                  type: alias
            - name: fielddata
              type: group
              fields:
                - name: memory_size_in_bytes
                  path: elasticsearch.node.stats.indices.fielddata.memory.bytes
                  type: alias
            - name: query_cache
              type: group
              fields:
                - name: memory_size_in_bytes
                  path: elasticsearch.node.stats.indices.query_cache.memory.bytes
                  type: alias
            - name: request_cache
              type: group
              fields:
                - name: memory_size_in_bytes
                  path: elasticsearch.node.stats.indices.request_cache.memory.bytes
                  type: alias
            - name: search
              type: group
              fields:
                - name: query_time_in_millis
                  path: elasticsearch.node.stats.indices.search.query_time.ms
                  type: alias
                - name: query_total
                  path: elasticsearch.node.stats.indices.search.query_total.count
                  type: alias
            - name: segments
              type: group
              fields:
                - name: count
                  path: elasticsearch.node.stats.indices.segments.count
                  type: alias
                - name: doc_values_memory_in_bytes
                  path: elasticsearch.node.stats.indices.segments.doc_values.memory.bytes
                  type: alias
                - name: fixed_bit_set_memory_in_bytes
                  path: elasticsearch.node.stats.indices.segments.fixed_bit_set.memory.bytes
                  type: alias
                - name: index_writer_memory_in_bytes
                  path: elasticsearch.node.stats.indices.segments.index_writer.memory.bytes
                  type: alias
                - name: memory_in_bytes
                  path: elasticsearch.node.stats.indices.segments.memory.bytes
                  type: alias
                - name: norms_memory_in_bytes
                  path: elasticsearch.node.stats.indices.segments.norms.memory.bytes
                  type: alias
                - name: points_memory_in_bytes
                  path: elasticsearch.node.stats.indices.segments.points.memory.bytes
                  type: alias
                - name: stored_fields_memory_in_bytes
                  path: elasticsearch.node.stats.indices.segments.stored_fields.memory.bytes
                  type: alias
                - name: term_vectors_memory_in_bytes
                  path: elasticsearch.node.stats.indices.segments.term_vectors.memory.bytes
                  type: alias
                - name: terms_memory_in_bytes
                  path: elasticsearch.node.stats.indices.segments.terms.memory.bytes
                  type: alias
                - name: version_map_memory_in_bytes
                  path: elasticsearch.node.stats.indices.segments.version_map.memory.bytes
                  type: alias
        - name: jvm
          type: group
          fields:
            - name: gc
              type: group
              fields:
                - name: collectors
                  type: group
                  fields:
                    - name: old
                      type: group
                      fields:
                        - name: collection_count
                          path: elasticsearch.node.stats.jvm.gc.collectors.old.collection.count
                          type: alias
                        - name: collection_time_in_millis
                          path: elasticsearch.node.stats.jvm.gc.collectors.old.collection.ms
                          type: alias
                    - name: young
                      type: group
                      fields:
                        - name: collection_count
                          path: elasticsearch.node.stats.jvm.gc.collectors.young.collection.count
                          type: alias
                        - name: collection_time_in_millis
                          path: elasticsearch.node.stats.jvm.gc.collectors.young.collection.ms
                          type: alias
            - name: mem
              type: group
              fields:
                - name: heap_max_in_bytes
                  path: elasticsearch.node.stats.jvm.mem.heap.max.bytes
                  type: alias
                - name: heap_used_in_bytes
                  path: elasticsearch.node.stats.jvm.mem.heap.used.bytes
                  type: alias
                - name: heap_used_percent
                  path: elasticsearch.node.stats.jvm.mem.heap.used.pct
                  type: alias
        - name: node_id
          path: elasticsearch.node.id
          type: alias
        - name: os
          type: group
          fields:
            - name: cpu
              type: group
              fields:
                - name: load_average
                  type: group
                  fields:
                    - name: 1m
                      path: elasticsearch.node.stats.os.cpu.load_avg.1m
                      type: alias
            - name: cgroup
              type: group
              fields:
                - name: cpuacct
                  type: group
                  fields:
                    - name: usage_nanos
                      path: elasticsearch.node.stats.os.cgroup.cpuacct.usage.ns
                      type: alias
                - name: cpu
                  type: group
                  fields:
                    - name: cfs_quota_micros
                      path: elasticsearch.node.stats.os.cgroup.cpu.cfs.quota.us
                      type: alias
                    - name: stat
                      type: group
                      fields:
                        - name: number_of_elapsed_periods
                          path: elasticsearch.node.stats.os.cgroup.cpu.stat.elapsed_periods.count
                          type: alias
                        - name: number_of_times_throttled
                          path: elasticsearch.node.stats.os.cgroup.cpu.stat.times_throttled.count
                          type: alias
                        - name: time_throttled_nanos
                          path: elasticsearch.node.stats.os.cgroup.cpu.stat.time_throttled.ns
                          type: alias
                - name: memory
                  type: group
                  fields:
                    - name: control_group
                      path: elasticsearch.node.stats.os.cgroup.memory.control_group
                      type: alias
                    - name: limit_in_bytes
                      path: elasticsearch.node.stats.os.cgroup.memory.limit.bytes
                      type: alias
                    - name: usage_in_bytes
                      path: elasticsearch.node.stats.os.cgroup.memory.usage.bytes
                      type: alias
        - name: process
          type: group
          fields:
            - name: cpu
              type: group
              fields:
                - name: percent
                  path: elasticsearch.node.stats.process.cpu.pct
                  type: alias
        - name: thread_pool
          type: group
          fields:
            - name: bulk
              type: group
              fields:
                - name: queue
                  path: elasticsearch.node.stats.thread_pool.bulk.queue.count
                  type: alias
                - name: rejected
                  path: elasticsearch.node.stats.thread_pool.bulk.rejected.count
                  type: alias
            - name: get
              type: group
              fields:
                - name: queue
                  path: elasticsearch.node.stats.thread_pool.get.queue.count
                  type: alias
                - name: rejected
                  path: elasticsearch.node.stats.thread_pool.get.rejected.count
                  type: alias
            - name: index
              type: group
              fields:
                - name: queue
                  path: elasticsearch.node.stats.thread_pool.index.queue.count
                  type: alias
                - name: rejected
                  path: elasticsearch.node.stats.thread_pool.index.rejected.count
                  type: alias
            - name: search
              type: group
              fields:
                - name: queue
                  path: elasticsearch.node.stats.thread_pool.search.queue.count
                  type: alias
                - name: rejected
                  path: elasticsearch.node.stats.thread_pool.search.rejected.count
                  type: alias
            - name: write
              type: group
              fields:
                - name: queue
                  path: elasticsearch.node.stats.thread_pool.write.queue.count
                  type: alias
                - name: rejected
                  path: elasticsearch.node.stats.thread_pool.write.rejected.count
                  type: alias
    - name: indices_stats
      type: group
      fields:
        - name: _all
          type: group
          fields:
            - name: primaries
              type: group
              fields:
                - name: indexing
                  type: group
                  fields:
                    - name: index_total
                      type: alias
                      path: elasticsearch.index.summary.primaries.indexing.index.count
                    - name: index_time_in_millis
                      type: alias
                      path: elasticsearch.index.summary.primaries.indexing.index.time.ms
            - name: total
              type: group
              fields:
                - name: search
                  type: group
                  fields:
                    - name: query_total
                      type: alias
                      path: elasticsearch.index.summary.total.search.query.count
                    - name: query_time_in_millis
                      type: alias
                      path: elasticsearch.index.summary.total.search.query.time.ms
                - name: indexing
                  type: group
                  fields:
                    - name: index_total
                      type: alias
                      path: elasticsearch.index.summary.total.indexing.index.count
    - name: elasticsearch
      type: group
      fields:
        - name: cluster.name
          type: keyword
          description: >
            Elasticsearch cluster name.
        - name: cluster.id
          type: keyword
          description: >
            Elasticsearch cluster id.
        - name: cluster.state.id
          type: keyword
          description: >
            Elasticsearch state id.
        - name: node
          type: group
          fields:
            - name: id
              type: keyword
              description: >
                Node ID
            - name: name
              type: keyword
              description: >
                Node name.
            - name: roles
              type: keyword
              description: >
                Node roles.
            - name: master
              type: boolean
              description: >
                Is the node the master node?
            - name: mlockall
              type: boolean
              description: >
                Is mlockall enabled on the node?
        - name: ccr
          type: group
          description: >
            Cross-cluster replication stats
          release: ga
          fields:
            - name: remote_cluster
              type: keyword
            - name: bytes_read
              type: long
            - name: last_requested_seq_no
              type: long
            - name: shard_id
              type: integer
        
            - name: total_time
              type: group
              fields:
                - name: read.ms
                  type: long
                - name: read.remote_exec.ms
                  type: long
                - name: write.ms
                  type: long
        
            - name: read_exceptions
              type: nested
            - name: requests
              type: group
              fields:
                - name: successful
                  type: group
                  fields:
                    - name: read.count
                      type: long
                    - name: write.count
                      type: long
                - name: failed
                  type: group
                  fields:
                    - name: read.count
                      type: long
                    - name: write.count
                      type: long
                - name: outstanding
                  type: group
                  fields:
                    - name: read.count
                      type: long
                    - name: write.count
                      type: long
        
            - name: write_buffer
              type: group
              fields:
                - name: size.bytes
                  type: long
                - name: operation.count
                  type: long
        
            - name: auto_follow
              type: group
              fields:
                - name: failed
                  type: group
                  fields:
                    - name: follow_indices.count
                      type: long
                    - name: remote_cluster_state_requests.count
                      type: long
                - name: success
                  type: group
                  fields:
                    - name: follow_indices.count
                      type: long
        
            - name: leader
              type: group
              fields:
                - name: index
                  type: keyword
                  description: >
                    Name of leader index
                - name: max_seq_no
                  type: long
                  description: >
                    Maximum sequence number of operation on the leader shard
                - name: global_checkpoint
                  type: long
        
            - name: follower
              type: group
              fields:
                - name: index
                  type: keyword
                  description: >
                    Name of follower index
                - name: shard.number
                  type: long
                  description: >
                    Number of the shard within the index
                - name: operations_written
                  type: long
                  description: >
                    Number of operations indexed (replicated) into the follower shard from the leader shard
                - name: time_since_last_read.ms
                  type: long
                  description: >
                    Time, in ms, since the follower last fetched from the leader
                - name: global_checkpoint
                  type: long
                  description: >
                    Global checkpoint value on follower shard
                - name: max_seq_no
                  type: long
                  description: >
                    Maximum sequence number of operation on the follower shard
                - name: mapping_version
                  type: long
                - name: settings_version
                  type: long
                - name: aliases_version
                  type: long
                - name: operations.read.count
                  type: long
        - name: cluster.stats
          type: group
          description: >
            Cluster stats
          release: ga
          fields:
            - name: version
              type: keyword
            - name: state
              type: group
              fields:
                - name: nodes_hash
                  type: keyword
                - name: master_node
                  type: keyword
                - name: version
                  type: keyword
                - name: state_uuid
                  type: keyword
                - name: nodes
                  type: flattened
            - name: status
              type: keyword
              description: Cluster status (green, yellow, red).
            - name: nodes
              type: group
              description: Nodes statistics.
              fields:
              - name: fs.total.bytes
                type: long
              - name: fs.available.bytes
                type: long
              - name: count
                type: long
                description: Total number of nodes in cluster.
              - name: master
                type: long
                description: Number of master-eligible nodes in cluster.
              - name: data
                type: long
                description: Number of data nodes in cluster.
              - name: jvm
                type: group
                fields:
                  - name: max_uptime.ms
                    type: long
                  - name: memory.heap.max.bytes
                    type: long
                  - name: memory.heap.used.bytes
                    type: long
            - name: indices
              type: group
              description: >
                Indices statistics.
              fields:
              - name: store.size.bytes
                type: long
              - name: total
                type: long
                description: >
                  Total number of indices in cluster.
              - name: shards
                type: group
                description: >
                  Shard statistics.
                fields:
                - name: docs.total
                  type: long
                - name: count
                  type: long
                  description: >
                    Total number of shards in cluster.
                - name: primaries
                  type: long
                  description: >
                    Total number of primary shards in cluster.
              - name: fielddata.memory.bytes
                type: long
                description: >
                  Memory used for fielddata.
            - name: license
              type: group
              fields:
              - name: expiry_date_in_millis
                type: long
              - name: status
                type: keyword
              - name: type
                type: keyword
            - name: stack
              type: group
              fields:
                - name: apm.found
                  type: boolean
                - name: xpack.ccr.available
                  type: boolean
                - name: xpack.ccr.enabled
                  type: boolean
        - name: enrich
          type: group
          description: >
            Enrich stats
          release: ga
          fields:
            - name: executing_policy
              type: group
              fields:
                - name: name
                  type: keyword
                - name: task
                  type: group
                  fields:
                  - name: id
                    type: long
                  - name: task
                    type: keyword
                  - name: action
                    type: keyword
                  - name: cancellable
                    type: boolean
                  - name: parent_task_id
                    type: keyword
                  - name: time
                    type: group
                    fields:
                      - name: start.ms
                        type: long
                      - name: running.nano
                        type: long
            - name: queue.size
              type: long
              description: >
                Number of search requests in the queue.
            - name: executed_searches.total
              type: long
              description: >
                Number of search requests that enrich processors have executed since node startup.
            - name: remote_requests
              type: group
              fields:
                - name: current
                  type: long
                  description: >
                    Current number of outstanding remote requests.
                - name: total
                  type: long
                  description: >
                    Number of outstanding remote requests executed since node startup.
        - name: index
          type: group
          description: >
            index
          release: ga
          fields:
            - name: created
              type: long
            - name: hidden
              type: boolean
            - name: shards
              type: group
              fields:
                - name: total
                  type: long
                - name: primaries
                  type: long
            - name: uuid
              type: keyword
            - name: status
              type: keyword
            - name: name
              type: keyword
              description: >
                Index name.
            - name: primaries
              type: group
              fields:
                - name: search
                  type: group
                  fields:
                    - name: query_total
                      type: long
                    - name: query_time_in_millis
                      type: long
                - name: request_cache
                  type: group
                  fields:
                    - name: memory_size_in_bytes
                      type: long
                    - name: evictions
                      type: long
                    - name: hit_count
                      type: long
                    - name: miss_count
                      type: long
                - name: query_cache
                  type: group
                  fields:
                    - name: memory_size_in_bytes
                      type: long
                    - name: hit_count
                      type: long
                    - name: miss_count
                      type: long
                - name: store.size_in_bytes
                  type: long
                - name: docs.count
                  type: long
                - name: docs.deleted
                  type: long
                - name: segments
                  type: group
                  fields:
                    - name: count
                      type: long
                    - name: memory_in_bytes
                      type: long
                    - name: terms_memory_in_bytes
                      type: long
                    - name: stored_fields_memory_in_bytes
                      type: long
                    - name: term_vectors_memory_in_bytes
                      type: long
                    - name: norms_memory_in_bytes
                      type: long
                    - name: points_memory_in_bytes
                      type: long
                    - name: doc_values_memory_in_bytes
                      type: long
                    - name: index_writer_memory_in_bytes
                      type: long
                    - name: version_map_memory_in_bytes
                      type: long
                    - name: fixed_bit_set_memory_in_bytes
                      type: long
                - name: refresh.total_time_in_millis
                  type: long
                - name: refresh.external_total_time_in_millis
                  type: long
                - name: merges.total_size_in_bytes
                  type: long
                - name: indexing
                  type: group
                  fields:
                    - name: index_total
                      type: long
                    - name: index_time_in_millis
                      type: long
                    - name: throttle_time_in_millis
                      type: long
            - name: total
              type: group
              fields:
                - name: docs.count
                  type: long
                  description: >
                    Total number of documents in the index.
                - name: docs.deleted
                  type: long
                  description: >
                    Total number of deleted documents in the index.
                - name: store.size_in_bytes
                  format: bytes
                  type: long
                  description: >
                      Total size of the index in bytes.
                - name: query_cache
                  type: group
                  fields:
                  - name: memory_size_in_bytes
                    type: long
                  - name: evictions
                    type: long
                  - name: hit_count
                    type: long
                  - name: miss_count
                    type: long
                - name: fielddata.memory_size_in_bytes
                  type: long
                - name: fielddata.evictions
                  type: long
                - name: request_cache
                  type: group
                  fields:
                    - name: memory_size_in_bytes
                      type: long
                    - name: evictions
                      type: long
                    - name: hit_count
                      type: long
                    - name: miss_count
                      type: long
                - name: merges.total_size_in_bytes
                  type: long
                - name: refresh.total_time_in_millis
                  type: long
                - name: refresh.external_total_time_in_millis
                  type: long
                - name: segments
                  type: group
                  fields:
                    - name: memory_in_bytes
                      type: long
                      format: bytes
                      description: >
                        Total number of memory used by the segments in bytes.
                    - name: terms_memory_in_bytes
                      type: long
                    - name: points_memory_in_bytes
                      type: long
                    - name: count
                      type: long
                      description: >
                        Total number of index segments.
                    - name: doc_values_memory_in_bytes
                      type: long
                    - name: norms_memory_in_bytes
                      type: long
                    - name: stored_fields_memory_in_bytes
                      type: long
                    - name: fixed_bit_set_memory_in_bytes
                      type: long
                    - name: term_vectors_memory_in_bytes
                      type: long
                    - name: version_map_memory_in_bytes
                      type: long
                    - name: index_writer_memory_in_bytes
                      type: long
                - name: search
                  type: group
                  fields:
                    - name: query_total
                      type: long
                    - name: query_time_in_millis
                      type: long
                - name: indexing
                  type: group
                  fields:
                    - name: index_total
                      type: long
                    - name: index_time_in_millis
                      type: long
                    - name: throttle_time_in_millis
                      type: long
                - name: bulk
                  type: group
                  fields:
                    - name: total_size_in_bytes
                      type: long
                    - name: avg_size_in_bytes
                      type: long
                    - name: avg_time_in_millis
                      type: long
                    - name: total_operations
                      type: long
                    - name: total_time_in_millis
                      type: long
        - name: index.recovery
          type: group
          description: >
            index
          release: ga
          fields:
            - name: index
              type: group
              fields:
                - name: files
                  type: group
                  fields:
                    - name: percent
                      type: keyword
                    - name: recovered
                      type: long
                    - name: reused
                      type: long
                    - name: total
                      type: long
                - name: size
                  type: group
                  fields:
                    - name: recovered_in_bytes
                      type: long
                    - name: reused_in_bytes
                      type: long
                    - name: total_in_bytes
                      type: long
            - name: name
              type: keyword
            - name: total_time.ms
              type: long
            - name: stop_time.ms
              type: long
            - name: start_time.ms
              type: long
            - name: id
              type: long
              description: >
                Shard recovery id.
            - name: type
              type: keyword
              description: >
                Shard recovery type.
            - name: primary
              type: boolean
              description: >
                True if primary shard.
            - name: stage
              type: keyword
              description: >
                Recovery stage.
            - name: translog
              type: group
              fields:
                - name: percent
                  type: keyword
                - name: total
                  type: long
                - name: total_on_start
                  type: long
            - name: target.transport_address
              type: keyword
            - name: target.id
              type: keyword
              description: >
                Target node id.
            - name: target.host
              type: keyword
              description: >
                Target node host address (could be IP address or hostname).
            - name: target.name
              type: keyword
              description: >
                Target node name.
        
            - name: source.transport_address
              type: keyword
            - name: source.id
              type: keyword
              description: >
                Source node id.
            - name: source.host
              type: keyword
              description: >
                Source node host address (could be IP address or hostname).
            - name: source.name
              type: keyword
              description: >
                Source node name.
            - name: verify_index
              type: group
              fields:
                - name: check_index_time.ms
                  type: long
                - name: total_time.ms
                  type: long
        - name: index.summary
          type: group
          description: >
            index
          release: ga
          fields:
            - name: primaries
              type: group
              fields:
                - name: docs.count
                  type: long
                  description: >
                    Total number of documents in the index.
                - name: docs.deleted
                  type: long
                  description: >
                    Total number of deleted documents in the index.
                - name: store.size.bytes
                  type: long
                  format: bytes
                  description: >
                    Total size of the index in bytes.
                - name: segments.count
                  type: long
                  description: >
                    Total number of index segments.
                - name: segments.memory.bytes
                  type: long
                  format: bytes
                  description: >
                    Total number of memory used by the segments in bytes.
                - name: indexing
                  type: group
                  fields:
                    - name: index.count
                      type: long
                    - name: index.time.ms
                      type: long
                - name: search
                  type: group
                  fields:
                    - name: query
                      type: group
                      fields:
                        - name: count
                          type: long
                        - name: time.ms
                          type: long
                - name: bulk
                  type: group
                  fields:
                    - name: operations.count
                      type: long
                    - name: size.bytes
                      type: long
                    - name: time
                      type: group
                      fields:
                        - name: count.ms
                          type: long
                        - name: avg.ms
                          type: long
                        - name: avg.bytes
                          type: long
            - name: total
              type: group
              fields:
                - name: docs.count
                  type: long
                  description: >
                    Total number of documents in the index.
                - name: docs.deleted
                  type: long
                  description: >
                    Total number of deleted documents in the index.
                - name: store.size.bytes
                  type: long
                  format: bytes
                  description: >
                    Total size of the index in bytes.
                - name: segments.count
                  type: long
                  description: >
                    Total number of index segments.
                - name: segments.memory.bytes
                  type: long
                  format: bytes
                  description: >
                    Total number of memory used by the segments in bytes.
                - name: indexing
                  type: group
                  fields:
                    - name: index.count
                      type: long
                    - name: is_throttled
                      type: boolean
                    - name: throttle_time.ms
                      type: long
                    - name: index.time.ms
                      type: long
                - name: search
                  type: group
                  fields:
                    - name: query
                      type: group
                      fields:
                        - name: count
                          type: long
                        - name: time.ms
                          type: long
                - name: bulk
                  type: group
                  fields:
                    - name: operations.count
                      type: long
                    - name: size.bytes
                      type: long
                    - name: time
                      type: group
                      fields:
                        - name: avg.ms
                          type: long
                        - name: avg.bytes
                          type: long
        - name: ingest_pipeline
          type: group
          release: beta
          description: Runtime metrics on ingest pipeline execution
          fields:
            - name: name
              type: wildcard
              description: Name / id of the ingest pipeline
            - name: total
              type: group
              description: Metrics on the total ingest pipeline execution, including all processors.
              fields:
                - name: count
                  type: long
                  description: Number of documents processed by this pipeline
                - name: failed
                  type: long
                  description: Number of documented failed to process by this pipeline
                - name: time.total.ms
                  type: long
                  description: Total time spent processing documents through this pipeline, inclusive of other pipelines called
                - name: time.self.ms
                  type: long
                  description: Time spent processing documents through this pipeline, exclusive of other pipelines called
            - name: processor
              type: group
              fields:
                - name: type
                  type: keyword
                  description: The type of ingest processor
                - name: type_tag
                  type: keyword
                  description: The type and the tag for this processor in the format "<type>:<tag>"
                - name: order_index
                  type: long
                  description: The order this processor appears in the pipeline definition
                - name: count
                  type: long
                  description: Number of documents processed by this processor
                - name: failed
                  type: long
                  description: Number of documented failed to process by this processor
                - name: time.total.ms
                  type: long
                  description: Total time spent processing documents through this processor
        - name: ml.job
          type: group
          description: >
            ml
          release: ga
          fields:
            - name: id
              type: keyword
              description: >
                Unique ml job id.
            - name: state
              type: keyword
              description: >
                Job state.
            - name: forecasts_stats.total
              type: long
            - name: model_size
              type: group
              fields:
                - name: memory_status
                  type: keyword
            - name: data_counts
              type: group
              fields:
                - name: invalid_date_count
                  type: long
                - name: processed_record_count
                  type: long
                  description: Processed data events.
            - name: data.invalid_date.count
              type: long
              description: >
                The number of records with either a missing date field or a date that could not be parsed.
        
        
        - name: node
          type: group
          description: >
            node
          release: ga
          fields:
            - name: version
              type: keyword
              description: >
                Node version.
            - name: jvm
              type: group
              description: >
                JVM Info.
              fields:
                - name: version
                  type: keyword
                  description: >
                    JVM version.
                - name: memory.heap.init.bytes
                  type: long
                  format: bytes
                  description: >
                    Heap init used by the JVM in bytes.
                - name: memory.heap.max.bytes
                  type: long
                  format: bytes
                  description: >
                    Heap max used by the JVM in bytes.
                - name: memory.nonheap.init.bytes
                  type: long
                  format: bytes
                  description: >
                    Non-Heap init used by the JVM in bytes.
                - name: memory.nonheap.max.bytes
                  type: long
                  format: bytes
                  description: >
                    Non-Heap max used by the JVM in bytes.
            - name: process.mlockall
              type: boolean
              description: >
                If process locked in memory.
        - name: node.stats
          type: group
          description: >
            Statistics about each node in a Elasticsearch cluster
          release: ga
          fields:
            - name: ingest
              type: group
              fields:
                - name: total
                  type: group
                  fields:
                    - name: count
                      type: long
                    - name: time_in_millis
                      type: long
                    - name: current
                      type: long
                    - name: failed
                      type: long
            - name: indices
              type: group
              fields:
                - name: bulk
                  type: group
                  fields:
                    - name: avg_time
                      type: group
                      fields:
                        - name: ms
                          type: long
                    - name: total_time
                      type: group
                      fields:
                        - name: ms
                          type: long
                    - name: total_size
                      type: group
                      fields:
                        - name: bytes
                          type: long
                    - name: avg_size
                      type: group
                      fields:
                        - name: bytes
                          type: long
                    - name: operations.total.count
                      type: long
                - name: docs.count
                  type: long
                  description: >
                    Total number of existing documents.
                - name: docs.deleted
                  type: long
                  description: >
                    Total number of deleted documents.
                - name: segments.count
                  type: long
                  description: >
                    Total number of segments.
                - name: segments.memory.bytes
                  type: long
                  format: bytes
                  description: >
                    Total size of segments in bytes.
                - name: store.size.bytes
                  type: long
                  description: >
                    Total size of the store in bytes.
                - name: fielddata
                  type: group
                  fields:
                    - name: memory.bytes
                      type: long
                      format: bytes
                - name: indexing
                  type: group
                  fields:
                    - name: index_time.ms
                      type: long
                    - name: index_total.count
                      type: long
                    - name: throttle_time.ms
                      type: long
                - name: query_cache
                  type: group
                  fields:
                    - name: memory.bytes
                      type: long
                      format: bytes
                - name: request_cache
                  type: group
                  fields:
                    - name: memory.bytes
                      type: long
                      format: bytes
                - name: search
                  type: group
                  fields:
                    - name: query_time.ms
                      type: long
                    - name: query_total.count
                      type: long
                - name: segments
                  type: group
                  fields:
                    - name: doc_values.memory.bytes
                      type: long
                      format: bytes
                    - name: fixed_bit_set.memory.bytes
                      type: long
                      format: bytes
                    - name: index_writer.memory.bytes
                      type: long
                      format: bytes
                    - name: norms.memory.bytes
                      type: long
                      format: bytes
                    - name: points.memory.bytes
                      type: long
                      format: bytes
                    - name: stored_fields.memory.bytes
                      type: long
                      format: bytes
                    - name: term_vectors.memory.bytes
                      type: long
                      format: bytes
                    - name: terms.memory.bytes
                      type: long
                      format: bytes
                    - name: version_map.memory.bytes
                      type: long
                      format: bytes
            - name: jvm.mem.heap
              type: group
              fields:
                - name: max.bytes
                  type: long
                  format: bytes
                - name: used
                  type: group
                  fields:
                    - name: bytes
                      type: long
                      format: bytes
                    - name: pct
                      type: double
                      format: percent
            - name: jvm.mem.pools
              type: group
              fields:
                - name: old
                  type: group
                  fields:
                    - name: max.bytes
                      type: long
                      format: bytes
                      description: >
                        Max bytes.
                    - name: peak.bytes
                      type: long
                      format: bytes
                      description: >
                        Peak bytes.
                    - name: peak_max.bytes
                      type: long
                      format: bytes
                      description: >
                        Peak max bytes.
                    - name: used.bytes
                      type: long
                      format: bytes
                      description: >
                        Used bytes.
                - name: young
                  type: group
                  fields:
                    - name: max.bytes
                      type: long
                      format: bytes
                      description: >
                        Max bytes.
                    - name: peak.bytes
                      type: long
                      format: bytes
                      description: >
                        Peak bytes.
                    - name: peak_max.bytes
                      type: long
                      format: bytes
                      description: >
                        Peak max bytes.
                    - name: used.bytes
                      type: long
                      format: bytes
                      description: >
                        Used bytes.
                - name: survivor
                  type: group
                  fields:
                    - name: max.bytes
                      type: long
                      format: bytes
                      description: >
                        Max bytes.
                    - name: peak.bytes
                      type: long
                      format: bytes
                      description: >
                        Peak bytes.
                    - name: peak_max.bytes
                      type: long
                      format: bytes
                      description: >
                        Peak max bytes.
                    - name: used.bytes
                      type: long
                      format: bytes
                      description: >
                        Used bytes.
            - name: jvm.gc.collectors
              type: group
              fields:
                - name: old.collection
                  type: group
                  fields:
                    - name: count
                      type: long
                    - name: ms
                      type: long
                - name: young.collection
                  type: group
                  fields:
                    - name: count
                      type: long
                    - name: ms
                      type: long
        
            - name: fs
              type: group
              fields:
                - name: total
                  type: group
                  fields:
                    - name: total_in_bytes
                      type: long
                    - name: available_in_bytes
                      type: long
                - name: summary
                  type: group
                  description: >
                    File system summary
                  fields:
                    - name: total.bytes
                      type: long
                      format: bytes
                    - name: free.bytes
                      type: long
                      format: bytes
                    - name: available.bytes
                      type: long
                      format: bytes
                - name: io_stats
                  type: group
                  fields:
                    - name: total
                      type: group
                      fields:
                        - name: operations.count
                          type: long
                        - name: read.operations.count
                          type: long
                        - name: write.operations.count
                          type: long
            - name: os
              type: group
              fields:
                - name: cpu
                  type: group
                  fields:
                    - name: load_avg.1m
                      type: half_float
                - name: cgroup
                  type: group
                  fields:
                    - name: cpuacct.usage.ns
                      type: long
                    - name: cpu
                      type: group
                      fields:
                        - name: cfs.quota.us
                          type: long
                        - name: stat
                          type: group
                          fields:
                            - name: elapsed_periods.count
                              type: long
                            - name: times_throttled.count
                              type: long
                            - name: time_throttled.ns
                              type: long
                    - name: memory
                      type: group
                      fields:
                        - name: control_group
                          type: keyword
                        - name: limit.bytes
                          type: keyword
                        - name: usage.bytes
                          type: keyword
            - name: process.cpu.pct
              type: double
              format: percent
            - name: thread_pool
              type: group
              fields:
                - name: bulk
                  type: group
                  fields:
                    - name: queue.count
                      type: long
                    - name: rejected.count
                      type: long
                - name: force_merge
                  type: group
                  fields:
                    - name: queue.count
                      type: long
                    - name: rejected.count
                      type: long
                - name: get
                  type: group
                  fields:
                    - name: queue.count
                      type: long
                    - name: rejected.count
                      type: long
                - name: index
                  type: group
                  fields:
                    - name: queue.count
                      type: long
                    - name: rejected.count
                      type: long
                - name: search
                  type: group
                  fields:
                    - name: queue.count
                      type: long
                    - name: rejected.count
                      type: long
                - name: write
                  type: group
                  fields:
                    - name: queue.count
                      type: long
                    - name: rejected.count
                      type: long
            - name: indexing_pressure
              type: group
              fields:
                - name: memory
                  type: group
                  fields:
                    - name: current.combined_coordinating_and_primary.bytes
                      type: long
                      format: bytes
                    - name: total.primary.rejections
                      type: long
                      format: bytes
                    - name: total.primary.bytes
                      type: long
                      format: bytes
                    - name: total.coordinating.rejections
                      type: long
                      format: bytes
                    - name: total.coordinating.bytes
                      type: long
                      format: bytes
                    - name: total.replica.rejections
                      type: long
                      format: bytes
                    - name: total.replica.bytes
                      type: long
                      format: bytes
                    - name: total.combined_coordinating_and_primary.bytes
                      type: long
                      format: bytes
                    - name: current.coordinating.bytes
                      type: long
                      format: bytes
                    - name: current.primary.bytes
                      type: long
                      format: bytes
                    - name: current.replica.bytes
                      type: long
                      format: bytes
                    - name: current.all.bytes
                      type: long
                      format: bytes
                    - name: total.all.bytes
                      type: long
                      format: bytes
                    - name: limit_in_bytes
                      type: long
                      format: bytes
        - name: cluster.pending_task
          type: group
          description: >
            `cluster.pending_task` contains a pending task description.
          release: ga
          fields:
            - name: insert_order
              type: long
              description: >
                Insert order
            - name: priority
              type: long
              description: >
                Priority
            - name: source
              type: keyword
              description: >
                Source. For example: put-mapping
            - name: time_in_queue.ms
              type: long
              description: >
                Time in queue
        - name: shard
          type: group
          description: >
            shard fields
          release: ga
          fields:
            - name: primary
              type: boolean
              description: >
                True if this is the primary shard.
            - name: number
              type: long
              description: >
                The number of this shard.
            - name: state
              type: keyword
              description: >
                The state of this shard.
            - name: relocating_node.name
              type: keyword
              description: >
                The node the shard was relocated from.
            - name: relocating_node.id
              type: keyword
              description: >
                The node the shard was relocated from. It has the exact same value than relocating_node.name for compatibility purposes.
            - name: source_node
              type: group
              fields:
                - name: name
                  type: keyword
                - name: uuid
                  type: keyword
- key: envoyproxy
  title: "Envoyproxy"
  description: >
    envoyproxy module
  release: ga
  settings: ["ssl", "http"]
  fields:
    - name: envoyproxy
      type: group
      description: >
      fields:
        - name: server
          type: group
          release: ga
          description: >
            Contains envoy proxy server stats
          fields:
            - name: cluster_manager
              type: group
              fields:
                - name: active_clusters 
                  type: integer
                  description: >
                    Number of currently active (warmed) clusters
                - name: cluster_added
                  type: integer
                  description: >
                    Total clusters added (either via static config or CDS)
                - name: cluster_modified
                  type: integer
                  description: >
                    Total clusters modified (via CDS)
                - name: cluster_removed
                  type: integer
                  description: >
                    Total clusters removed (via CDS)
                - name: warming_clusters
                  type: integer
                  description: >
                    Number of currently warming (not active) clusters
                - name: cluster_updated
                  type: integer
                  description: >
                    Total cluster updates
                - name: cluster_updated_via_merge
                  type: integer
                  description: >
                    Total cluster updates applied as merged updates
                - name: update_merge_cancelled
                  type: integer
                  description: >
                    Total merged updates that got cancelled and delivered early
                - name: update_out_of_merge_window
                  type: integer
                  description: >
                    Total updates which arrived out of a merge window
        
            - name: filesystem
              type: group
              fields:
                - name: flushed_by_timer
                  type: integer
                  description: >
                    Total number of times internal flush buffers are written to a file due to flush timeout
                - name: reopen_failed
                  type: integer
                  description: >
                    Total number of times a file was failed to be opened
                - name: write_buffered
                  type: integer
                  description: >
                    Total number of times file data is moved to Envoys internal flush buffer
                - name: write_completed
                  type: integer
                  description: >
                    Total number of times a file was written
                - name: write_total_buffered 
                  type: integer
                  description: >
                    Current total size of internal flush buffer in bytes
                - name: write_failed
                  type: integer
                  description: >
                    Total number of times an error occurred during a file write operation
        
            - name: runtime
              type: group
              fields:
                - name: load_error
                  type: integer
                  description: >
                    Total number of load attempts that resulted in an error in any layer
                - name: load_success
                  type: integer
                  description: >
                    Total number of load attempts that were successful at all layers
                - name: num_keys 
                  type: integer
                  description: >
                    Number of keys currently loaded
                - name: override_dir_exists
                  type: integer
                  description: >
                    Total number of loads that did use an override directory
                - name: override_dir_not_exists
                  type: integer
                  description: >
                    Total number of loads that did not use an override directory
                - name: admin_overrides_active
                  type: integer
                  description: >
                    1 if any admin overrides are active otherwise 0
                - name: deprecated_feature_use
                  type: integer
                  description: >
                    Total number of times deprecated features were used.
                - name: num_layers
                  type: integer
                  description: >
                    Number of layers currently active (without loading errors)
        
            - name: listener_manager
              type: group
              fields:
                - name: listener_added
                  type: integer
                  description: >
                    Total listeners added (either via static config or LDS)
                - name: listener_create_failure
                  type: integer
                  description: >
                    Total failed listener object additions to workers
                - name: listener_create_success
                  type: integer
                  description: >
                    Total listener objects successfully added to workers
                - name: listener_modified
                  type: integer
                  description: >
                    Total listeners modified (via LDS)
                - name: listener_removed
                  type: integer
                  description: >
                    Total listeners removed (via LDS)
                - name: total_listeners_active
                  type: integer
                  description: >
                    Number of currently active listeners
                - name: total_listeners_draining
                  type: integer
                  description: >
                    Number of currently draining listeners
                - name: total_listeners_warming
                  type: integer
                  description: >
                    Number of currently warming listeners
                - name: listener_stopped
                  type: integer
                  description: >
                    Total listeners stopped
        
            - name: stats
              type: group
              fields:
                - name: overflow
                  type: integer
                  description: >
                    Total number of times Envoy cannot allocate a statistic due to a shortage of shared memory
        
            - name: server
              type: group
              fields:      
                - name: days_until_first_cert_expiring
                  type: integer
                  description: >
                    Number of days until the next certificate being managed will expire
                - name: live
                  type: integer
                  description: >
                    1 if the server is not currently draining, 0 otherwise
                - name: memory_allocated
                  type: integer
                  description: >
                    Current amount of allocated memory in bytes
                - name: memory_heap_size
                  type: integer
                  description: >
                    Current reserved heap size in bytes
                - name: parent_connections
                  type: integer
                  description: >
                    Total connections of the old Envoy process on hot restart
                - name: total_connections
                  type: integer
                  description: >
                    Total connections of both new and old Envoy processes
                - name: uptime
                  type: integer
                  description: >
                    Current server uptime in seconds
                - name: version
                  type: integer
                  description: >
                    Integer represented version number based on SCM revision
                - name: watchdog_mega_miss
                  type: integer
                - name: watchdog_miss
                  type: integer
                - name: hot_restart_epoch
                  type: integer
                  description: >
                    Current hot restart epoch
                - name: concurrency
                  type: integer
                  description: >
                    Number of worker threads
                - name: debug_assertion_failures
                  type: integer
                - name: dynamic_unknown_fields
                  type: integer
                  description: >
                    Number of messages in dynamic configuration with unknown fields
                - name: state
                  type: integer
                  description: >
                    Current state of the Server
                - name: static_unknown_fields
                  type: integer
                  description: >
                    Number of messages in static configuration with unknown fields
                - name: stats_recent_lookups
                  type: integer
        
            - name: http2
              type: group
              fields:
                - name: header_overflow
                  type: integer
                  description: >
                    Total number of connections reset due to the headers being larger than Envoy::Http::Http2::ConnectionImpl::StreamImpl::MAX_HEADER_SIZE (63k)
                - name: headers_cb_no_stream
                  type: integer
                  description: >
                    Total number of errors where a header callback is called without an associated stream. This tracks an unexpected occurrence due to an as yet undiagnosed bug
                - name: rx_messaging_error
                  type: integer
                  description: >
                    Total number of invalid received frames that violated section 8 of the HTTP/2 spec. This will result in a tx_reset
                - name: rx_reset
                  type: integer
                  description: >
                    Total number of reset stream frames received by Envoy
                - name: too_many_header_frames
                  type: integer
                  description: >
                    Total number of times an HTTP2 connection is reset due to receiving too many headers frames. Envoy currently supports proxying at most one header frame for 100-Continue one non-100 response code header frame and one frame with trailers
                - name: trailers
                  type: integer
                  description: >
                    Total number of trailers seen on requests coming from downstream
                - name: tx_reset
                  type: integer
                  description: >
                    Total number of reset stream frames transmitted by Envoy
- key: etcd
  title: "Etcd"
  description: >
    etcd Module
  release: ga
  settings: ["ssl", "http"]
  fields:
    - name: etcd
      type: group
      description: >
        `etcd` contains statistics that were read from Etcd
      fields:
        - name: api_version
          type: keyword
          description: >
            Etcd API version for metrics retrieval


        - name: leader
          type: group
          description: >
            Contains etcd leader statistics.
          release: ga
          fields:
            - name: follower
              type: group
              description: >
                Contains follower statistics.
              fields:
                - name: id
                  type: keyword
                  description: ID of follower
                - name: latency
                  type: group
                  description: >
                    latency to each peer in the cluster
                  fields:
                    - name: ms
                      type: scaled_float
                - name: success_operations
                  type: integer
                  description: successful Raft RPC requests
                - name: failed_operations
                  type: integer
                  description: failed Raft RPC requests
                - name: leader
                  type: keyword
                  description: ID of actual leader
        - name: server
          type: group
          description: >
            Server metrics from the Etcd V3 /metrics endpoint
          release: beta
          fields:
            - name: has_leader
              type: byte
              description: >
                Whether a leader exists in the cluster
        
            - name: leader_changes.count
              type: long
              description: >
                Number of leader changes seen at the cluster
        
            - name: proposals_committed.count
              type: long
              description: >
                Number of consensus proposals commited
        
            - name: proposals_pending.count
              type: long
              description: >
                Number of consensus proposals pending
        
            - name: proposals_failed.count
              type: long
              description: >
                Number of consensus proposals failed
        
            - name: grpc_started.count
              type: long
              description: >
                Number of sent gRPC requests
        
            - name: grpc_handled.count
              type: long
              description: >
                Number of received gRPC requests
        
        - name: disk
          type: group
          description: >
            Disk metrics from the Etcd V3 /metrics endpoint
          release: beta
          fields:
            - name: mvcc_db_total_size.bytes
              type: long
              format: bytes
              description: >
                Size of stored data at MVCC
        
            - name: wal_fsync_duration.ns.bucket.*
              type: object
              object_type: long
              description: >
                Latency for writing ahead logs to disk
        
            - name: wal_fsync_duration.ns.count
              type: long
              description: >
                Write ahead logs count
            
            - name: wal_fsync_duration.ns.sum
              type: long
              description: >
                Write ahead logs latency sum
        
            - name: backend_commit_duration.ns.bucket.*
              type: object
              object_type: long
              description: >
                Latency for writing backend changes to disk
        
            - name: backend_commit_duration.ns.count
              type: long
              description: >
                Backend commits count
            
            - name: backend_commit_duration.ns.sum
              type: long
              description: >
                Backend commits latency sum
        
        - name: memory
          type: group
          description: >
            Memory metrics from the Etcd V3 /metrics endpoint
          release: beta
          fields:
            - name: go_memstats_alloc.bytes
              type: long
              format: bytes
              description: >
                Memory allocated bytes as of MemStats Go
        
        - name: network
          type: group
          description: >
            Network metrics from the Etcd V3 /metrics endpoint
          release: beta
          fields:
            - name: client_grpc_sent.bytes
              type: long
              format: bytes
              description: >
                gRPC sent bytes total
        
            - name: client_grpc_received.bytes
              type: long
              format: bytes
              description: >
                gRPC received bytes total
        - name: self
          type: group
          description: >
            Contains etcd self statistics.
          release: ga
          fields:
            - name: id
              type: keyword
              description: >
               the unique identifier for the member
        
            - name: leaderinfo.leader
              type: keyword
              description: >
                id of the current leader member
            - name: leaderinfo.starttime
              type: keyword
              description: >
                the time when this node was started
            - name: leaderinfo.uptime
              type: keyword
              description: >
                amount of time the leader has been leader
        
            - name: name
              type: keyword
              description: >
                this member's name
        
            - name: recv.appendrequest.count
              type: integer
              description: >
                number of append requests this node has processed
            - name: recv.bandwidthrate
              type: scaled_float
              description: >
                number of bytes per second this node is receiving (follower only)
            - name: recv.pkgrate
              type: scaled_float
              description: >
                number of requests per second this node is receiving (follower only)
        
            - name: send.appendrequest.count
              type: integer
              description: >
                 number of requests that this node has sent
            - name: send.bandwidthrate
              type: scaled_float
              description: >
                number of bytes per second this node is sending (leader only). This value is undefined on single member clusters.
            - name: send.pkgrate
              type: scaled_float
              description: >
                number of requests per second this node is sending (leader only). This value is undefined on single member clusters.
        
            - name: starttime
              type: keyword
              description: >
                the time when this node was started
        
            - name: state
              type: keyword
              description: >
                either leader or follower
        - name: store
          type: group
          description: >
            The store statistics include information about the operations that this node has handled.
          release: ga
          fields:
            - name: gets.success
              type: integer
            - name: gets.fail
              type: integer
        
            - name: sets.success
              type: integer
            - name: sets.fail
              type: integer
        
            - name: delete.success
              type: integer
            - name: delete.fail
              type: integer
        
            - name: update.success
              type: integer
            - name: update.fail
              type: integer
        
            - name: create.success
              type: integer
            - name: create.fail
              type: integer
        
            - name: compareandswap.success
              type: integer
            - name: compareandswap.fail
              type: integer
        
            - name: compareanddelete.success
              type: integer
            - name: compareanddelete.fail
              type: integer
        
        
            - name: expire.count
              type: integer
        
            - name: watchers
              type: integer
- key: golang
  title: "Golang"
  description: >
    Golang module
  short_config: false
  release: ga
  settings: ["ssl", "http"]
  fields:
    - name: golang
      type: group
      description: >
      fields:
        - name: expvar
          type: group
          description: >
            expvar
          release: ga
          fields:
            - name: cmdline
              type: keyword
              description: >
                The cmdline of this Go program start with.
        - name: heap
          type: group
          description: >
            The Go program heap information exposed by expvar.
          release: ga
          fields:
            - name: cmdline
              type: keyword
              description: >
                The cmdline of this Go program start with.
        
            - name: gc
              type: group
              description: >
                Garbage collector summary.
              fields:
                - name: total_pause
                  type: group
                  description: >
                     Total GC pause duration over lifetime of process.
                  fields:
                    - name: ns
                      type: long
                      description: >
                        Duration in Ns.
                - name: total_count
                  type: long
                  description: >
                     Total number of GC was happened.
                - name: next_gc_limit
                  type: long
                  format: bytes
                  description: >
                     Next collection will happen when HeapAlloc > this amount.
                - name: cpu_fraction
                  type: float
                  description: >
                     Fraction of CPU time used by GC.
                - name: pause
                  type: group
                  description: >
                     Last GC pause durations during the monitoring period.
                  fields:
                    - name: count
                      type: long
                      description: >
                         Count of GC pause duration during this collect period.
                    - name: sum
                      type: group
                      description: >
                         Total GC pause duration during this collect period.
                      fields:
                        - name: ns
                          type: long
                          description: >
                            Duration in Ns.
                    - name: max
                      type: group
                      description: >
                         Max GC pause duration during this collect period.
                      fields:
                        - name: ns
                          type: long
                          description: >
                             Duration in Ns.
                    - name: avg
                      type: group
                      description: >
                         Average GC pause duration during this collect period.
                      fields:
                        - name: ns
                          type: long
                          description: >
                             Duration in Ns.
        
            - name: system
              type: group
              description: >
                Heap summary,which bytes was obtained from system.
              fields:
                - name: total
                  type: long
                  format: bytes
                  description: >
                    Total bytes obtained from system (sum of XxxSys below).
                - name: obtained
                  type: long
                  format: bytes
                  description: >
                    Via HeapSys, bytes obtained from system. heap_sys = heap_idle + heap_inuse.
                - name: stack
                  type: long
                  format: bytes
                  description: >
                    Bytes used by stack allocator, and these bytes was obtained from system.
                - name: released
                  type: long
                  format: bytes
                  description: >
                    Bytes released to the OS.
        
            - name: allocations
              type: group
              description: >
                Heap allocations summary.
              fields:
                - name: mallocs
                  type: long
                  description: >
                    Number of mallocs.
                - name: frees
                  type: long
                  description: >
                    Number of frees.
                - name: objects
                  type: long
                  description: >
                    Total number of allocated objects.
                - name: total
                  type: long
                  format: bytes
                  description: >
                    Bytes allocated (even if freed) throughout the lifetime.
                - name: allocated
                  type: long
                  format: bytes
                  description: >
                    Bytes allocated and not yet freed (same as Alloc above).
                - name: idle
                  type: long
                  format: bytes
                  description: >
                    Bytes in idle spans.
                - name: active
                  type: long
                  format: bytes
                  description: >
                    Bytes in non-idle span.
- key: graphite
  title: "Graphite"
  description: >
    graphite Module
  release: ga
  fields:
    - name: graphite
      type: group
      description: >
      fields:
        - name: server
          type: group
          description: >
            server
          release: ga
          fields:
            - name: example
              type: keyword
              description: >
                Example field
- key: haproxy
  title: "HAProxy"
  description: >
    HAProxy Module
  short_config: false
  release: ga
  settings: ["ssl", "http"]
  fields:
    - name: haproxy
      type: group
      description: >
        HAProxy metrics.
      fields:
        - name: info
          type: group
          description: >
            General information about HAProxy processes.
          release: ga
          fields:
            - name: processes
              type: long
              description: >
                Number of processes.
        
            - name: process_num
              type: long
              description: >
                Process number.
        
            - name: threads
              type: long
              description: >
                Number of threads.
        
            - name: pid
              type: alias
              path: process.pid
              migration: true
              description: >
                Process ID.
        
            - name: run_queue
              type: long
              description: >
        
            - name: stopping
              type: long
              description: >
                Number of stopping jobs.
        
            - name: jobs
              type: long
              description: >
                Number of all jobs.
        
            - name: unstoppable_jobs
              type: long
              description: >
                Number of unstoppable jobs.
        
            - name: listeners
              type: long
              description: >
                Number of listeners.
        
            - name: dropped_logs
              type: long
              description: >
                Number of dropped logs.
        
            - name: busy_polling
              type: long
              description: >
                Number of busy polling.
        
            - name: failed_resolutions
              type: long
              description: >
                Number of failed resolutions.
        
            - name: tasks
              type: long
              description: >
        
            - name: uptime.sec
              type: long
              description: >
                Current uptime in seconds.
        
            - name: memory.max.bytes
              type: long
              format: bytes
              description: >
                Maximum amount of memory usage in bytes (the 'Memmax_MB' value converted to bytes).
        
        
            - name: bytes
              type: group
              fields:
        
                - name: out
                  type: group
                  fields:
        
                    - name: total
                      type: long
                      description: >
                        Number of bytes sent out.
        
                    - name: rate
                      type: long
                      description: >
                        Average bytes output rate.
        
        
            - name: peers
              type: group
              fields:
        
                - name: active
                  type: long
                  description: >
                    Number of active peers.
        
                - name: connected
                  type: long
                  description: >
                    Number of connected peers.
        
        
            - name: pool
              type: group
              fields:
        
                - name: allocated
                  type: long
                  description: >
                    Size of the allocated pool.
        
                - name: used
                  type: long
                  description: >
                    Number of members used from the allocated pool.
        
                - name: failed
                  type: long
                  description: >
                    Number of failed connections to pool members.
        
        
            - name: ulimit_n
              type: long
              description: >
                Maximum number of open files for the process.
        
            - name: compress
              type: group
              description: >
        
              fields:
                - name: bps
                  type: group
                  description: >
        
                  fields:
                    - name: in
                      type: long
                      description: >
                        Incoming compressed data in bits per second.
        
                    - name: out
                      type: long
                      description: >
                        Outgoing compressed data in bits per second.
        
                    - name: rate_limit
                      type: long
                      description: >
                        Rate limit of compressed data in bits per second.
        
            - name: connection
              type: group
              description: >
        
              fields:
                - name: rate
                  type: group
                  description: >
        
                  fields:
                    - name: value
                      type: long
                      description: >
                        Number of connections in the last second.
        
                    - name: limit
                      type: long
                      description: >
                        Rate limit of connections.
        
                    - name: max
                      type: long
                      description: >
                        Maximum rate of connections.
        
                - name: current
                  type: long
                  description: >
                    Current connections.
        
                - name: total
                  type: long
                  description: >
                    Total connections.
        
                - name: ssl.current
                  type: long
                  description: >
                    Current SSL connections.
        
                - name: ssl.total
                  type: long
                  description: >
                    Total SSL connections.
        
                - name: ssl.max
                  type: long
                  description: >
                    Maximum SSL connections.
        
                - name: max
                  type: long
                  description: >
                    Maximum connections.
        
                - name: hard_max
                  type: long
                  description: >
        
            - name: requests.total
              type: long
              description: >
                Total number of requests.
        
            - name: sockets.max
              type: long
              description: >
                Maximum number of sockets.
        
            - name: requests.max
              type: long
              description: >
                Maximum number of requests.
        
            - name: pipes
              type: group
              description: >
              fields:
                - name: used
                  type: integer
                  description: >
                    Number of used pipes during kernel-based tcp splicing.
        
                - name: free
                  type: integer
                  description: >
                    Number of free pipes.
        
                - name: max
                  type: integer
                  description: >
                    Maximum number of used pipes.
        
            - name: session
              type: group
              description:
              fields:
                - name: rate.value
                  type: integer
                  description: >
                    Rate of session per seconds.
        
                - name: rate.limit
                  type: integer
                  description: >
                    Rate limit of sessions.
        
                - name: rate.max
                  type: integer
                  description: >
                    Maximum rate of sessions.
        
        
            - name: ssl
              type: group
              description:
              fields:
                - name: rate.value
                  type: integer
                  description: >
                    Rate of SSL requests.
        
                - name: rate.limit
                  type: integer
                  description: >
                    Rate limit of SSL requests.
        
                - name: rate.max
                  type: integer
                  description: >
                    Maximum rate of SSL requests.
        
                - name: frontend
                  type: group
                  description:
                  fields:
                    - name: key_rate.value
                      type: integer
                      description: >
                        Key rate of SSL frontend.
        
                    - name: key_rate.max
                      type: integer
                      description: >
                        Maximum key rate of SSL frontend.
        
                    - name: session_reuse.pct
                      type: scaled_float
                      format: percent
                      description: >
                        Rate of reuse of SSL frontend sessions.
        
                - name: backend
                  type: group
                  description:
                  fields:
                    - name: key_rate.value
                      type: integer
                      description: >
                        Key rate of SSL backend sessions.
        
                    - name: key_rate.max
                      type: integer
                      description: >
                        Maximum key rate of SSL backend sessions.
                - name: cached_lookups
                  type: long
                  description: >
                    Number of SSL cache lookups.
                - name: cache_misses
                  type: long
                  description: >
                    Number of SSL cache misses.
        
        
            - name: zlib_mem_usage
              type: group
              description: >
        
              fields:
                - name: value
                  type: integer
                  description: >
                    Memory usage of zlib.
        
                - name: max
                  type: integer
                  description: >
                    Maximum memory usage of zlib.
        
            - name: idle.pct
              type: scaled_float
              format: percent
              description: >
                Percentage of idle time.
        - name: stat
          type: group
          description: >
            Stats collected from HAProxy processes.
          release: ga
          fields:
        
            - name: status
              type: keyword
              description: >
                Status (UP, DOWN, NOLB, MAINT, or MAINT(via)...).
        
            - name: weight
              type: long
              description: >
                Total weight (for backends), or server weight (for servers).
        
            - name: downtime
              type: long
              description: >
                Total downtime (in seconds). For backends, this value is the downtime
                for the whole backend, not the sum of the downtime for the servers.
        
            - name: component_type
              type: integer
              description: >
                Component type (0=frontend, 1=backend, 2=server, or 3=socket/listener).
        
            - name: process_id
              type: alias
              path: process.pid
              migration: true
              description: >
                Process ID (0 for first instance, 1 for second, and so on).
        
            - name: service_name
              type: keyword
              description: >
                Service name (FRONTEND for frontend, BACKEND for backend, or any name for server/listener).
        
            - name: in.bytes
              type: long
              format: bytes
              description: >
                Bytes in.
        
            - name: out.bytes
              type: long
              format: bytes
              description: >
                Bytes out.
        
            - name: last_change
              type: integer
              description: >
                Number of seconds since the last UP->DOWN or DOWN->UP transition.
        
            - name: throttle.pct
              type: scaled_float
              format: percent
              description: >
                Current throttle percentage for the server when slowstart
                is active, or no value if slowstart is inactive.
        
            - name: selected.total
              type: long
              description: >
                Total number of times a server was selected, either for new
                sessions, or when re-dispatching. For servers, this field reports the
                the number of times the server was selected.
        
            - name: tracked.id
              type: long
              description: >
                ID of the proxy/server if tracking is enabled.
        
            - name: cookie
              type: keyword
              description: >
                Cookie value of the server or the name of the cookie of the backend.
        
            - name: load_balancing_algorithm
              type: keyword
              description: >
                Load balancing algorithm.
        
            - name: connection
              type: group
              fields:
        
                - name: total
                  type: long
                  description: >
                    Cumulative number of connections.
        
                - name: retried
                  type: long
                  description: >
                    Number of times a connection to a server was retried.
        
                - name: time.avg
                  type: long
                  description: >
                    Average connect time in ms over the last 1024 requests.
        
                - name: rate
                  type: long
                  description: >
                    Number of connections over the last second.
        
                - name: rate_max
                  type: long
                  description: >
                    Highest value of connection.rate.
        
                - name: attempt.total
                  type: long
                  description: >
                    Number of connection establishment attempts.
        
                - name: reuse.total
                  type: long
                  description: >
                    Number of connection reuses.
        
                - name: idle
                  type: group
                  fields:
        
                    - name: total
                      type: long
                      description: >
                        Number of idle connections available for reuse.
        
                    - name: limit
                      type: long
                      description: >
                        Limit on idle connections available for reuse.
        
                - name: cache
                  type: group
                  fields:
        
                    - name: lookup.total
                      type: long
                      description: >
                        Number of cache lookups.
        
                    - name: hits
                      type: long
                      description: >
                        Number of cache hits.
        
            - name: request
              type: group
              fields:
        
                - name: denied
                  type: long
                  description: >
                    Requests denied because of security concerns.
        
                      * For TCP this is because of a matched tcp-request content rule.
                      * For HTTP this is because of a matched http-request or tarpit rule.
        
                - name: denied_by_connection_rules
                  type: long
                  description: >
                    Requests denied because of TCP request connection rules.
        
                - name: denied_by_session_rules
                  type: long
                  description: >
                    Requests denied because of TCP request session rules.
        
                - name: queued.current
                  type: long
                  description: >
                    Current queued requests. For backends, this field reports the number
                    of requests queued without a server assigned.
        
                - name: queued.max
                  type: long
                  description: >
                    Maximum value of queued.current.
        
                - name: errors
                  type: long
                  description: >
                    Request errors. Some of the possible causes are:
        
                      * early termination from the client, before the request has been sent
                      * read error from the client
                      * client timeout
                      * client closed connection
                      * various bad requests from the client.
                      * request was tarpitted.
        
                - name: redispatched
                  type: long
                  description: >
                    Number of times a request was redispatched to another server. For
                    servers, this field reports the number of times the server was
                    switched away from.
        
                - name: connection.errors
                  type: long
                  description: >
                    Number of requests that encountered an error trying to
                    connect to a server. For backends, this field reports the sum of
                    the stat for all backend servers, plus any connection errors not
                    associated with a particular server (such as the backend having no
                    active servers).
        
                - name: rate
                  type: group
                  description: >
                  fields:
                    - name: value
                      type: long
                      description: >
                        Number of HTTP requests per second over the last elapsed second.
                    - name: max
                      type: long
                      description: >
                        Maximum number of HTTP requests per second.
        
                - name: total
                  type: long
                  description: >
                    Total number of HTTP requests received.
        
                - name: intercepted
                  type: long
                  description: >
                    Number of intercepted requests.
        
        
            - name: response
              type: group
              fields:
        
                - name: errors
                  type: long
                  description: >
                    Number of response errors. This value includes the number of data
                    transfers aborted by the server (haproxy.stat.server.aborted).
                    Some other errors are:
        
                    * write errors on the client socket (won't be counted for the server stat)
                    * failure applying filters to the response
        
        
                - name: time.avg
                  type: long
                  description: >
                    Average response time in ms over the last 1024 requests (0 for TCP).
        
                - name: denied
                  type: integer
                  description: >
                    Responses denied because of security concerns. For HTTP this is
                    because of a matched http-request rule, or "option checkcache".
        
                - name: http
                  type: group
                  description: >
        
                  fields:
                    - name: 1xx
                      type: long
                      description: >
                        HTTP responses with 1xx code.
        
                    - name: 2xx
                      type: long
                      description: >
                        HTTP responses with 2xx code.
        
                    - name: 3xx
                      type: long
                      description: >
                        HTTP responses with 3xx code.
        
                    - name: 4xx
                      type: long
                      description: >
                        HTTP responses with 4xx code.
        
                    - name: 5xx
                      type: long
                      description: >
                        HTTP responses with 5xx code.
        
                    - name: other
                      type: long
                      description: >
                        HTTP responses with other codes (protocol error).
        
        
            - name: header
              type: group
              fields:
        
                - name: rewrite
                  type: group
                  fields:
        
                    - name: failed
                      type: group
                      fields:
        
                        - name: total
                          type: long
                          description: >
                            Number of failed header rewrite warnings.
        
        
            - name: session
              type: group
              fields:
        
                - name: current
                  type: long
                  description: >
                    Number of current sessions.
        
                - name: max
                  type: long
                  description: >
                    Maximum number of sessions.
        
                - name: limit
                  type: long
                  description: >
                    Configured session limit.
        
                - name: total
                  type: long
                  description: >
                    Number of all sessions.
        
                - name: rate
                  type: group
                  fields:
                    - name: value
                      type: integer
                      description: >
                        Number of sessions per second over the last elapsed second.
        
                    - name: limit
                      type: integer
                      description: >
                        Configured limit on new sessions per second.
        
                    - name: max
                      type: integer
                      description: >
                        Maximum number of new sessions per second.
        
        
            - name: check
              type: group
              description: >
        
              fields:
                - name: status
                  type: keyword
                  description: >
                    Status of the last health check. One of:
        
                      UNK     -> unknown
                      INI     -> initializing
                      SOCKERR -> socket error
                      L4OK    -> check passed on layer 4, no upper layers testing enabled
                      L4TOUT  -> layer 1-4 timeout
                      L4CON   -> layer 1-4 connection problem, for example
                                "Connection refused" (tcp rst) or "No route to host" (icmp)
                      L6OK    -> check passed on layer 6
                      L6TOUT  -> layer 6 (SSL) timeout
                      L6RSP   -> layer 6 invalid response - protocol error
                      L7OK    -> check passed on layer 7
                      L7OKC   -> check conditionally passed on layer 7, for example 404 with
                                disable-on-404
                      L7TOUT  -> layer 7 (HTTP/SMTP) timeout
                      L7RSP   -> layer 7 invalid response - protocol error
                      L7STS   -> layer 7 response error, for example HTTP 5xx
        
                - name: code
                  type: long
                  description: >
                    Layer 5-7 code, if available.
        
                - name: duration
                  type: long
                  description: >
                    Time in ms that it took to finish the last health check.
        
                - name: health.last
                  type: keyword
                  description: >
                    The result of the last health check.
        
                - name: health.fail
                  type: long
                  description: >
                    Number of failed checks.
        
                - name: agent.last
                  type: integer
                  description: >
        
                - name: failed
                  type: long
                  description: >
                    Number of checks that failed while the server was up.
        
                - name: down
                  type: long
                  description: >
                    Number of UP->DOWN transitions. For backends, this value is the
                    number of transitions to the whole backend being down, rather than
                    the sum of the transitions for each server.
        
            - name: client.aborted
              type: integer
              description: >
                Number of data transfers aborted by the client.
        
        
            - name: server
              type: group
              description: >
              fields:
        
                - name: id
                  type: integer
                  description: >
                    Server ID (unique inside a proxy).
        
                - name: aborted
                  type: integer
                  description: >
                    Number of data transfers aborted by the server. This value is
                    included in haproxy.stat.response.errors.
        
                - name: active
                  type: integer
                  description: >
                    Number of backend servers that are active, meaning that they are
                    healthy and can receive requests from the load balancer.
        
                - name: backup
                  type: integer
                  description: >
                    Number of backend servers that are backup servers.
        
        
            - name: compressor
              type: group
              description: >
        
              fields:
                - name: in.bytes
                  type: long
                  format: bytes
                  description: >
                    Number of HTTP response bytes fed to the compressor.
        
                - name: out.bytes
                  type: integer
                  format: bytes
                  description: >
                    Number of HTTP response bytes emitted by the compressor.
        
                - name: bypassed.bytes
                  type: long
                  format: bytes
                  description: >
                    Number of bytes that bypassed the HTTP compressor (CPU/BW limit).
        
                - name: response.bytes
                  type: long
                  format: bytes
                  description: >
                    Number of HTTP responses that were compressed.
        
            - name: proxy
              type: group
              description: >
        
              fields:
                - name: id
                  type: integer
                  description: >
                    Unique proxy ID.
        
                - name: name
                  type: keyword
                  description: >
                    Proxy name.
        
                - name: mode
                  type: keyword
                  description: >
                    Proxy mode (tcp, http, health, unknown).
        
        
            - name: queue
              type: group
              description: >
        
              fields:
                - name: limit
                  type: integer
                  description: >
                    Configured queue limit (maxqueue) for the server, or nothing if the
                    value of maxqueue is 0 (meaning no limit).
        
                - name: time.avg
                  type: integer
                  description: >
                    The average queue time in ms over the last 1024 requests.
        
        
            - name: agent
              type: group
              description: >
        
              fields:
                - name: status
                  type: keyword
                  description: >
                    Status of the last health check. One of:
        
                      UNK     -> unknown
                      INI     -> initializing
                      SOCKERR -> socket error
                      L4OK    -> check passed on layer 4, no upper layers enabled
                      L4TOUT  -> layer 1-4 timeout
                      L4CON   -> layer 1-4 connection problem, for example
                                "Connection refused" (tcp rst) or "No route to host" (icmp)
                      L7OK    -> agent reported "up"
                      L7STS   -> agent reported "fail", "stop" or "down"
        
                - name: description
                  type: keyword
                  description: >
                    Human readable version of agent.status.
        
                - name: code
                  type: integer
                  description: >
                    Value reported by agent.
        
                - name: rise
                  type: integer
                  description: >
                    Rise value of agent.
        
                - name: fall
                  type: integer
                  description: >
                    Fall value of agent.
        
                - name: health
                  type: integer
                  description: >
                    Health parameter of agent. Between 0 and `agent.rise`+`agent.fall`-1.
        
                - name: duration
                  type: integer
                  description: >
                    Duration of the last check in ms.
        
                - name: check
                  type: group
                  fields:
        
                    - name: rise
                      type: integer
                      description: >
                        Rise value of server.
        
                    - name: fall
                      type: integer
                      description: >
                        Fall value of server.
        
                    - name: health
                      type: integer
                      description: >
                        Health parameter of server. Between 0 and `agent.check.rise`+`agent.check.fall`-1.
        
                    - name: description
                      type: keyword
                      description: >
                        Human readable version of check.
        
        
            - name: source
              type: group
              fields:
        
                - name: address
                  type: text
                  description: >
                    Address of the source.
        
        
        
- key: http
  title: "HTTP"
  description: >
    HTTP module
  release: ga
  settings: ["ssl", "http"]
  fields:
    - name: http
      type: group
      description: >
      fields:
        - name: request
          type: group
          description: >
              HTTP request information
          fields:
            - name: headers
              type: object
              description: >
                The HTTP headers sent
        - name: response
          type: group
          description: >
              HTTP response information
          fields:
            - name: headers
              type: object
              description: >
                The HTTP headers received
            - name: code
              type: keyword
              description: >
                The HTTP status code
              example: 404
            - name: phrase
              type: keyword
              example: Not found
              description: >
                The HTTP status phrase
        - name: json
          type: group
          description: >
            json metricset
          release: ga
          fields:
        - name: server
          type: group
          description: >
            server
          release: ga
          fields:
- key: jolokia
  title: "Jolokia"
  description: >
    Jolokia module
  short_config: false
  release: ga
  settings: ["ssl", "http"]
  fields:
    - name: jolokia
      type: group
      description: >
          jolokia contains metrics exposed via jolokia agent
      fields:
        - key: jmx
          type: group
          description: >
            Jolokia jmx metricset
          release: ga
          fields:
- key: kafka
  title: "Kafka"
  description: >
    Kafka module
  short_config: false
  release: ga
  fields:
    - name: kafka
      type: group
      description: >
      fields:
        - name: broker
          type: group
          description: >
            Broker Consumer Group Information have been read from (Broker handling
            the consumer group).
          fields:
            - name: id
              type: long
              description: >
                Broker id

            - name: address
              type: keyword
              description: >
                Broker advertised address

        - name: topic.name
          type: keyword
          description: >
            Topic name

        - name: topic.error.code
          type: long
          description: >
            Topic error code.

        - name: partition.id
          type: long
          description: >
            Partition id.

        - name: partition.topic_id
          type: keyword
          description:
            Unique id of the partition in the topic.

        - name: partition.topic_broker_id
          type: keyword
          description:
            Unique id of the partition in the topic and the broker.
        - name: broker
          type: group
          description: Broker metrics from Kafka Broker JMX
          release: beta
          fields:
            - name: mbean
              description: Mbean that this event is related to
              type: keyword
            - name: request.channel.queue.size
              description: The size of the request queue
              type: long
            - name: request.produce.failed_per_second
              description: The rate of failed produce requests per second
              type: float
            - name: request.fetch.failed_per_second
              description: The rate of client fetch request failures per second
              type: float
            - name: request.produce.failed
              description: The number of failed produce requests
              type: float
            - name: request.fetch.failed
              description: The number of client fetch request failures
              type: float
            - name: replication.leader_elections
              description: The leader election rate
              type: float
            - name: replication.unclean_leader_elections
              description: The unclean leader election rate
              type: float
            - name: session.zookeeper.disconnect
              description: The ZooKeeper closed sessions per second
              type: float
            - name: session.zookeeper.expire
              description: The ZooKeeper expired sessions per second
              type: float
            - name: session.zookeeper.readonly
              description: The ZooKeeper readonly sessions per second
              type: float
            - name: session.zookeeper.sync
              description: The ZooKeeper client connections per second
              type: float
            - name: log.flush_rate
              description: The log flush rate
              type: float
            - name: topic.net.in.bytes_per_sec
              description: The incoming byte rate per topic
              type: float
            - name: topic.net.out.bytes_per_sec
              description: The outgoing byte rate per topic
              type: float
            - name: topic.net.rejected.bytes_per_sec
              description: The rejected byte rate per topic
              type: float
            - name: topic.messages_in
              description: The incoming message rate per topic
              type: float
            - name: net.in.bytes_per_sec
              description: The incoming byte rate
              type: float
            - name: net.out.bytes_per_sec
              description: The outgoing byte rate
              type: float
            - name: net.rejected.bytes_per_sec
              description: The rejected byte rate
              type: float
            - name: messages_in
              description: The incoming message rate
              type: float
        - name: consumer
          type: group
          description: Consumer metrics from Kafka Consumer JMX
          release: beta
          fields:
            - name: mbean
              description: Mbean that this event is related to
              type: keyword
            - name: fetch_rate
              description: The minimum rate at which the consumer sends fetch requests to a broker
              type: float
            - name: bytes_consumed
              description: The average number of bytes consumed for a specific topic per second
              type: float
            - name: records_consumed
              description: The average number of records consumed per second for a specific topic
              type: float
            - name: in.bytes_per_sec
              description: The rate of bytes coming in to the consumer
              type: float
            - name: max_lag
              description: The maximum consumer lag
              type: float
            - name: zookeeper_commits
              description: The rate of offset commits to ZooKeeper
              type: float
            - name: kafka_commits
              description: The rate of offset commits to Kafka
              type: float
            - name: messages_in
              description: The rate of consumer message consumption
              type: float
        - name: consumergroup
          type: group
          description: >
            consumergroup
          release: ga
          fields:
            - name: id
              type: keyword
              description: Consumer Group ID
        
            - name: offset
              type: long
              description: consumer offset into partition being read
        
            - name: meta
              type: keyword
              description: custom consumer meta data string
        
            - name: consumer_lag
              type: long
              description: consumer lag for partition/topic calculated as the difference between the partition offset and consumer offset
        
            - name: error.code
              type: long
              description: >
                kafka consumer/partition error code.
        
            - name: client
              type: group
              description: >
                Assigned client reading events from partition
              fields:
                - name: id
                  type: keyword
                  description: Client ID (kafka setting client.id)
        
                - name: host
                  type: keyword
                  description: Client host
        
                - name: member_id
                  type: keyword
                  description: internal consumer group member ID
        - name: partition
          type: group
          description: >
            partition
          release: ga
          fields:
            - name: offset
              type: group
              description: >
                Available offsets of the given partition.
              fields:
                - name: newest
                  type: long
                  description: >
                    Newest offset of the partition.
                - name: oldest
                  type: long
                  description: >
                    Oldest offset of the partition.
        
            - name: partition
              type: group
              description: >
                Partition data.
              fields:
                - name: leader
                  type: long
                  description: >
                    Leader id (broker).
                - name: replica
                  type: long
                  description: >
                    Replica id (broker).
        
                - name: insync_replica
                  type: boolean
                  description: >
                    Indicates if replica is included in the in-sync replicate set (ISR).
        
                - name: is_leader
                  type: boolean
                  description: >
                    Indicates if replica is the leader
        
                - name: error.code
                  type: long
                  description: >
                    Error code from fetching partition.
        - name: producer
          type: group
          description: Producer metrics from Kafka Producer JMX
          release: beta
          fields:
            - name: mbean
              description: Mbean that this event is related to
              type: keyword
            - name: available_buffer_bytes
              description: The total amount of buffer memory
              type: float
            - name: batch_size_avg
              description: The average number of bytes sent
              type: float
            - name: batch_size_max
              description: The maximum number of bytes sent
              type: long
            - name: record_send_rate
              description: The average number of records sent per second
              type: float
            - name: record_retry_rate
              description: The average number of retried record sends per second
              type: float
            - name: record_error_rate
              description: The average number of retried record sends per second
              type: float
            - name: records_per_request
              description: The average number of records sent per second
              type: float
            - name: record_size_avg
              description: The average record size
              type: float
            - name: record_size_max
              description: The maximum record size
              type: long
            - name: request_rate
              description: The number of producer requests per second
              type: float
            - name: response_rate
              description: The number of producer responses per second
              type: float
            - name: io_wait
              description: The producer I/O wait time
              type: float
            - name: out.bytes_per_sec
              description: The rate of bytes going out for the producer
              type: float
            - name: message_rate
              description: The producer message rate
              type: float
- key: kibana
  title: "Kibana"
  description: >
    Kibana module
  short_config: false
  release: ga
  settings: ["ssl", "http"]
  fields:
    - name: kibana_stats
      type: group
      fields:
        - name: timestamp
          type: alias
          path: "@timestamp"
        - name: kibana.response_time.max
          type: alias
          path: kibana.stats.response_time.max.ms
        - name: kibana.status
          type: alias
          path: kibana.stats.kibana.status
        - name: os.memory.free_in_bytes
          type: alias
          path: kibana.stats.os.memory.free_in_bytes
        - name: process.uptime_in_millis
          type: alias
          path: kibana.stats.process.uptime.ms
        - name: process.memory.heap.size_limit
          type: alias
          path: kibana.stats.process.memory.heap.size_limit.bytes
        - name: concurrent_connections
          type: alias
          path: kibana.stats.concurrent_connections
        - name: process.memory.resident_set_size_in_bytes
          type: alias
          path: kibana.stats.process.memory.resident_set_size.bytes
        - name: os.load.1m
          type: alias
          path: kibana.stats.os.load.1m
        - name: os.load.5m
          type: alias
          path: kibana.stats.os.load.5m
        - name: os.load.15m
          type: alias
          path: kibana.stats.os.load.15m
        - name: process.event_loop_delay
          type: alias
          path: kibana.stats.process.event_loop_delay.ms
        - name: process.event_loop_utilization.active
          type: alias
          path: kibana.stats.process.event_loop_utilization.active
        - name: process.event_loop_utilization.idle
          type: alias
          path: kibana.stats.process.event_loop_utilization.idle
        - name: process.event_loop_utilization.utilization
          type: alias
          path: kibana.stats.process.event_loop_utilization.utilization
        - name: requests.total
          type: alias
          path: kibana.stats.request.total
        - name: requests.disconnects
          type: alias
          path: kibana.stats.request.disconnects
        - name: response_times.max
          type: alias
          path: kibana.stats.response_time.max.ms
        - name: response_times.average
          type: alias
          path: kibana.stats.response_time.avg.ms
        - name: kibana.uuid
          type: alias
          path: service.id
    - name: kibana
      type: group
      fields:
        - name: elasticsearch.cluster.id
          type: keyword
        - name: cluster_actions
          type: group
          description: >
            Kibana cluster actions metrics.
          release: beta
          fields:
            - name: kibana
              type: group
              fields:
                - name: status
                  type: keyword
            - name: overdue
              type: group
              fields:
                - name: count
                  type: long
                - name: delay
                  type: group
                  fields:
                    - name: p50
                      type: float
                    - name: p99
                      type: float
        - name: cluster_rules
          type: group
          description: >
            Kibana cluster rule metrics.
          release: beta
          fields:
            - name: kibana
              type: group
              fields:
                - name: status
                  type: keyword
            - name: overdue
              type: group
              fields:
                - name: count
                  type: long
                - name: delay
                  type: group
                  fields:
                    - name: p50
                      type: float
                    - name: p99
                      type: float
        - name: node_actions
          type: group
          description: >
            Kibana node actions metrics.
          release: beta
          fields:
            - name: kibana
              type: group
              fields:
                - name: status
                  type: keyword
            - name: failures
              type: long
            - name: executions
              type: long
            - name: timeouts
              type: long
        - name: node_rules
          type: group
          description: >
            Kibana node rule metrics.
          release: beta
          fields:
            - name: kibana
              type: group
              fields:
                - name: status
                  type: keyword
            - name: failures
              type: long
            - name: executions
              type: long
            - name: timeouts
              type: long
        - name: settings
          type: group
          description: >
            Kibana stats and run-time metrics.
          release: ga
          fields:
            - name: uuid
              type: keyword
              description: Kibana instance UUID
            - name: name
              type: keyword
              description: Kibana instance name
            - name: index
              type: keyword
              description: Name of Kibana's internal index
            - name: host
              type: keyword
              description: Kibana instance hostname
            - name: transport_address
              type: keyword
              description: Kibana server's hostname and port
            - name: version
              type: keyword
              description: Kibana version
            - name: snapshot
              type: boolean
              description: Whether the Kibana build is a snapshot build
            - name: status
              type: keyword
              description: Kibana instance's health status
            - name: locale
              type: keyword
            - name: port
              type: integer
        - name: stats
          type: group
          description: >
            Kibana stats and run-time metrics.
          release: ga
          fields:
            - name: kibana
              type: group
              fields:
                - name: status
                  type: keyword
            - name: usage
              type: group
              fields:
              - name: index
                type: keyword
            - name: uuid
              type: alias
              path: service.id
              migration: true
              description: >
                Kibana instance UUID
            - name: name
              type: keyword
              description: >
                Kibana instance name
            - name: index
              type: keyword
              description: >
                Name of Kibana's internal index
            - name: host.name
              type: keyword
              description: >
                Kibana instance hostname
            - name: transport_address
              type: alias
              path: service.address
              migration: true
              description: >
                Kibana server's hostname and port
            - name: version
              type: alias
              description: >
                Kibana version
              path: service.version
              migration: true
            - name: snapshot
              type: boolean
              description: >
                Whether the Kibana build is a snapshot build
            - name: status
              type: keyword
              description: >
                Kibana instance's health status
            - name: os
              type: group
              fields:
                - name: distro
                  type: keyword
                - name: distroRelease
                  type: keyword
                - name: platform
                  type: keyword
                - name: platformRelease
                  type: keyword
                - name: memory
                  type: group
                  fields:
                    - name: free_in_bytes
                      type: long
                    - name: total_in_bytes
                      type: long
                    - name: used_in_bytes
                      type: long
                - name: load
                  type: group
                  fields:
                    - name: 1m
                      type: half_float
                    - name: 5m
                      type: half_float
                    - name: 15m
                      type: half_float
            - name: concurrent_connections
              type: long
              description: >
                Number of client connections made to the server. Note that browsers can send multiple simultaneous connections to request multiple server assets at once, and they can re-use established connections.
            - name: process
              type: group
              description: >
                Process metrics
              fields:
              - name: memory.resident_set_size.bytes
                type: long
              - name: uptime.ms
                type: long
              - name: event_loop_delay.ms
                type: scaled_float
                description: >
                  Event loop delay in milliseconds
              - name: event_loop_utilization
                type: group
                description: >
                  The ratio of time the event loop is not idling in the event provider to the total time the event loop is running.
                fields:
                - name: active
                  type: scaled_float
                  description: >
                    Duration of time event loop has been active since last measurement.
                - name: idle
                  type: scaled_float
                  description: >
                    Duration of time event loop has been idle since last measurement.
                - name: utilization
                  type: scaled_float
                  description: >
                    Computed utilization value representing ratio of active to idle time since last measurement.
              - name: memory.heap
                type: group
                description: >
                  Process heap metrics
                fields:
                - name: total.bytes
                  type: long
                  format: bytes
                  description: >
                    Total heap allocated to process in bytes
                - name: used.bytes
                  type: long
                  format: bytes
                  description: >
                    Heap used by process in bytes
                - name: size_limit.bytes
                  type: long
                  format: bytes
                  description: >
                    Max. old space size allocated to Node.js process, in bytes
                - name: uptime.ms
                  type: long
                  description: >
                    Uptime of process in milliseconds
            - name: request
              type: group
              description: >
                  Request count metrics
              fields:
                - name: disconnects
                  type: long
                  description: >
                    Number of requests that were disconnected
                - name: total
                  type: long
                  description: >
                    Total number of requests
            - name: response_time
              type: group
              description: Response times metrics
              fields:
                - name: avg.ms
                  type: long
                  description: Average response time in milliseconds
                - name: max.ms
                  type: long
                  description: Maximum response time in milliseconds
            - name: elasticsearch_client
              type: group
              description: Elasticsearch Client's stats
              fields:
                - name: total_active_sockets
                  type: integer
                  description: Total number of active sockets
                - name: total_idle_sockets
                  type: integer
                  description: Total number of idle sockets
                - name: total_queued_requests
                  type: integer
                  description: Total number of queued requests
        - name: status
          type: group
          description: >
            Status fields
          release: ga
          fields:
            - name: name
              type: keyword
              description: >
                Kibana instance name.
            - name: uuid
              type: alias
              path: service.id
              migration: true
              description: >
                Kibana instance uuid.
            - name: version.number
              type: alias
              description: >
                Kibana version number.
              path: service.version
              migration: true
            - name: status.overall.state
              type: keyword
              description: >
                Kibana overall state.
            - name: metrics
              type: group
              description: >
                Metrics fields
              fields:
                - name: concurrent_connections
                  type: long
                  description: >
                    Current concurrent connections.
                - name: requests
                  type: group
                  description: >
                    Request statistics.
                  fields:
                    - name: disconnects
                      type: long
                      description: >
                        Total number of disconnected connections.
                    - name: total
                      type: long
                      description: >
                        Total number of connections.
- key: kubernetes
  title: "Kubernetes"
  description: >
    Kubernetes metrics
  release: ga
  settings: ["ssl", "http"]
  short_config: false
  fields:
    - name: kubernetes
      type: group
      description: >
        Information and statistics of pods managed by kubernetes.
      fields:

        - name: apiserver
          type: group
          description: >
            Kubernetes API server metrics
          release: ga
          fields:
            - name: request.resource
              type: keyword
              description: >
                Requested resource
            - name: request.subresource
              type: keyword
              description: >
                Requested subresource
            - name: request.scope
              type: keyword
              description: >
                Request scope (cluster, namespace, resource)
            - name: request.verb
              type: keyword
              description: >
                HTTP verb
            - name: request.code
              type: keyword
              description: >
                HTTP code
            - name: request.content_type
              type: keyword
              description: >
                Request HTTP content type
            - name: request.dry_run
              type: keyword
              description: >
                Wether the request uses dry run
            - name: request.kind
              type: keyword
              description: >
                Kind of request
            - name: request.component
              type: keyword
              description: >
                Component handling the request
            - name: request.group
              type: keyword
              description: >
                API group for the resource
            - name: request.version
              type: keyword
              description: >
                version for the group
            - name: request.handler
              type: keyword
              description: >
                Request handler
            - name: request.method
              type: keyword
              description: >
                HTTP method
            - name: request.host
              type: keyword
              description: >
                Request host
            - name: process
              type: group
              fields:
                - name: cpu.sec
                  type: double
                  description: CPU seconds
                - name: memory.resident.bytes
                  type: long
                  format: bytes
                  description: Bytes in resident memory
                - name: memory.virtual.bytes
                  type: long
                  format: bytes
                  description: Bytes in virtual memory
                - name: fds.open.count
                  type: long
                  description: Number of open file descriptors
                - name: started.sec
                  type: double
                  description: Seconds since the process started
            - name: watch
              type: group
              fields:
                - name: events.size.bytes.bucket.*
                  type: object
                  object_type: long
                  description: Watch event size distribution in bytes
                - name: events.size.bytes.sum
                  type: long
                  format: bytes
                  description: Sum of watch events sizes in bytes
                - name: events.size.bytes.count
                  type: long
                  description: Number of watch events
                - name: events.kind
                  type: keyword
                  description: >
                    Resource kind of the watch event
            - name: response
              type: group
              fields:
                - name: size.bytes.bucket.*
                  type: object
                  object_type: long
                  description: >
                    Response size distribution in bytes for each group, version, verb, resource, subresource, scope and component.
                - name: size.bytes.sum
                  type: long
                  format: bytes
                  description: Sum of responses sizes in bytes
                - name: size.bytes.count
                  type: long
                  description: Number of responses to requests
            - name: client.request.count
              type: long
              description: Number of requests as client
            - name: request
              type: group
              fields:
                - name: count
                  type: long
                  description: Number of requests
                - name: duration.us.sum
                  type: long
                  description: Request duration, sum in microseconds
                - name: duration.us.count
                  type: long
                  description: Request duration, number of operations
                - name: duration.us.bucket.*
                  type: object
                  object_type: long
                  description: Response latency distribution, histogram buckets
                - name: current.count
                  type: long
                  description: Inflight requests
                - name: longrunning.count
                  type: long
                  description: Number of requests active long running requests
            - name: etcd.object.count
              type: long
              description: Number of kubernetes objects at etcd
            - name: audit.event.count
              type: long
              description: Number of audit events
            - name: audit.rejected.count
              type: long
              description: Number of audit rejected events
        - name: container
          type: group
          description: >
            kubernetes container metrics
          release: ga
          fields:
            - name: start_time
              type: date
              description: >
                Start time
            - name: cpu
              type: group
              description: >
                CPU usage metrics
              fields:
                - name: usage
                  type: group
                  fields:
                    - name: core
                      type: group
                      fields:
                        - name: ns
                          type: double
                          description: >
                            Container CPU Core usage nanoseconds
                    - name: nanocores
                      type: double
                      description: >
                        CPU used nanocores
                    - name: node.pct
                      type: scaled_float
                      format: percent
                      description: >
                        CPU usage as a percentage of the total node allocatable CPU
                    - name: limit.pct
                      type: scaled_float
                      format: percent
                      description: >
                        CPU usage as a percentage of the defined limit for the container (or total node allocatable CPU if unlimited). If the container CPU limits are missing and the `node` and `state_node` metricsets are both disabled on that node, this metric will be missing entirely.
            - name: logs
              type: group
              description: >
                Logs info
              fields:
                - name: available
                  type: group
                  fields:
                    - name: bytes
                      type: double
                      format: bytes
                      description: >
                        Logs available capacity in bytes
                - name: capacity
                  type: group
                  fields:
                    - name: bytes
                      type: double
                      format: bytes
                      description: >
                        Logs total capacity in bytes
                - name: used
                  type: group
                  fields:
                    - name: bytes
                      type: double
                      format: bytes
                      description: >
                        Logs used capacity in bytes
                - name: inodes
                  type: group
                  fields:
                    - name: count
                      type: double
                      description: >
                        Total available inodes
                    - name: free
                      type: double
                      description: >
                        Total free inodes
                    - name: used
                      type: double
                      description: >
                        Total used inodes
            - name: memory
              type: group
              fields:
                - name: available
                  type: group
                  fields:
                    - name: bytes
                      type: double
                      format: bytes
                      description: >
                        Total available memory
                - name: usage
                  type: group
                  fields:
                    - name: bytes
                      type: double
                      format: bytes
                      description: >
                        Total memory usage
                    - name: node.pct
                      type: scaled_float
                      format: percent
                      description: >
                        Memory usage as a percentage of the total node allocatable memory
                    - name: limit.pct
                      type: scaled_float
                      format: percent
                      description: >
                        Memory usage as a percentage of the defined limit for the container (or total node allocatable memory if unlimited). If the container Memory limits are missing and the `node` and `state_node` metricsets are both disabled on that node, this metric will be missing entirely.
                - name: rss
                  type: group
                  fields:
                    - name: bytes
                      type: double
                      format: bytes
                      description: >
                        RSS memory usage
                - name: workingset
                  type: group
                  fields:
                    - name: bytes
                      type: double
                      format: bytes
                      description: >
                        Working set memory usage
                    - name: limit.pct
                      type: scaled_float
                      format: percent
                      description: >
                        Working set memory usage as a percentage of the defined limit for the container (or total node allocatable memory if unlimited)
                - name: pagefaults
                  type: double
                  description: >
                    Number of page faults
                - name: majorpagefaults
                  type: double
                  description: >
                    Number of major page faults
            - name: rootfs
              type: group
              fields:
                - name: capacity
                  type: group
                  fields:
                    - name: bytes
                      type: double
                      format: bytes
                      description: >
                        Root filesystem total capacity in bytes
                - name: available
                  type: group
                  fields:
                    - name: bytes
                      type: double
                      format: bytes
                      description: >
                        Root filesystem total available in bytes
                - name: used
                  type: group
                  fields:
                    - name: bytes
                      type: double
                      format: bytes
                      description: >
                        Root filesystem total used in bytes
                - name: inodes
                  type: group
                  fields:
                    - name: used
                      type: double
                      description: >
                        Used inodes
        - name: controllermanager
          type: group
          description: >
            Controller manager metrics
          release: ga
          fields:
            - name: verb
              type: keyword
              description: >
                HTTP verb
            - name: code
              type: keyword
              description: >
                HTTP code
            - name: method
              type: keyword
              description: >
                HTTP method
            - name: host
              type: keyword
              description: >
                HTTP host
            - name: name
              type: keyword
              description: >
                Name for the resource
            - name: zone
              type: keyword
              description: >
                Infrastructure zone
            - name: process
              type: group
              fields:
                - name: cpu.sec
                  type: double
                  description: Total user and system CPU time spent in seconds
                - name: memory.resident.bytes
                  type: long
                  format: bytes
                  description: Bytes in resident memory
                - name: memory.virtual.bytes
                  type: long
                  format: bytes
                  description: Bytes in virtual memory
                - name: fds.open.count
                  type: long
                  description: Number of open file descriptors
                - name: fds.max.count
                  type: long
                  description: Limit for open file descriptors
                - name: started.sec
                  type: double
                  description: Start time of the process since unix epoch in seconds
            - name: client
              type: group
              fields:
                - name: request.count
                  type: long
                  description: Number of HTTP requests to API server, broken down by status code, method and host
                - name: request.duration.us.sum
                  type: long
                  description: Sum of requests latency in microseconds, broken down by verb and host
                - name: request.duration.us.count
                  type: long
                  description: Number of request duration operations to API server, broken down by verb and host
                - name: request.duration.us.bucket.*
                  type: object
                  object_type: long
                  description: Requests latency distribution in histogram buckets, broken down by verb and host
                - name: request.size.bytes.sum
                  type: long
                  format: bytes
                  description: Requests size sum in bytes, broken down by verb and host
                - name: request.size.bytes.count
                  type: long
                  description: Number of requests, broken down by verb and host
                - name: request.size.bytes.bucket.*
                  type: object
                  object_type: long
                  description: Requests size distribution in histogram buckets, broken down by verb and host
                - name: response.size.bytes.count
                  type: long
                  description: Number of responses, broken down by verb and host
                - name: response.size.bytes.sum
                  type: long
                  format: bytes
                  description: Responses size sum in bytes, broken down by verb and host
                - name: response.size.bytes.bucket.*
                  type: object
                  object_type: long
                  description: Responses size distribution in histogram buckets, broken down by verb and host
            - name: workqueue
              type: group
              fields:
                - name: longestrunning.sec
                  type: double
                  description: How many seconds has the longest running processor been running, broken down by workqueue name
                - name: unfinished.sec
                  type: double
                  description: How many seconds of work has done that is in progress and hasn't been considered in the longest running processor, broken down by workqueue name
                - name: adds.count
                  type: long
                  description: Workqueue add count, broken down by workqueue name
                - name: depth.count
                  type: long
                  description: Workqueue current depth, broken down by workqueue name
                - name: retries.count
                  type: long
                  description: Workqueue number of retries, broken down by workqueue name
            - name: node.collector
              type: group
              fields:
                - name: eviction.count
                  type: long
                  description: Number of node evictions, broken down by zone
                - name: unhealthy.count
                  type: long
                  description: Number of unhealthy nodes, broken down by zone
                - name: count
                  type: long
                  description: Number of nodes, broken down by zone
                - name: health.pct
                  type: long
                  description: Percentage of healthy nodes, broken down by zone
            - name: leader.is_master
              type: boolean
              description: >
                Whether the controller manager instance is leader
        
        - name: event
          type: group
          description: >
            The Kubernetes events metricset collects events that are generated by objects running
            inside of Kubernetes
          release: ga
          fields:
          - name: count
            type: long
            description: >
              Count field records the number of times the particular event has occurred
          - name: timestamp
            type: group
            fields:
            - name: first_occurrence
              type: date
              description: >
                Timestamp of first occurrence of event
            - name: last_occurrence
              type: date
              description: >
                Timestamp of last occurrence of event
          - name: message
            type: text
            description: >
              Message recorded for the given event
            copy_to: message
          - name: reason
            type: keyword
            description: >
              Reason recorded for the given event
          - name: type
            type: keyword
            description: >
              Type of the given event
          - name: source
            type: group
            description: >
              The component reporting this event
            fields:
            - name: component
              type: keyword
              description: >
                Component from which the event is generated
            - name: host
              type: keyword
              description: >
                Node name on which the event is generated
          - name: metadata
            type: group
            description: >
              Metadata associated with the given event
            fields:
            - name: timestamp
              type: group
              fields:
              - name: created
                type: date
                description: >
                  Timestamp of creation of the given event
            - name: generate_name
              type: keyword
              description: >
                Generate name of the event
            - name: name
              type: keyword
              description: >
                Name of the event
            - name: namespace
              type: keyword
              description: >
                Namespace in which event was generated
            - name: resource_version
              type: keyword
              description: >
                Version of the event resource
            - name: uid
              type: keyword
              description: >
                Unique identifier to the event object
            - name: self_link
              type: keyword
              description: >
                URL representing the event
          - name: involved_object
            type: group
            description: >
              Metadata associated with the given involved object
            fields:
            - name: api_version
              type: keyword
              description: >
                API version of the object
            - name: kind
              type: keyword
              description: >
                API kind of the object
            - name: name
              type: keyword
              description: >
                name of the object
            - name: resource_version
              type: keyword
              description: >
                resource version of the object
            - name: uid
              type: keyword
              description: >
                UUID version of the object
        - name: node
          type: group
          description: >
            kubernetes node metrics
          release: ga
          fields:
            - name: start_time
              type: date
              description: >
                Start time
            - name: cpu
              type: group
              description: >
                CPU usage metrics
              fields:
                - name: usage
                  type: group
                  fields:
                    - name: core
                      type: group
                      fields:
                        - name: ns
                          type: double
                          description: >
                            Node CPU Core usage nanoseconds
                    - name: nanocores
                      type: double
                      description: >
                        CPU used nanocores
            - name: memory
              type: group
              fields:
                - name: available
                  type: group
                  fields:
                    - name: bytes
                      type: double
                      format: bytes
                      description: >
                        Total available memory
                - name: usage
                  type: group
                  fields:
                    - name: bytes
                      type: double
                      format: bytes
                      description: >
                        Total memory usage
                - name: rss
                  type: group
                  fields:
                    - name: bytes
                      type: double
                      format: bytes
                      description: >
                        RSS memory usage
                - name: workingset
                  type: group
                  fields:
                    - name: bytes
                      type: double
                      format: bytes
                      description: >
                        Working set memory usage
                - name: pagefaults
                  type: double
                  description: >
                    Number of page faults
                - name: majorpagefaults
                  type: double
                  description: >
                    Number of major page faults
            - name: network
              type: group
              fields:
                - name: rx
                  type: group
                  fields:
                    - name: bytes
                      type: double
                      format: bytes
                      description: >
                        Received bytes on the default interface. If default interface is not defined, will be reported not correct value `0`
                    - name: errors
                      type: double
                      description: >
                        Rx errors on the default interface. If default interface is not defined, will be reported not correct value `0`
                - name: tx
                  type: group
                  fields:
                    - name: bytes
                      type: double
                      format: bytes
                      description: >
                        Transmitted bytes on the default interface. If default interface is not defined, will be reported not correct value `0`
                    - name: errors
                      type: double
                      description: >
                        Tx errors on the default interface. If default interface is not defined, will be reported not correct value `0`
            - name: fs
              type: group
              fields:
                - name: capacity
                  type: group
                  fields:
                    - name: bytes
                      type: double
                      format: bytes
                      description: >
                        Filesystem total capacity in bytes
                - name: available
                  type: group
                  fields:
                    - name: bytes
                      type: double
                      format: bytes
                      description: >
                        Filesystem total available in bytes
                - name: used
                  type: group
                  fields:
                    - name: bytes
                      type: double
                      format: bytes
                      description: >
                        Filesystem total used in bytes
                - name: inodes
                  type: group
                  fields:
                    - name: used
                      type: double
                      description: >
                        Number of used inodes
                    - name: count
                      type: double
                      description: >
                        Number of inodes
                    - name: free
                      type: double
                      description: >
                        Number of free inodes
            - name: runtime
              type: group
              fields:
                - name: imagefs
                  type: group
                  fields:
                    - name: capacity
                      type: group
                      fields:
                        - name: bytes
                          type: double
                          format: bytes
                          description: >
                            Image filesystem total capacity in bytes
                    - name: available
                      type: group
                      fields:
                        - name: bytes
                          type: double
                          format: bytes
                          description: >
                            Image filesystem total available in bytes
                    - name: used
                      type: group
                      fields:
                        - name: bytes
                          type: double
                          format: bytes
                          description: >
                            Image filesystem total used in bytes
        - name: pod
          type: group
          description: >
            kubernetes pod metrics
          release: ga
          fields:
            - name: start_time
              type: date
              description: >
                Start time
            - name: network
              type: group
              fields:
                - name: rx
                  type: group
                  fields:
                    - name: bytes
                      type: double
                      format: bytes
                      description: >
                        Received bytes
                    - name: errors
                      type: double
                      description: >
                        Rx errors
                - name: tx
                  type: group
                  fields:
                    - name: bytes
                      type: double
                      format: bytes
                      description: >
                        Transmitted bytes
                    - name: errors
                      type: double
                      description: >
                        Tx errors
            - name: cpu
              type: group
              description: >
                CPU usage metrics
              fields:
                - name: usage
                  type: group
                  fields:
                    - name: nanocores
                      type: double
                      description: >
                        CPU used nanocores
                    - name: node.pct
                      type: scaled_float
                      format: percent
                      description: >
                        CPU usage as a percentage of the total node CPU
                    - name: limit.pct
                      type: scaled_float
                      format: percent
                      description: >
                        CPU usage as a percentage of the defined limit for the pod containers (or total node CPU if one or more containers of the pod are unlimited). If one or more containers of the pod is unlimited and the `node` and `state_node` metricsets are both disabled on that node, this metric will be missing entirely.
            - name: memory
              type: group
              fields:
                - name: usage
                  type: group
                  fields:
                    - name: bytes
                      type: double
                      format: bytes
                      description: >
                        Total memory usage
                    - name: node.pct
                      type: scaled_float
                      format: percent
                      description: >
                        Memory usage as a percentage of the total node allocatable memory
                    - name: limit.pct
                      type: scaled_float
                      format: percent
                      description: >
                        Memory usage as a percentage of the defined limit for the pod containers (or total node allocatable memory if unlimited). If one or more containers of the pod is unlimited and the `node` and `state_node` metricsets are both disabled on that node, this metric will be missing entirely.
                - name: available
                  type: group
                  fields:
                    - name: bytes
                      type: double
                      format: bytes
                      description: >
                        Total memory available
                - name: working_set
                  type: group
                  fields:
                    - name: bytes
                      type: double
                      format: bytes
                      description: >
                        Total working set memory
                    - name: limit.pct
                      type: scaled_float
                      format: percent
                      description: >
                        Working set memory usage as a percentage of the defined limit for the pod containers (or total node allocatable memory if unlimited)
                - name: rss
                  type: group
                  fields:
                    - name: bytes
                      type: double
                      format: bytes
                      description: >
                        Total resident set size memory
                - name: page_faults
                  type: double
                  description: >
                    Total page faults
                - name: major_page_faults
                  type: double
                  description: >
                    Total major page faults
        - name: proxy
          type: group
          description: >
            Kubernetes proxy server metrics
          release: ga
          fields:
            - name: code
              type: keyword
              description: >
                HTTP code
            - name: method
              type: keyword
              description: >
                HTTP method
            - name: host
              type: keyword
              description: >
                HTTP host
            - name: verb
              type: keyword
              description: >
                HTTP verb
            - name: process
              type: group
              fields:
                - name: cpu.sec
                  type: double
                  description: Total user and system CPU time spent in seconds
                - name: memory.resident.bytes
                  type: long
                  format: bytes
                  description: Bytes in resident memory
                - name: memory.virtual.bytes
                  type: long
                  format: bytes
                  description: Bytes in virtual memory
                - name: fds.open.count
                  type: long
                  description: Number of open file descriptors
                - name: fds.max.count
                  type: long
                  description: Limit for open file descriptors
                - name: started.sec
                  type: double
                  description: Start time of the process since unix epoch in seconds
            - name: client
              type: group
              fields:
                - name: request.count
                  type: long
                  description: Number of HTTP requests to API server, broken down by status code, method and host
                - name: request.duration.us.sum
                  type: long
                  description: Sum of requests latency in microseconds, broken down by verb and host
                - name: request.duration.us.count
                  type: long
                  description: Number of request duration operations to API server, broken down by verb and host
                - name: request.duration.us.bucket.*
                  type: object
                  object_type: long
                  description: Requests latency distribution in histogram buckets, broken down by verb and host
                - name: request.size.bytes.sum
                  type: long
                  format: bytes
                  description: Requests size sum in bytes, broken down by verb and host
                - name: request.size.bytes.count
                  type: long
                  description: Number of requests, broken down by verb and host
                - name: request.size.bytes.bucket.*
                  type: object
                  object_type: long
                  description: Requests size distribution in histogram buckets, broken down by verb and host
                - name: response.size.bytes.count
                  type: long
                  description: Number of responses, broken down by verb and host
                - name: response.size.bytes.sum
                  type: long
                  format: bytes
                  description: Responses size sum in bytes, broken down by verb and host
                - name: response.size.bytes.bucket.*
                  type: object
                  object_type: long
                  description: Responses size distribution in histogram buckets, broken down by verb and host
            - name: sync
              type: group
              description: >
                kubeproxy proxy sync metrics
              fields:
                - name: rules.duration.us.sum
                  type: long
                  description: SyncProxyRules latency sum in microseconds
                - name: rules.duration.us.count
                  type: long
                  description: Number of SyncProxyRules latency operations
                - name: rules.duration.us.bucket.*
                  type: object
                  object_type: long
                  description: SyncProxyRules latency distribution in histogram buckets
                - name: networkprogramming.duration.us.sum
                  type: long
                  description: Sum of network programming latency in microseconds
                - name: networkprogramming.duration.us.count
                  type: long
                  description: Number of network programming latency operations
                - name: networkprogramming.duration.us.bucket.*
                  type: object
                  object_type: long
                  description: Network programming latency distribution in histogram buckets
        - name: scheduler
          type: group
          description: >
            Kubernetes scheduler metrics
          release: ga
          fields:
            - name: verb
              type: keyword
              description: >
                HTTP verb
            - name: host
              type: keyword
              description: >
                HTTP host
            - name: code
              type: keyword
              description: >
                HTTP code
            - name: method
              type: keyword
              description: >
                HTTP method
            - name: queue
              type: keyword
              description: >
                Scheduling queue
            - name: event
              type: keyword
              description: >
                Scheduling event
            - name: profile
              type: keyword
              description: >
                Scheduling profile
            - name: result
              type: keyword
              description: >
                Attempt result to schedule pod
            - name: name
              type: keyword
              description: >
                Name for the resource
            - name: leader.is_master
              type: boolean
              description: >
                Whether the scheduler instance is leader
            - name: process
              type: group
              fields:
                - name: cpu.sec
                  type: double
                  description: Total user and system CPU time spent in seconds
                - name: memory.resident.bytes
                  type: long
                  format: bytes
                  description: Bytes in resident memory
                - name: memory.virtual.bytes
                  type: long
                  format: bytes
                  description: Bytes in virtual memory
                - name: fds.open.count
                  type: long
                  description: Number of open file descriptors
                - name: fds.max.count
                  type: long
                  description: Limit for open file descriptors
                - name: started.sec
                  type: double
                  description: Start time of the process since unix epoch in seconds
            - name: client
              type: group
              fields:
                - name: request.count
                  type: long
                  description: Number of HTTP requests to API server, broken down by status code, method and host
                - name: request.duration.us.sum
                  type: long
                  description: Sum of requests latency in microseconds, broken down by verb and host
                - name: request.duration.us.count
                  type: long
                  description: Number of request duration operations to API server, broken down by verb and host
                - name: request.duration.us.bucket.*
                  type: object
                  object_type: long
                  description: Requests latency distribution in histogram buckets, broken down by verb and host
                - name: request.size.bytes.sum
                  type: long
                  format: bytes
                  description: Requests size sum in bytes, broken down by verb and host
                - name: request.size.bytes.count
                  type: long
                  description: Number of requests, broken down by verb and host
                - name: request.size.bytes.bucket.*
                  type: object
                  object_type: long
                  description: Requests size distribution in histogram buckets, broken down by verb and host
                - name: response.size.bytes.count
                  type: long
                  description: Number of responses, broken down by verb and host
                - name: response.size.bytes.sum
                  type: long
                  format: bytes
                  description: Responses size sum in bytes, broken down by verb and host
                - name: response.size.bytes.bucket.*
                  type: object
                  object_type: long
                  description: Responses size distribution in histogram buckets, broken down by verb and host
            - name: workqueue
              type: group
              fields:
                - name: longestrunning.sec
                  type: double
                  description: How many seconds has the longest running processor been running, broken down by workqueue name
                - name: unfinished.sec
                  type: double
                  description: How many seconds of work has done that is in progress and hasn't been considered in the longest running processor, broken down by workqueue name
                - name: adds.count
                  type: long
                  description: Workqueue add count, broken down by workqueue name
                - name: depth.count
                  type: long
                  description: Workqueue current depth, broken down by workqueue name
                - name: retries.count
                  type: long
                  description: Workqueue number of retries, broken down by workqueue name
            - name: scheduling
              type: group
              fields:
                - name: pending.pods.count
                  type: long
                  description: Number of current pending pods, broken down by the queue type
                - name: preemption.victims.bucket.*
                  type: object
                  object_type: long
                  description: Number of preemption victims distribution in histogram buckets
                - name: preemption.victims.sum
                  type: long
                  description: Preemption victims sum
                - name: preemption.victims.count
                  type: long
                  description: Number of preemption victims
                - name: preemption.attempts.count
                  type: long
                  description: Total preemption attempts in the cluster so far
                - name: attempts.duration.us.bucket.*
                  type: object
                  object_type: long
                  description: Scheduling attempt latency distribution in histogram buckets, broken down by profile and result
                - name: attempts.duration.us.sum
                  type: long
                  description: Sum of scheduling attempt latency in microseconds, broken down by profile and result
                - name: attempts.duration.us.count
                  type: long
                  description: Number of scheduling attempts, broken down by profile and result
        - name: container
          type: group
          description: >
            kubernetes container metrics
          release: ga
          fields:
            - name: id
              type: keyword
              description:
                Container id
            - name: status
              type: group
              fields:
                - name: phase
                  type: keyword
                  description: >
                        Container phase (running, waiting, terminated)
                - name: ready
                  type: boolean
                  description: >
                    Container ready status
                - name: restarts
                  type: integer
                  description: >
                    Container restarts count
                - name: reason
                  type: keyword
                  description: >
                    The reason the container is currently in waiting (ContainerCreating, CrashLoopBackoff, ErrImagePull,
                    ImagePullBackoff) or terminated (Completed, ContainerCannotRun, Error, OOMKilled) state.
                - name: last_terminated_reason
                  type: keyword
                  description: >
                    The last reason the container was in terminated state (Completed, ContainerCannotRun, Error or OOMKilled).
            - name: cpu
              type: group
              fields:
                - name: limit.cores
                  type: float
                  description: >
                    Container CPU cores limit
                - name: request.cores
                  type: float
                  description: >
                    Container CPU requested cores
            - name: memory
              type: group
              fields:
                - name: limit.bytes
                  type: long
                  format: bytes
                  description: >
                    Container memory limit in bytes
                - name: request.bytes
                  type: long
                  format: bytes
                  description: >
                    Container requested memory in bytes
        - name: cronjob
          type: group
          description: >
            kubernetes cronjob metrics
          release: ga
          fields:
            - name: name
              type: keyword
              description: Cronjob name
            - name: schedule
              type: keyword
              description: Cronjob schedule
            - name: concurrency
              type: keyword
              description: Concurrency policy
            - name: active.count
              type: long
              description: Number of active pods for the cronjob
            - name: is_suspended
              type: boolean
              description: Whether the cronjob is suspended
            - name: created.sec
              type: double
              description: Epoch seconds since the cronjob was created
            - name: last_schedule.sec
              type: double
              description: Epoch seconds for last cronjob run
            - name: next_schedule.sec
              type: double
              description: Epoch seconds for next cronjob run
            - name: deadline.sec
              type: long
              description: Deadline seconds after schedule for considering failed
        
        
        
        
              
              
        
        
        - name: daemonset
          type: group
          description: >
            Kubernetes DaemonSet metrics
          release: ga
          fields:
            - name: name
              type: keyword
            - name: replicas
              type: group
              description: >
                Kubernetes DaemonSet replica metrics
              fields:
                - name: available
                  type: long
                  description: >
                    The number of available replicas per DaemonSet
                - name: desired
                  type: long
                  description: >
                    The desired number of replicas per DaemonSet
                - name: ready
                  type: long
                  description: >
                    The number of ready replicas per DaemonSet
                - name: unavailable
                  type: long
                  description: >
                    The number of unavailable replicas per DaemonSet
        - name: deployment
          type: group
          description: >
            kubernetes deployment metrics
          release: ga
          fields:
            - name: paused
              type: boolean
              description: >
                Kubernetes deployment paused status
            - name: status
              type: group
              fields:
                - name: available
                  type: keyword
                  description: |
                    Deployment Available Condition status (true, false or unknown)
                - name: progressing
                  type: keyword
                  description: Deployment Progresing Condition status (true, false or unknown)
            - name: replicas
              type: group
              description: >
                Kubernetes deployment replicas info
              fields:
                - name: desired
                  type: integer
                  description: >
                    Deployment number of desired replicas (spec)
                - name: available
                  type: integer
                  description: >
                    Deployment available replicas
                - name: unavailable
                  type: integer
                  description: >
                    Deployment unavailable replicas
                - name: updated
                  type: integer
                  description: >
                    Deployment updated replicas
        - name: job
          type: group
          release: ga
          description: >
            Kubernetes job metrics
          fields:
            - name: name
              type: keyword
              description: >
                The name of the job resource
            - name: pods
              type: group
              description: >
                Pod metrics for the job
              fields:
                - name: active
                  type: long
                  description: >
                    Number of active pods
                - name: failed
                  type: long
                  description: >
                    Number of failed pods
                - name: succeeded
                  type: long
                  description: >
                    Number of successful pods
            - name: time
              type: group
              description: >
                Kubernetes job timestamps
              fields:
                - name: created
                  type: date
                  description: >
                    The time at which the job was created
                - name: completed
                  type: date
                  description: >
                    The time at which the job completed
            - name: completions
              type: group
              description: >
                Kubernetes job completion settings
              fields:
                - name: desired
                  type: long
                  description: >
                    The configured completion count for the job (Spec)
            - name: parallelism
              type: group
              description: >
                Kubernetes job parallelism settings
              fields:
                - name: desired
                  type: long
                  description: >
                    The configured parallelism of the job (Spec)
            - name: owner
              type: group
              description: >
                Kubernetes job owner information
              fields:
                - name: name
                  type: keyword
                  description: >
                    The name of the resource that owns this job
                - name: kind
                  type: keyword
                  description: >
                    The kind of resource that owns this job (eg. "CronJob")
                - name: is_controller
                  type: keyword
                  description: >
                    Owner is controller ("true", "false", or "<none>")
            - name: status
              type: group
              description: >
                Kubernetes job status information
              fields:
                - name: complete
                  type: keyword
                  description: >
                    Whether the job completed ("true", "false", or "unknown")
                - name: failed
                  type: keyword
                  description: >
                    Whether the job failed ("true", "false", or "unknown")
        - name: node
          type: group
          description: >
            kubernetes node metrics
          release: ga
          fields:
            - name: status
              type: group
              fields:
                - name: ready
                  type: keyword
                  description: >
                    Node ready status (true, false or unknown)
                - name: unschedulable
                  type: boolean
                  description: >
                    Node unschedulable status
                - name: memory_pressure
                  type: keyword
                  description: >
                    Node MemoryPressure status (true, false or unknown)
                - name: disk_pressure
                  type: keyword
                  description: >
                    Node DiskPressure status (true, false or unknown)
                - name: out_of_disk
                  type: keyword
                  description: >
                    Node OutOfDisk status (true, false or unknown)
                - name: pid_pressure
                  type: keyword
                  description: >
                    Node PIDPressure status (true, false or unknown)
                - name: network_unavailable
                  type: keyword
                  description: >
                    Node NetworkUnavailable status (true, false or unknown)
            - name: cpu
              type: group
              fields:
                - name: allocatable.cores
                  type: float
                  description: >
                    The allocatable CPU cores of a node that are available for pods scheduling
                - name: capacity.cores
                  type: long
                  description: >
                    Node CPU capacity cores
            - name: memory
              type: group
              fields:
                - name: allocatable.bytes
                  type: long
                  format: bytes
                  description: >
                    The allocatable memory of a node in bytes that is available for pods scheduling
                - name: capacity.bytes
                  type: long
                  format: bytes
                  description: >
                    Node memory capacity in bytes
            - name: pod
              type: group
              fields:
                - name: allocatable.total
                  type: long
                  description: >
                    Node allocatable pods
                - name: capacity.total
                  type: long
                  description: >
                    Node pod capacity
        - name: persistentvolume
          type: group
          description: >
            kubernetes persistent volume metrics from kube-state-metrics
          release: ga
          fields:
            - name: name
              type: keyword
              description: Volume name.
            - name: capacity.bytes
              type: long
              description: Volume capacity
            - name: phase
              type: keyword
              description: Volume phase according to kubernetes
            - name: storage_class
              type: keyword
              description: Storage class for the volume
              
              
        
        - name: persistentvolumeclaim
          type: group
          description: >
            kubernetes persistent volume clame metrics from kube-state-metrics
          release: ga
          fields:
            - name: name
              type: keyword
              description: PVC name.
            - name: volume_name
              type: keyword
              description: Binded volume name.
            - name: request_storage.bytes
              type: long
              description: Requested capacity.
            - name: phase
              type: keyword
              description: PVC phase.
            - name: access_mode
              type: keyword
              description: Access mode.
            - name: storage_class
              type: keyword
              description: Storage class for the PVC.
              
        - name: pod
          type: group
          description: >
            kubernetes pod metrics
          release: ga
          fields:
            - name: host_ip
              type: ip
              description: >
                Kubernetes pod host IP
            - name: status
              type: group
              description: >
                Kubernetes pod status metrics
              fields:
                - name: phase
                  type: keyword
                  description: >
                    Kubernetes pod phase (Running, Pending...)
                - name: ready
                  type: keyword
                  description: >
                    Kubernetes pod ready status (true, false or unknown)
                - name: scheduled
                  type: keyword
                  description: >
                    Kubernetes pod scheduled status (true, false, unknown)
        - name: replicaset
          type: group
          description: >
            kubernetes replica set metrics
          release: ga
          fields:
            - name: replicas
              type: group
              description: >
                Kubernetes replica set paused status
              fields:
                - name: available
                  type: long
                  description: >
                    The number of replicas per ReplicaSet
                - name: desired
                  type: long
                  description: >
                    The number of replicas per ReplicaSet
                - name: ready
                  type: long
                  description: >
                    The number of ready replicas per ReplicaSet
                - name: observed
                  type: long
                  description: >
                    The generation observed by the ReplicaSet controller
                - name: labeled
                  type: long
                  description: >
                    The number of fully labeled replicas per ReplicaSet
        - name: resourcequota
          type: group
          description: >
            kubernetes resourcequota metrics
          release: ga
          fields:
            - name: created.sec
              type: double
              description: Epoch seconds since the ResourceQuota was created
            - name: quota
              type: double
              description: Quota informed (hard or used) for the resource
            - name: name
              type: keyword
              description: ResourceQuota name
            - name: type
              type: keyword
              description: Quota information type, `hard` or `used`
            - name: resource
              type: keyword
              description: Resource name the quota applies to
        
              
              
        
        
        - name: service
          type: group
          description: >
            kubernetes service metrics
          release: ga
          fields:
            - name: name
              type: keyword
              description: Service name.
            - name: cluster_ip
              type: keyword
              description: Internal IP for the service.
            - name: external_name
              type: keyword
              description: Service external DNS name
            - name: external_ip
              type: keyword
              description: Service external IP
            - name: load_balancer_ip
              type: keyword
              description: Load Balancer service IP
            - name: type
              type: keyword
              description: Service type
            - name: ingress_ip
              type: keyword
              description: Ingress IP
            - name: ingress_hostname
              type: keyword
              description: Ingress Hostname
            - name: created
              type: date
              description: Service creation date
        - name: statefulset
          type: group
          description: >
            kubernetes stateful set metrics
          release: ga
          fields:
            - name: created
              type: long
              description: >
                The creation timestamp (epoch) for StatefulSet
            - name: replicas
              type: group
              description: >
                Kubernetes stateful set replicas status
              fields:
                - name: observed
                  type: long
                  description: >
                    The number of observed replicas per StatefulSet
                - name: desired
                  type: long
                  description: >
                    The number of desired replicas per StatefulSet
                - name: ready
                  type: long
                  description: >
                    The number of ready replicas per StatefulSet
            - name: generation
              type: group
              description: >
                Kubernetes stateful set generation information
              fields:
                - name: observed
                  type: long
                  description: >
                    The observed generation per StatefulSet
                - name: desired
                  type: long
                  description: >
                    The desired generation per StatefulSet
        - name: storageclass
          type: group
          description: >
            kubernetes storage class metrics
          release: ga
          fields:
            - name: name
              type: keyword
              description: Storage class name.
            - name: provisioner
              type: keyword
              description: Volume provisioner for the storage class.
            - name: reclaim_policy
              type: keyword
              description: Reclaim policy for dynamically created volumes
            - name: volume_binding_mode
              type: keyword
              description: Mode for default provisioning and binding
            - name: created
              type: date
              description: Storage class creation date
        - name: system
          type: group
          description: >
            kubernetes system containers metrics
          release: ga
          fields:
            - name: container
              type: keyword
              description: >
                Container name
            - name: start_time
              type: date
              description: >
                Start time
            - name: cpu
              type: group
              description: >
                CPU usage metrics
              fields:
                - name: usage
                  type: group
                  fields:
                    - name: core
                      type: group
                      fields:
                        - name: ns
                          type: double
                          description: >
                            CPU Core usage nanoseconds
                    - name: nanocores
                      type: double
                      description: >
                        CPU used nanocores
            - name: memory
              type: group
              fields:
                - name: usage
                  type: group
                  fields:
                    - name: bytes
                      type: double
                      format: bytes
                      description: >
                        Total memory usage
                - name: rss
                  type: group
                  fields:
                    - name: bytes
                      type: double
                      format: bytes
                      description: >
                        RSS memory usage
                - name: workingset
                  type: group
                  fields:
                    - name: bytes
                      type: double
                      format: bytes
                      description: >
                        Working set memory usage
                - name: pagefaults
                  type: double
                  description: >
                    Number of page faults
                - name: majorpagefaults
                  type: double
                  description: >
                    Number of major page faults
        - name: volume
          type: group
          description: >
            kubernetes volume metrics
          release: ga
          fields:
            - name: name
              type: keyword
              description: >
                Volume name
            - name: fs
              type: group
              fields:
                - name: capacity
                  type: group
                  fields:
                    - name: bytes
                      type: double
                      format: bytes
                      description: >
                        Filesystem total capacity in bytes
                - name: available
                  type: group
                  fields:
                    - name: bytes
                      type: double
                      format: bytes
                      description: >
                        Filesystem total available in bytes
                - name: used
                  type: group
                  fields:
                    - name: bytes
                      type: double
                      format: bytes
                      description: >
                        Filesystem total used in bytes
                    - name: pct
                      type: scaled_float
                      format: percent
                      description: >
                        Percentage of used storage
                - name: inodes
                  type: group
                  fields:
                    - name: used
                      type: double
                      description: >
                        Used inodes
                    - name: free
                      type: double
                      description: >
                        Free inodes
                    - name: count
                      type: double
                      description: >
                        Total inodes
                    - name: pct
                      type: scaled_float
                      format: percent
                      description: >
                        Percentage of used inodes
- key: kvm
  title: "KVM"
  release: beta
  description: >
    kvm module
  fields:
    - name: kvm.id
      type: long
      description: >
        Domain id
    - name: kvm.name
      type: keyword
      description: >
        Domain name
    - name: kvm
      type: group
      description: >
      fields:
        - name: dommemstat
          type: group
          description: >
            dommemstat
          release: beta
          fields:
              - name: stat
                type: group
                description: >
                  Memory stat
                fields:
                  - name: name
                    type: keyword
                    description: >
                      Memory stat name
                  - name: value
                    type: long
                    description: >
                      Memory stat value
              - name: id
                type: long
                description: >
                  Domain id
              - name: name
                type: keyword
                description: >
                  Domain name
        - name: status
          type: group
          description: >
            status
          release: beta
          fields:
            - name: state
              type: keyword
              description: >
                Domain state
- key: linux
  title: "Linux"
  release: beta
  description: >
    linux module
  fields:
    - name: linux
      type: group
      description: >
        linux system metrics
      fields:
        - name: conntrack
          type: group
          release: beta
          description: >
            conntrack
          fields:
            - name: summary
              type: group
              description: >
                summary of nf_conntrack statistics, summed across CPU cores
              fields:
                - name: drop
                  type: long
                  description: >
                    packets dropped due to conntrack failiure
                - name: early_drop
                  type: long
                  description: >
                    conntrack entries dropped to make room for new ones
                - name: entries
                  type: long
                  description: >
                    entries in the conntrack table
                - name: found
                  type: long
                  description: >
                    successfully searched entries
                - name: ignore
                  type: long
                  description: >
                    packets seen already connected to a conntrack entry
                - name: insert_failed
                  type: long
                  description: >
                    Number of entries where list insert insert failed 
                - name: invalid
                  type: long
                  description: > 
                    packets seen that cannot be tracked
                - name: search_restart
                  type: long
                  description: >
                    table lookups which had to be restarted due to table resizes
        - name: iostat
          type: group
          release: beta
          description: >
            iostat
          fields:
            - name: read.request.merges_per_sec
              type: float
              description: >
                  The number of read requests merged per second that were queued to the device.
            - name: write.request.merges_per_sec
              type: float
              description: >
                  The number of write requests merged per second that were queued to the device.
            - name: read.request.per_sec
              type: float
              description: >
                  The number of read requests that were issued to the device per second
            - name: write.request.per_sec
              type: float
              description: >
                  The number of write requests that were issued to the device per second
            - name: read.per_sec.bytes
              type: float
              description: >
                  The number of Bytes read from the device per second.
              format: bytes
            - name: read.await
              type: float
              description: >
                  The average time spent for read requests issued to the device to be served.
            - name: write.per_sec.bytes
              type: float
              description: >
                  The number of Bytes write from the device per second.
              format: bytes
            - name: write.await
              type: float
              description: >
                  The average time spent for write requests issued to the device to be served.
            - name: request.avg_size
              type: float
              description: >
                  The average size (in bytes) of the requests that were issued to the device.
            - name: queue.avg_size
              type: float
              description: >
                  The average queue length of the requests that were issued to the device.
            - name: await
              type: float
              description: >
                  The average time spent for requests issued to the device to be served.
            - name: service_time
              type: float
              description: >
                  The average service time (in milliseconds) for I/O requests that were issued to the device.
            - name: busy
              type: float
              description: >
                  Percentage of CPU time during which I/O requests were issued to the device (bandwidth utilization for the device). Device saturation occurs when this value is close to 100%.
        
        - name: ksm
          type: group
          release: beta
          description: >
            ksm
          fields:
            - name: stats
              type: group
              description: >
                KSM statistics
              fields:
                - name: pages_shared
                  type: long
                  description: >
                    Shared pages in use.
                - name: pages_sharing
                  type: long
                  description: >
                    Sites sharing pages.
                - name: pages_unshared
                  type: long
                  description: >
                    Unique pages.
                - nmae: pages_volatile
                  type: long
                  description: >
                    Pages changing too fast to be shared.
                - name: full_scans
                  type: long
                  description: >
                    Number of times mergable pages have been scanned.
                - name: stable_node_chains
                  type: long
                  description: >
                    Pages that have reached max_page_sharing.
                - name: stable_node_dups
                  type: long
                  description: >
                    Number of duplicated KSM pages.
        - name: memory
          type: group
          release: beta
          description: >
            Linux memory data
          fields:
            - name: page_stats
              type: group
              description: memory page statistics
              fields:
                - name: pgscan_kswapd.pages
                  type: long
                  format: number
                  description: pages scanned by kswapd
                - name: pgscan_direct.pages
                  type: long
                  format: number
                  description: pages scanned directly
                - name: pgfree.pages
                  type: long
                  format: number
                  description: pages freed by the system
                - name: pgsteal_kswapd.pages
                  type: long
                  format: number
                  description: number of pages reclaimed by kswapd
                - name: pgsteal_direct.pages
                  type: long
                  format: number
                  description: number of pages reclaimed directly
                - name: direct_efficiency.pct
                  type: scaled_float
                  format: percent
                  description: direct reclaim efficiency percentage. A lower percentage indicates the system is struggling to reclaim memory.
                - name: kswapd_efficiency.pct
                  type: scaled_float
                  format: percent
                  description: kswapd reclaim efficiency percentage. A lower percentage indicates the system is struggling to reclaim memory.
            - name: hugepages
              type: group
              prefix: "[float]"
              description: This group contains statistics related to huge pages usage on the system.
              fields:
                - name: total
                  type: long
                  format: number
                  description: >
                    Number of huge pages in the pool.
                - name: used.bytes
                  type: long
                  format: bytes
                  description: >
                    Memory used in allocated huge pages.
                - name: used.pct
                  type: long
                  format: percent
                  description: >
                    Percentage of huge pages used.
                - name: free
                  type: long
                  format: number
                  description: >
                    Number of available huge pages in the pool.
                - name: reserved
                  type: long
                  format: number
                  description: >
                    Number of reserved but not allocated huge pages in the pool.
                - name: surplus
                  type: long
                  format: number
                  description: >
                    Number of overcommited huge pages.
                - name: default_size
                  type: long
                  format: bytes
                  description: >
                    Default size for huge pages.
            - name: swap
              type: group
              prefix: "[float]"
              description: This group contains statistics related to the swap memory usage on the system.
              fields:
                - name: total
                  type: long
                  format: bytes
                  description: >
                    Total swap memory.
                - name: used.bytes
                  type: long
                  format: bytes
                  description: >
                    Used swap memory.
                - name: free
                  type: long
                  format: bytes
                  description: >
                    Available swap memory.
                - name: used.pct
                  type: scaled_float
                  format: percent
                  description: >
                    The percentage of used swap memory.
                - name: in.pages
                  type: long
                  description: >
                    Pages swapped in.
                - name: out.pages
                  type: long
                  description: >
                    Pages swapped out.
                - name: readahead.cached
                  type: long
                  description: >
                    Swap readahead pages hit from swap_ra_hit.
                - name: readahead.pages
                  type: long
                  description: >
                    Pages swapped based on readahead predictions.
        - name: pageinfo
          type: group
          release: beta
          description: >
            pageinfo
          fields:
            - name: buddy_info
              type: group
              description: >
                Data from /proc/buddyinfo grouping used pages by order
              fields:
                - name: DMA
                  type: group
                  description: >
                    DMA page Data
                  fields:
                    - name: "0"
                      type: long
                      description: >
                        free chunks of 2^0*PAGE_SIZE
                    - name: "1"
                      type: long
                      description: >
                        free chunks of 2^1*PAGE_SIZE
                    - name: "2"
                      type: long
                      description: >
                        free chunks of 2^2*PAGE_SIZE
                    - name: "3"
                      type: long
                      description: >
                        free chunks of 2^3*PAGE_SIZE
                    - name: "4"
                      type: long
                      description: >
                        free chunks of 2^4*PAGE_SIZE
                    - name: "5"
                      type: long
                      description: >
                        free chunks of 2^5*PAGE_SIZE
                    - name: "6"
                      type: long
                      description: >
                        free chunks of 2^6*PAGE_SIZE
                    - name: "7"
                      type: long
                      description: >
                        free chunks of 2^7*PAGE_SIZE
                    - name: "8"
                      type: long
                      description: >
                        free chunks of 2^8*PAGE_SIZE
                    - name: "9"
                      type: long
                      description: >
                        free chunks of 2^9*PAGE_SIZE
                    - name: "10"
                      type: long
                      description: >
                        free chunks of 2^10*PAGE_SIZE
            - name: nodes.*
              type: object
              description: >
                    Raw allocation info from /proc/pagetypeinfo
        
        - name: pressure
          type: group
          release: beta
          description: Linux pressure stall information metrics for cpu, memory, and io
          fields:
            - name: cpu.some.10.pct
              type: float
              format: percent
              description: >
                The average share of time in which at least some tasks were stalled on CPU over a ten second window.
            - name: cpu.some.60.pct
              type: float
              format: percent
              description: >
                The average share of time in which at least some tasks were stalled on CPU over a sixty second window.
            - name: cpu.some.300.pct
              type: float
              format: percent
              description: >
                The average share of time in which at least some tasks were stalled on CPU over a three hundred second window.
            - name: cpu.some.total.time.us
              type: long
              description: >
                The total absolute stall time (in microseconds) in which at least some tasks were stalled on CPU.
            - name: memory.some.10.pct
              type: float
              format: percent
              description: >
                The average share of time in which at least some tasks were stalled on Memory over a ten second window.
            - name: memory.some.60.pct
              type: float
              format: percent
              description: >
                The average share of time in which at least some tasks were stalled on Memory over a sixty second window.
            - name: memory.some.300.pct
              type: float
              format: percent
              description: >
                The average share of time in which at least some tasks were stalled on Memory over a three hundred second window.
            - name: memory.some.total.time.us
              type: long
              description: >
                The total absolute stall time (in microseconds) in which at least some tasks were stalled on memory.
            - name: memory.full.10.pct
              type: float
              format: percent
              description: >
                The average share of time in which in which all non-idle tasks were stalled on memory simultaneously over a ten second window.
            - name: memory.full.60.pct
              type: float
              format: percent
              description: >
                The average share of time in which in which all non-idle tasks were stalled on memory simultaneously over a sixty second window.
            - name: memory.full.300.pct
              type: float
              format: percent
              description: >
                The average share of time in which in which all non-idle tasks were stalled on memory simultaneously over a three hundred second window.
            - name: memory.full.total.time.us
              type: long
              description: >
                The total absolute stall time (in microseconds) in which in which all non-idle tasks were stalled on memory.
            - name: io.some.10.pct
              type: float
              format: percent
              description: >
                The average share of time in which at least some tasks were stalled on io over a ten second window.
            - name: io.some.60.pct
              type: float
              format: percent
              description: >
                The average share of time in which at least some tasks were stalled on io over a sixty second window.
            - name: io.some.300.pct
              type: float
              format: percent
              description: >
                The average share of time in which at least some tasks were stalled on io over a three hundred second window.
            - name: io.some.total.time.us
              type: long
              description: >
                The total absolute stall time (in microseconds) in which at least some tasks were stalled on io.
            - name: io.full.10.pct
              type: float
              format: percent
              description: >
                The average share of time in which in which all non-idle tasks were stalled on io simultaneously over a ten second window.
            - name: io.full.60.pct
              type: float
              format: percent
              description: >
                The average share of time in which in which all non-idle tasks were stalled on io simultaneously over a sixty second window.
            - name: io.full.300.pct
              type: float
              format: percent
              description: >
                The average share of time in which in which all non-idle tasks were stalled on io simultaneously over a three hundred second window.
            - name: io.full.total.time.us
              type: long
              description: >
                The total absolute stall time (in microseconds) in which in which all non-idle tasks were stalled on io.
        - name: rapl
          type: group
          release: beta
          description: >
            Wattage as reported by Intel RAPL
          fields:
            - name: core
              type: long
              description: >
                The core where the RAPL request originated from. Only one core is queried per hardware CPU.
            - name: dram.watts
              type: float
              description: >
                Power usage in watts on the DRAM RAPL domain
            - name: dram.joules
              type: float
              description: >
                Raw power usage counter for the DRAM domain
        
            - name: pp0.watts
              type: float
              description: >
                Power usage in watts on the PP0 RAPL domain
            - name: pp0.joules
              type: float
              description: >
                Raw power usage counter for the PP0 domain
        
            - name: pp1.watts
              type: float
              description: >
                Power usage in watts on the PP1 RAPL domain
            - name: pp1.joules
              type: float
              description: >
                Raw power usage counter for the PP1 domain
        
            - name: package.watts
              type: float
              description: >
                Power usage in watts on the Package RAPL domain
            - name: package.joules
              type: float
              description: >
                Raw power usage counter for the package domain
- key: logstash
  title: "Logstash"
  description: >
    Logstash module
  release: ga
  settings: ["ssl", "http"]
  short_config: false
  fields:
    - name: logstash_stats
      type: group
      fields:
        - name: timestamp
          type: alias
          path: "@timestamp"
        - name: jvm
          type: group
          fields:
            - name: mem
              type: group
              fields:
                - name: heap_used_in_bytes
                  type: alias
                  path: logstash.node.stats.jvm.mem.heap_used_in_bytes
                - name: heap_max_in_bytes
                  type: alias
                  path: logstash.node.stats.jvm.mem.heap_max_in_bytes
            - name: uptime_in_millis
              type: alias
              path: logstash.node.stats.jvm.uptime_in_millis
        - name: events
          type: group
          fields:
            - name: in
              type: alias
              path: logstash.node.stats.events.in
            - name: out
              type: alias
              path: logstash.node.stats.events.out
            - name: duration_in_millis
              type: alias
              path: logstash.node.stats.events.duration_in_millis
        - name: logstash
          type: group
          fields:
            - name: uuid
              type: alias
              path: logstash.node.stats.logstash.uuid
            - name: version
              type: alias
              path: logstash.node.stats.logstash.version
        - name: pipelines
          type: nested
        - name: os
          type: group
          fields:
            - name: cpu
              type: group
              fields:
                - name: load_average
                  type: group
                  fields:
                    - name: 15m
                      type: alias
                      path: logstash.node.stats.os.cpu.load_average.15m
                    - name: 1m
                      type: alias
                      path: logstash.node.stats.os.cpu.load_average.1m
                    - name: 5m
                      type: alias
                      path: logstash.node.stats.os.cpu.load_average.5m
            - name: cgroup
              type: group
              fields:
                - name: cpuacct.usage_nanos
                  type: alias
                  path: logstash.node.stats.os.cgroup.cpuacct.usage_nanos
                - name: cpu
                  type: group
                  fields:
                    - name: cfs_quota_micros
                      type: alias
                      path: logstash.node.stats.os.cgroup.cpu.cfs_quota_micros
                    - name: stat
                      type: group
                      fields:
                        - name: number_of_elapsed_periods
                          type: alias
                          path: logstash.node.stats.os.cgroup.cpu.stat.number_of_elapsed_periods
                        - name: time_throttled_nanos
                          type: alias
                          path: logstash.node.stats.os.cgroup.cpu.stat.time_throttled_nanos
                        - name: number_of_times_throttled
                          type: alias
                          path: logstash.node.stats.os.cgroup.cpu.stat.number_of_times_throttled
        - name: process.cpu.percent
          type: alias
          path: logstash.node.stats.process.cpu.percent
        - name: queue.events_count
          type: alias
          path: logstash.node.stats.queue.events_count
    - name: logstash_state
      type: group
      fields:
        - name: pipeline.id
          type: alias
          path: logstash.node.state.pipeline.id
        - name: pipeline.hash
          type: alias
          path: logstash.node.state.pipeline.hash
    - name: logstash
      type: group
      fields:
        - name: elasticsearch.cluster.id
          type: keyword
        - name: node
          type: group
          description: >
            node
          release: ga
          fields:
        - name: node
          type: group
          description: >
            node_stats metrics.
          release: ga
          fields:
            - name: id
              type: keyword
            - name: state.pipeline
              type: group
              fields:
                - name: id
                  type: keyword
                - name: hash
                  type: keyword
                - name: ephemeral_id
                  type: keyword
                - name: batch_size
                  type: long
                - name: workers
                  type: long
                - name: representation
                  type: group
                  fields:
                    - name: hash
                      type: keyword
                    - name: type
                      type: keyword
                    - name: version
                      type: keyword
                    - name: graph
                      type: group
                      fields:
                        - name: edges
                          type: object
                        - name: vertices
                          type: object
            - name: host
              type: alias
              path: host.hostname
              migration: true
              description: >
                Host name
            - name: version
              type: alias
              path: service.version
              migration: true
              description: >
                Logstash Version
            - name: jvm
              type: group
              description: >
                JVM Info
              fields:
                - name: version
                  type: keyword
                  description: >
                    Version
                - name: pid
                  type: alias
                  path: process.pid
                  migration: true
                  description: >
                    Process ID
            - name: stats
              type: group
              fields:
                - name: timestamp
                  type: date
                - name: jvm
                  type: group
                  fields:
                    - name: uptime_in_millis
                      type: long
                    - name: mem
                      type: group
                      fields:
                        - name: heap_used_in_bytes
                          type: long
                        - name: heap_max_in_bytes
                          type: long
                - name: events
                  type: group
                  description: >
                    Events stats
                  fields:
                    - name: in
                      type: long
                      description: >
                        Incoming events counter.
                    - name: out
                      type: long
                      description: >
                        Outgoing events counter.
                    - name: filtered
                      type: long
                      description: >
                        Filtered events counter.
                    - name: duration_in_millis
                      type: long
                - name: logstash
                  type: group
                  fields:
                    - name: uuid
                      type: keyword
                    - name: version
                      type: keyword
                - name: os
                  type: group
                  fields:
                    - name: cpu
                      type: group
                      fields:
                        - name: load_average
                          type: group
                          fields:
                            - name: 15m
                              type: half_float
                            - name: 1m
                              type: half_float
                            - name: 5m
                              type: half_float
                    - name: cgroup
                      type: group
                      fields:
                        - name: cpuacct.usage_nanos
                          type: long
                        - name: cpu
                          type: group
                          fields:
                            - name: cfs_quota_micros
                              type: long
                            - name: stat
                              type: group
                              fields:
                                - name: number_of_elapsed_periods
                                  type: long
                                - name: time_throttled_nanos
                                  type: long
                                - name: number_of_times_throttled
                                  type: long
                - name: process.cpu.percent
                  type: double
                - name: pipelines
                  type: nested
                  fields:
                    - name: ephemeral_id
                      type: keyword
                    - name: id
                      type: keyword
                    - name: hash
                      type: keyword
                    - name: queue
                      type: group
                      fields:
                        - name: events_count
                          type: long
                        - name: type
                          type: keyword
                        - name: queue_size_in_bytes
                          type: long
                        - name: max_queue_size_in_bytes
                          type: long
                    - name: events
                      type: group
                      fields:
                        - name: in
                          type: long
                        - name: out
                          type: long
                        - name: duration_in_millis
                          type: long
                        - name: queue_push_duration_in_millis
                          type: long
                        - name: filtered
                          type: long
                    - name: vertices
                      type: nested
                      fields:
                        - name: duration_in_millis
                          type: long
                        - name: events_in
                          type: long
                        - name: pipeline_ephemeral_id
                          type: keyword
                          description: pipeline_ephemeral_id
                        - name: events_out
                          type: long
                          description: events_out
                        - name: id
                          type: keyword
                          description: id
                        - name: queue_push_duration_in_millis
                          type: long
                          description: queue_push_duration_in_millis
                        - name: long_counters
                          type: nested
                          fields:
                            - name: name
                              type: keyword
                            - name: value
                              type: long
                    - name: reloads
                      type: group
                      fields:
                        - name: failures
                          type: long
                        - name: successes
                          type: long
                - name: queue.events_count
                  type: long
- key: memcached
  title: "Memcached"
  description: >
    Memcached module
  short_config: false
  release: ga
  fields:
    - name: memcached
      type: group
      description: >
      fields:
        - name: stats
          type: group
          description: >
            stats
          release: ga
          fields:
            - name: pid
              type: long
              description: >
                Current process ID of the Memcached task.
        
            - name: uptime.sec
              type: long
              description: >
                Memcached server uptime.
        
            - name: threads
              type: long
              description: >
                Number of threads used by the current Memcached server process.
        
            - name: connections.current
              type: long
              description: >
                Number of open connections to this Memcached server, should be the same
                value on all servers during normal operation.
        
            - name: connections.total
              type: long
              description: >
                Numer of successful connect attempts to this server since it has been started.
        
            - name: get.hits
              type: long
              description: >
                Number of successful "get" commands (cache hits) since startup, divide them
                by the "cmd_get" value to get the cache hitrate.
        
            - name: get.misses
              type: long
              description: >
                Number of failed "get" requests because nothing was cached for this key
                or the cached value was too old.
        
            - name: cmd.get
              type: long
              description: >
                Number of "get" commands received since server startup not counting if they
                were successful or not.
        
            - name: cmd.set
              type: long
              description: >
                Number of "set" commands serviced since startup.
        
            - name: read.bytes
              type: long
              formate: bytes
              description: >
                Total number of bytes received from the network by this server.
        
            - name: written.bytes
              type: long
              formate: bytes
              description: >
                Total number of bytes send to the network by this server.
        
            - name: items.current
              type: long
              description: >
                Number of items currently in this server's cache.
        
            - name: items.total
              type: long
              formate: bytes
              description: >
                Number of items stored ever stored on this server. This is no "maximum item
                count" value but a counted increased by every new item stored in the cache.
        
            - name: evictions
              type: long
              formate: bytes
              description: >
                Number of objects removed from the cache to free up memory for new items
                because Memcached reached it's maximum memory setting (limit_maxbytes).
        
            - name: bytes.current
              type: long
              formate: bytes
              description: >
                Number of bytes currently used for caching items.
        
            - name: bytes.limit
              type: long
              formate: bytes
              description: >
                Number of bytes this server is allowed to use for storage.
- key: mongodb
  title: "MongoDB"
  description: >
    Metrics collected from MongoDB servers.
  short_config: false
  release: ga
  settings: ["ssl"]
  fields:
    - name: mongodb
      type: group
      description: >
        MongoDB metrics.
      fields:
        - name: collstats
          type: group
          description: >
            MongoDB collection statistics metrics.
          release: ga
          fields:
            - name: db
              type: keyword
              description: >
                Database name.
        
            - name: collection
              type: keyword
              description: >
                Collection name.
        
            - name: name
              type: keyword
              description: >
                Combination of database and collection name.
        
            - name: total.time.us
              type: long
              description: >
                Total waiting time for locks in microseconds.
            - name: total.count
              type: long
              description: >
                Total number of lock wait events.
        
            - name: lock
              type: group
              fields:
                - name: read.time.us
                  type: long
                  description: >
                    Time waiting for read locks in microseconds.
                - name: read.count
                  type: long
                  description: >
                    Number of read lock wait events.
        
                - name: write.time.us
                  type: long
                  description: >
                    Time waiting for write locks in microseconds.
                - name: write.count
                  type: long
                  description: >
                    Number of write lock wait events.
        
            - name: queries.time.us
              type: long
              description: >
                Time running queries in microseconds.
            - name: queries.count
              type: long
              description: >
                Number of queries executed.
        
            - name: getmore.time.us
              type: long
              description: >
                Time asking for more cursor rows in microseconds.
            - name: getmore.count
              type: long
              description: >
                Number of times a cursor asked for more data.
        
            - name: insert.time.us
              type: long
              description: >
                Time inserting new documents in microseconds.
            - name: insert.count
              type: long
              description: >
                Number of document insert events.
        
            - name: update.time.us
              type: long
              description: >
                Time updating documents in microseconds.
            - name: update.count
              type: long
              description: >
                Number of document update events.
        
            - name: remove.time.us
              type: long
              description: >
                Time deleting documents in microseconds.
            - name: remove.count
              type: long
              description: >
                Number of document delete events.
        
            - name: commands.time.us
              type: long
              description: >
                Time executing database commands in microseconds.
            - name: commands.count
              type: long
              description: >
                Number of database commands executed.
        - name: dbstats
          type: group
          description: >
            dbstats provides an overview of a particular mongo database. This document
            is most concerned with data volumes of a database.
          release: ga
          fields:
            - name: avg_obj_size.bytes
              type: long
              format: bytes
        
            - name: collections
              type: integer
        
            - name: data_size.bytes
              type: long
              format: bytes
        
            - name: db
              type: keyword
        
            - name: file_size.bytes
              type: long
              format: bytes
        
            - name: index_size.bytes
              type: long
              format: bytes
        
            - name: indexes
              type: long
        
            - name: num_extents
              type: long
        
            - name: objects
              type: long
        
            - name: storage_size.bytes
              type: long
              format: bytes
        
            - name: ns_size_mb.mb
              type: long
        
            - name: data_file_version
              type: group
              fields:
                - name: major
                  type: long
        
                - name: minor
                  type: long
        
            - name: extent_free_list
              type: group
              fields:
                - name: num
                  type: long
        
                - name: size.bytes
                  type: long
                  format: bytes
        - name: metrics
          type: group
          release: ga
          description: >
            Statistics that reflect the current use and state of a running `mongod` instance
            for more information, take a look at https://docs.mongodb.com/manual/reference/command/serverStatus/#serverstatus.metrics
          fields:
            - name: commands
              type: group
              description: >
                Reports on the use of database commands.
                The fields in metrics.commands are the names of database commands and each value is a document
                that reports the total number of commands executed as well as the number of failed executions.
        
                metrics.commands.<command>.failed shows the number of times <command> failed on this mongod.
                metrics.commands.<command>.total shows the number of times <command> executed on this mongod.
              fields:
                - name: is_self
                  type: group
                  fields:
                    - name: failed
                      type: long
                    - name: total
                      type: long
                - name: aggregate
                  type: group
                  fields:
                    - name: failed
                      type: long
                    - name: total
                      type: long
                - name: build_info
                  type: group
                  fields:
                    - name: failed
                      type: long
                    - name: total
                      type: long
                - name: coll_stats
                  type: group
                  fields:
                    - name: failed
                      type: long
                    - name: total
                      type: long
                - name: connection_pool_stats
                  type: group
                  fields:
                    - name: failed
                      type: long
                    - name: total
                      type: long
                - name: count
                  type: group
                  fields:
                    - name: failed
                      type: long
                    - name: total
                      type: long
                - name: db_stats
                  type: group
                  fields:
                    - name: failed
                      type: long
                    - name: total
                      type: long
                - name: distinct
                  type: group
                  fields:
                    - name: failed
                      type: long
                    - name: total
                      type: long
                - name: find
                  type: group
                  fields:
                    - name: failed
                      type: long
                    - name: total
                      type: long
                - name: get_cmd_line_opts
                  type: group
                  fields:
                    - name: failed
                      type: long
                    - name: total
                      type: long
                - name: get_last_error
                  type: group
                  fields:
                    - name: failed
                      type: long
                    - name: total
                      type: long
                - name: get_log
                  type: group
                  fields:
                    - name: failed
                      type: long
                    - name: total
                      type: long
                - name: get_more
                  type: group
                  fields:
                    - name: failed
                      type: long
                    - name: total
                      type: long
                - name: get_parameter
                  type: group
                  fields:
                    - name: failed
                      type: long
                    - name: total
                      type: long
                - name: host_info
                  type: group
                  fields:
                    - name: failed
                      type: long
                    - name: total
                      type: long
                - name: insert
                  type: group
                  fields:
                    - name: failed
                      type: long
                    - name: total
                      type: long
                - name: is_master
                  type: group
                  fields:
                    - name: failed
                      type: long
                    - name: total
                      type: long
                - name: last_collections
                  type: group
                  fields:
                    - name: failed
                      type: long
                    - name: total
                      type: long
                - name: last_commands
                  type: group
                  fields:
                    - name: failed
                      type: long
                    - name: total
                      type: long
                - name: list_databased
                  type: group
                  fields:
                    - name: failed
                      type: long
                    - name: total
                      type: long
                - name: list_indexes
                  type: group
                  fields:
                    - name: failed
                      type: long
                    - name: total
                      type: long
                - name: ping
                  type: group
                  fields:
                    - name: failed
                      type: long
                    - name: total
                      type: long
                - name: profile
                  type: group
                  fields:
                    - name: failed
                      type: long
                    - name: total
                      type: long
                - name: replset_get_rbid
                  type: group
                  fields:
                    - name: failed
                      type: long
                    - name: total
                      type: long
                - name: replset_get_status
                  type: group
                  fields:
                    - name: failed
                      type: long
                    - name: total
                      type: long
                - name: replset_heartbeat
                  type: group
                  fields:
                    - name: failed
                      type: long
                    - name: total
                      type: long
                - name: replset_update_position
                  type: group
                  fields:
                    - name: failed
                      type: long
                    - name: total
                      type: long
                - name: server_status
                  type: group
                  fields:
                    - name: failed
                      type: long
                    - name: total
                      type: long
                - name: update
                  type: group
                  fields:
                    - name: failed
                      type: long
                    - name: total
                      type: long
                - name: whatsmyuri
                  type: group
                  fields:
                    - name: failed
                      type: long
                    - name: total
                      type: long
        
            - name: cursor
              type: group
              description: >
                Contains data regarding cursor state and use.
              fields:
                - name: timed_out
                  type: long
                  description: >
                    The total number of cursors that have timed out since the server process started.
                - name: open
                  type: group
                  description: >
                    Contains data regarding open cursors.
                  fields:
                    - name: no_timeout
                      type: long
                      description: >
                        The number of open cursors with the option DBQuery.Option.noTimeout set to prevent timeout.
                    - name: pinned
                      type: long
                      description: >
                        The number of `pinned` open cursors.
                    - name: total
                      type: long
                      description: >
                        The number of cursors that MongoDB is maintaining for clients.
        
            - name: document
              type: group
              description: >
                Reflects document access and modification patterns.
              fields:
                - name: deleted
                  type: long
                  description: >
                    The total number of documents deleted.
                - name: inserted
                  type: long
                  description: >
                    The total number of documents inserted.
                - name: returned
                  type: long
                  description: >
                    The total number of documents returned by queries.
                - name: updated
                  type: long
                  description: >
                    The total number of documents updated.
        
            - name: get_last_error
              type: group
              description: >
                  Returns the error status of the preceding write operation on the current connection.
              fields:
                - name: write_wait.ms
                  type: long
                  description: >
                    The total amount of time in milliseconds that the mongod has spent performing getLastError operations
                    with write concern (i.e. w) greater than 1.
                - name: write_wait.count
                  type: long
                  description: >
                    The total number of getLastError operations with a specified write concern (i.e. w) greater than 1.
                - name: write_timeouts
                  type: long
                  description: >
                    The number of times that write concern operations have timed out as a result of the wtimeout threshold to getLastError.
        
            - name: operation
              type: group
              description: >
                Holds counters for several types of update and query operations that MongoDB handles using special operation types.
              fields:
                - name: scan_and_order
                  type: long
                  description: >
                    The total number of queries that return sorted numbers that cannot perform the sort operation using an index.
                - name: write_conflicts
                  type: long
                  description: >
                    The total number of queries that encountered write conflicts.
        
            - name: query_executor
              type: group
              description: >
                Reports data from the query execution system.
              fields:
                - name: scanned_indexes.count
                  type: long
                  description: >
                    The total number of index items scanned during queries and query-plan evaluation.
                - name: scanned_documents.count
                  type: long
                  description: >
                    The total number of documents scanned during queries and query-plan evaluation.
        
            - name: replication
              type: group
              description: >
                Reports metrics related to the replication process.
                metrics.replication appears on all mongod instances, even those that aren't members of replica sets.
              fields:
                - name: executor
                  type: group
                  description: >
                    Reports on various statistics for the replication executor.
                  fields:
                    - name: counters
                      type: group
                      fields:
                        - name: event_created
                          type: long
                        - name: event_wait
                          type: long
                        - name: cancels
                          type: long
                        - name: waits
                          type: long
                        - name: scheduled
                          type: group
                          fields:
                            - name: netcmd
                              type: long
                            - name: dbwork
                              type: long
                            - name: exclusive
                              type: long
                            - name: work_at
                              type: long
                            - name: work
                              type: long
                            - name: failures
                              type: long
                    - name: queues
                      type: group
                      fields:
                        - name: in_progress
                          type: group
                          fields:
                            - name: network
                              type: long
                            - name: dbwork
                              type: long
                            - name: exclusive
                              type: long
                        - name: sleepers
                          type: long
                        - name: ready
                          type: long
                        - name: free
                          type: long
                    - name: unsignaled_events
                      type: long
                    - name: event_waiters
                      type: long
                    - name: shutting_down
                      type: boolean
                    - name: network_interface
                      type: keyword
                - name: apply
                  type: group
                  description: >
                    Reports on the application of operations from the replication oplog.
                  fields:
                    - name: attempts_to_become_secondary
                      type: long
                    - name: batches
                      type: group
                      description: >
                        Reports on the oplog application process on secondaries members of replica sets.
                      fields:
                        - name: count
                          type: long
                          description: >
                            The total number of batches applied across all databases.
                        - name: time.ms
                          type: long
                          description: >
                            The total amount of time in milliseconds the mongod has spent applying operations from the oplog.
                    - name: ops
                      type: long
                      description: >
                        The total number of oplog operations applied.
                - name: buffer
                  type: group
                  description: >
                    MongoDB buffers oplog operations from the replication sync source buffer before applying oplog entries in a batch.
                    metrics.replication.buffer provides a way to track the oplog buffer.
                  fields:
                    - name: count
                      type: long
                      description: >
                        The current number of operations in the oplog buffer.
                    - name: max_size.bytes
                      type: long
                      description: >
                        The maximum size of the buffer. This value is a constant setting in the mongod, and is not configurable.
                    - name: size.bytes
                      type: long
                      description: >
                        The current size of the contents of the oplog buffer.
                - name: initial_sync
                  type: group
                  description: >
                    Report initial sync status
                  fields:
                    - name: completed
                      type: long
                    - name: failed_attempts
                      type: long
                    - name: failures
                      type: long
                - name: network
                  type: group
                  description: >
                    Reports network use by the replication process.
                  fields:
                    - name: bytes
                      type: long
                      description: >
                        The total amount of data read from the replication sync source.
                    - name: getmores
                      type: group
                      description: >
                        Reports on the getmore operations, which are requests for additional results from the oplog cursor
                        as part of the oplog replication process.
                      fields:
                        - name: count
                          type: long
                          description: >
                            The total number of getmore operations
                        - name: time.ms
                          type: long
                          description: >
                            The total amount of time required to collect data from getmore operations.
                    - name: ops
                      type: long
                      description: >
                        The total number of operations read from the replication source.
                    - name: reders_created
                      type: long
                      description: >
                        The total number of oplog query processes created.
                - name: preload
                  type: group
                  description: >
                    Reports on the `pre-fetch` stage, where MongoDB loads documents and indexes into RAM to improve replication throughput.
                  fields:
                    - name: docs
                      type: group
                      description: >
                        Reports on the documents loaded into memory during the pre-fetch stage.
                      fields:
                        - name: count
                          type: long
                          description: >
                            The total number of documents loaded during the pre-fetch stage of replication.
                        - name: time.ms
                          type: long
                          decsription: >
                            The total amount of time spent loading documents as part of the pre-fetch stage of replication.
                    - name: indexes
                      type: group
                      description: >
                        Reports on the index items loaded into memory during the pre-fetch stage of replication.
                      fields:
                        - name: count
                          type: long
                          description: >
                            The total number of index entries loaded by members before updating documents as part of the pre-fetch stage of replication.
                        - name: time.ms
                          type: long
                          description: >
                            The total amount of time, in milliseconds, spent loading index entries as part of the pre-fetch stage of replication.
        
            - name: storage.free_list.search
              type: group
              fields:
                - name: bucket_exhausted
                  type: long
                  description: >
                    The number of times that mongod has checked the free list without finding a suitably large record allocation.
                - name: requests
                  type: long
                  description: >
                    The number of times mongod has searched for available record allocations.
                - name: scanned
                  type: long
                  description: >
                    The number of available record allocations mongod has searched.
        
            - name: ttl
              type: group
              description: >
                Reports on the operation of the resource use of the ttl index process.
              fields:
                - name: deleted_documents.count
                  type: long
                  description: >
                    The total number of documents deleted from collections with a ttl index.
                - name: passes.count
                  type: long
                  description: >
                    The number of times the background process removes documents from collections with a ttl index.
        - name: replstatus
          type: group
          release: ga
          description: >
            replstatus provides an overview of replica set status.
          fields:
            - name: oplog
              type: group
              description: >
                oplog provides an overview of replication oplog status, which is retrieved from db.getReplicationInfo().
              fields:
                - name: size.allocated
                  type: long
                  format: bytes
                  description: >
                    The total amount of space used by the replstatus in bytes.
                - name: size.used
                  type: long
                  format: bytes
                  description: >
                    total amount of space allocated to the replstatus in bytes.
        
                - name: first.timestamp
                  type: long
                  description: >
                    Timestamp of the first (i.e. earliest) operation in the replstatus
        
                - name: last.timestamp
                  type: long
                  description: >
                    Timestamp of the last (i.e. latest) operation in the replstatus
        
                - name: window
                  type: long
                  description: >
                    The difference between the first and last operation in the replstatus.
        
            - name: set_name
              type: keyword
              description: >
                The name of the replica set.
        
            - name: server_date
              type: date
              description: >
                Reflects the current time according to the server that processed the replSetGetStatus command.
        
            - name: optimes
              type: group
              fields:
                - name: last_committed
                  type: long
                  description: >
                    Information, from the viewpoint of this member, regarding the most recent operation that has been written to a majority of replica set members.
                - name: applied
                  type: long
                  description: >
                    Information, from the viewpoint of this member, regarding the most recent operation that has been applied to this member of the replica set.
                - name: durable
                  type: long
                  description: >
                    Information, from the viewpoint of this member, regarding the most recent operation that has been written to the journal of this member of the replica set.
        
            - name: lag
              type: group
              description: >
                Delay between a write operation on the primary and its copy to a secondary
              fields:
                - name: max
                  type: long
                  format: duration
                  description: >
                    Difference between optime of primary and slowest secondary
                - name: min
                  type: long
                  format: duration
                  description: >
                    Difference between optime of primary and fastest secondary
        
            - name: headroom
              type: group
              description: >
                Difference between the primary's oplog window and the replication lag of the secondary
              fields:
                - name: max
                  type: long
                  format: duration
                  description: >
                    Difference between primary's oplog window and the replication lag of the fastest secondary
                - name: min
                  type: long
                  format: duration
                  description: >
                    Difference between primary's oplog window and the replication lag of the slowest secondary
        
            - name: members
              type: group
              description: >
                Provides information about members of replica set grouped by their state
              fields:
                - name: primary.host
                  type: keyword
                  description: >
                    Host address of the primary
                - name: primary.optime
                  type: keyword
                  description: >
                    Optime of primary
                - name: secondary.hosts
                  type: keyword
                  description: >
                    List of secondary hosts
                - name: secondary.optimes
                  type: keyword
                  description: >
                    Optimes of secondaries
                - name: secondary.count
                  type: long
                  descriprtion: >
                    Count of secondaries
                - name: recovering.hosts
                  type: keyword
                  description: >
                    List of recovering members hosts
                - name: recovering.count
                  type: long
                  description: >
                    Count of members in the `recovering` state
                - name: unknown.hosts
                  type: keyword
                  description: >
                    List of members' hosts in the `unknown` state
                - name: unknown.count
                  type: long
                  description: >
                    Count of members with `unknown` state
                - name: startup2.hosts
                  type: keyword
                  description: >
                    List of initializing members hosts
                - name: startup2.count
                  type: long
                  description: >
                    Count of members in the `startup2` state
                - name: arbiter.hosts
                  type: keyword
                  description: >
                    List of arbiters hosts
                - name: arbiter.count
                  type: long
                  description: >
                    Count of arbiters
                - name: down.hosts
                  type: keyword
                  description: >
                    List of `down` members hosts
                - name: down.count
                  type: long
                  description: >
                    Count of `down` members
                - name: rollback.hosts
                  type: keyword
                  description: >
                    List of members in the `rollback` state
                - name: rollback.count
                  type: long
                  description: >
                    Count of members in the `rollback` state
                - name: unhealthy.hosts
                  type: keyword
                  description: >
                    List of members' hosts with healthy = false
                - name: unhealthy.count
                  type: long
                  description: >
                    Count of unhealthy members
        - name: status
          type: group
          description: >
            MongoDB server status metrics.
          release: ga
          fields:
            - name: version
              type: alias
              path: service.version
              description: >
                Instance version.
            - name: process
              type: alias
              path: process.name
              description: >
                The current MongoDB process. Possible values are mongos or mongod.
            - name: uptime.ms
              type: long
              description: >
                Instance uptime in milliseconds.
            - name: local_time
              type: date
              description: >
                Local time as reported by the MongoDB instance.
        
            - name: asserts.regular
              type: long
              description: >
                Number of regular assertions produced by the server.
            - name: asserts.warning
              type: long
              description: >
                Number of warning assertions produced by the server.
            - name: asserts.msg
              type: long
              description: >
                Number of msg assertions produced by the server.
            - name: asserts.user
              type: long
              description: >
                Number of user assertions produced by the server.
            - name: asserts.rollovers
              type: long
              description: >
                Number of rollovers assertions produced by the server.
        
            - name: connections
              type: group
              description: >
                Data regarding the current status of incoming connections and
                availability of the database server.
              fields:
                - name: current
                  type: long
                  description: >
                    The number of connections to the database server from clients. This
                    number includes the current shell session. Consider the value of
                    `available` to add more context to this datum.
                - name: available
                  type: long
                  description: >
                     The number of unused available incoming connections the database
                     can provide.
                - name: total_created
                  type: long
                  description: >
                    A count of all incoming connections created to the server. This
                    number includes connections that have since closed.
        
            - name: extra_info
              type: group
              description: >
                Platform specific data.
              fields:
                - name: heap_usage.bytes
                  type: long
                  format: bytes
                  description: >
                    The total size in bytes of heap space used by the database process.
                    Only available on Unix/Linux.
                - name: page_faults
                  type: long
                  description: >
                    The total number of page faults that require disk operations. Page
                    faults refer to operations that require the database server to
                    access data that isn't available in active memory.
        
            - name: global_lock
              type: group
              description: >
                Reports on lock state of the database.
              fields:
                  - name: total_time.us
                    type: long
                    description: >
                      The time, in microseconds, since the database last started and created the globalLock.
                      This is roughly equivalent to total server uptime.
                  - name: current_queue
                    type: group
                    description: >
                      The number of operations queued because of a lock.
                    fields:
                      - name: total
                        type: long
                        description: >
                          The total number of operations queued waiting for the lock (i.e., the sum of current_queue.readers and current_queue.writers).
                      - name: readers
                        type: long
                        description: >
                          The number of operations that are currently queued and waiting for the read lock.
                      - name: writers
                        type: long
                        description: >
                          The number of operations that are currently queued and waiting for the write lock.
                  - name: active_clients
                    type: group
                    description: >
                      The number of connected clients and the read and write operations performed by these clients.
                    fields:
                      - name: total
                        type: long
                        description: >
                          Total number of the active client connections performing read or write operations.
                      - name: readers
                        type: long
                        description: >
                          The number of the active client connections performing read operations.
                      - name: writers
                        type: long
                        description: >
                          The number of the active client connections performing write operations.
            - name: locks
              type: group
              description: >
                A document that reports for each lock <type>, data on lock <mode>s.
                The possible lock <type>s are global, database, collection, metadata and oplog.
                The possible <mode>s are r, w, R and W which respresent shared, exclusive, intent shared and intent exclusive.
        
                locks.<type>.acquire.count.<mode> shows the number of times the lock was acquired in the specified mode.
                locks.<type>.wait.count.<mode> shows the number of times the locks.acquireCount lock acquisitions encountered waits
                because the locks were held in a conflicting mode.
                locks.<type>.wait.us.<mode> shows the cumulative wait time in microseconds for the lock acquisitions.
                locks.<type>.deadlock.count.<mode> shows the number of times the lock acquisitions encountered deadlocks.
              fields:
                - name: global
                  type: group
                  fields:
                    - name: acquire.count.r
                      type: long
                    - name: acquire.count.w
                      type: long
                    - name: acquire.count.R
                      type: long
                    - name: acquire.count.W
                      type: long
                    - name: wait.count.r
                      type: long
                    - name: wait.count.w
                      type: long
                    - name: wait.count.R
                      type: long
                    - name: wait.count.W
                      type: long
                    - name: wait.us.r
                      type: long
                    - name: wait.us.w
                      type: long
                    - name: wait.us.R
                      type: long
                    - name: wait.us.W
                      type: long
                    - name: deadlock.count.r
                      type: long
                    - name: deadlock.count.w
                      type: long
                    - name: deadlock.count.R
                      type: long
                    - name: deadlock.count.W
                      type: long
                - name: database
                  type: group
                  fields:
                    - name: acquire.count.r
                      type: long
                    - name: acquire.count.w
                      type: long
                    - name: acquire.count.R
                      type: long
                    - name: acquire.count.W
                      type: long
                    - name: wait.count.r
                      type: long
                    - name: wait.count.w
                      type: long
                    - name: wait.count.R
                      type: long
                    - name: wait.count.W
                      type: long
                    - name: wait.us.r
                      type: long
                    - name: wait.us.w
                      type: long
                    - name: wait.us.R
                      type: long
                    - name: wait.us.W
                      type: long
                    - name: deadlock.count.r
                      type: long
                    - name: deadlock.count.w
                      type: long
                    - name: deadlock.count.R
                      type: long
                    - name: deadlock.count.W
                      type: long
                - name: collection
                  type: group
                  fields:
                    - name: acquire.count.r
                      type: long
                    - name: acquire.count.w
                      type: long
                    - name: acquire.count.R
                      type: long
                    - name: acquire.count.W
                      type: long
                    - name: wait.count.r
                      type: long
                    - name: wait.count.w
                      type: long
                    - name: wait.count.R
                      type: long
                    - name: wait.count.W
                      type: long
                    - name: wait.us.r
                      type: long
                    - name: wait.us.w
                      type: long
                    - name: wait.us.R
                      type: long
                    - name: wait.us.W
                      type: long
                    - name: deadlock.count.r
                      type: long
                    - name: deadlock.count.w
                      type: long
                    - name: deadlock.count.R
                      type: long
                    - name: deadlock.count.W
                      type: long
                - name: meta_data
                  type: group
                  fields:
                    - name: acquire.count.r
                      type: long
                    - name: acquire.count.w
                      type: long
                    - name: acquire.count.R
                      type: long
                    - name: acquire.count.W
                      type: long
                    - name: wait.count.r
                      type: long
                    - name: wait.count.w
                      type: long
                    - name: wait.count.R
                      type: long
                    - name: wait.count.W
                      type: long
                    - name: wait.us.r
                      type: long
                    - name: wait.us.w
                      type: long
                    - name: wait.us.R
                      type: long
                    - name: wait.us.W
                      type: long
                    - name: deadlock.count.r
                      type: long
                    - name: deadlock.count.w
                      type: long
                    - name: deadlock.count.R
                      type: long
                    - name: deadlock.count.W
                      type: long
                - name: oplog
                  type: group
                  fields:
                    - name: acquire.count.r
                      type: long
                    - name: acquire.count.w
                      type: long
                    - name: acquire.count.R
                      type: long
                    - name: acquire.count.W
                      type: long
                    - name: wait.count.r
                      type: long
                    - name: wait.count.w
                      type: long
                    - name: wait.count.R
                      type: long
                    - name: wait.count.W
                      type: long
                    - name: wait.us.r
                      type: long
                    - name: wait.us.w
                      type: long
                    - name: wait.us.R
                      type: long
                    - name: wait.us.W
                      type: long
                    - name: deadlock.count.r
                      type: long
                    - name: deadlock.count.w
                      type: long
                    - name: deadlock.count.R
                      type: long
                    - name: deadlock.count.W
                      type: long
        
            - name: network
              type: group
              description: >
                Platform specific data.
              fields:
                - name: in.bytes
                  type: long
                  format: bytes
                  description: >
                    The amount of network traffic, in bytes, received by this database.
                - name: out.bytes
                  type: long
                  format: bytes
                  description: >
                    The amount of network traffic, in bytes, sent from this database.
                - name: requests
                  type: long
                  description: >
                    The total number of requests received by the server.
        
            - name: ops.latencies
              type: group
              description: >
                Operation latencies for the database as a whole.
                Only mongod instances report this metric.
              fields:
                - name: reads.latency
                  type: long
                  description: >
                    Total combined latency in microseconds.
                - name: reads.count
                  type: long
                  description: >
                    Total number of read operations performed on the collection since startup.
                - name: writes.latency
                  type: long
                  description: >
                    Total combined latency in microseconds.
                - name: writes.count
                  type: long
                  description: >
                    Total number of write operations performed on the collection since startup.
                - name: commands.latency
                  type: long
                  description: >
                    Total combined latency in microseconds.
                - name: commands.count
                  type: long
                  description: >
                    Total number of commands performed on the collection since startup.
        
            - name: ops.counters
              type: group
              description: >
                An overview of database operations by type.
              fields:
                - name: insert
                  type: long
                  description: >
                    The total number of insert operations received since the mongod
                    instance last started.
                - name: query
                  type: long
                  description: >
                    The total number of queries received since the mongod instance last
                    started.
                - name: update
                  type: long
                  description: >
                    The total number of update operations received since the mongod
                    instance last started.
                - name: delete
                  type: long
                  description: >
                    The total number of delete operations received since the mongod
                    instance last started.
                - name: getmore
                  type: long
                  description: >
                    The total number of getmore operations received since the mongod
                    instance last started.
                - name: command
                  type: long
                  description: >
                    The total number of commands issued to the database since the mongod
                    instance last started.
        
            - name: ops.replicated
              type: group
              description: >
                An overview of database replication operations by type.
              fields:
                - name: insert
                  type: long
                  description: >
                    The total number of replicated insert operations received since the
                    mongod instance last started.
                - name: query
                  type: long
                  description: >
                    The total number of replicated queries received since the mongod
                    instance last started.
                - name: update
                  type: long
                  description: >
                    The total number of replicated update operations received since the
                    mongod instance last started.
                - name: delete
                  type: long
                  description: >
                    The total number of replicated delete operations received since the
                    mongod instance last started.
                - name: getmore
                  type: long
                  description: >
                    The total number of replicated getmore operations received since the
                    mongod instance last started.
                - name: command
                  type: long
                  description: >
                    The total number of replicated commands issued to the database since
                    the mongod instance last started.
        
            - name: memory
              type: group
              description: >
                Data about the current memory usage of the mongod server.
              fields:
                - name: bits
                  type: long
                  description: >
                    Either 64 or 32, depending on which target architecture was specified
                    during the mongod compilation process.
                - name: resident.mb
                  type: long
                  description: >
                    The amount of RAM, in megabytes (MB), currently used by the database
                    process.
                - name: virtual.mb
                  type: long
                  description: >
                   The amount, in megabytes (MB), of virtual memory used by the mongod
                   process.
                - name: mapped.mb
                  type: long
                  description: >
                    The amount of mapped memory, in megabytes (MB), used by the database.
                    Because MongoDB uses memory-mapped files, this value is likely to be
                    to be roughly equivalent to the total size of your database or
                    databases.
                - name: mapped_with_journal.mb
                  type: long
                  description: >
                    The amount of mapped memory, in megabytes (MB), including the memory
                    used for journaling.
            - name: write_backs_queued
              type: boolean
              description: >
                True when there are operations from a mongos instance queued for retrying.
            - name: storage_engine.name
              type: keyword
              description: >
                A string that represents the name of the current storage engine.
        
            - name: wired_tiger
              type: group
              description: >
                Statistics about the WiredTiger storage engine.
              fields:
                - name: concurrent_transactions
                  type: group
                  description: >
                    Statistics about the transactions currently in progress.
                  fields:
                    - name: write.out
                      type: long
                      description: >
                        Number of concurrent write transaction in progress.
                    - name: write.available
                      type: long
                      description: >
                        Number of concurrent write tickets available.
                    - name: write.total_tickets
                      type: long
                      description: >
                        Number of total write tickets.
                    - name: read.out
                      type: long
                      description: >
                        Number of concurrent read transaction in progress.
                    - name: read.available
                      type: long
                      description: >
                        Number of concurrent read tickets available.
                    - name: read.total_tickets
                      type: long
                      description: >
                        Number of total read tickets.
                - name: cache
                  type: group
                  description: >
                    Statistics about the cache and page evictions from the cache.
                  fields:
                    - name: maximum.bytes
                      type: long
                      format: bytes
                      description: >
                        Maximum cache size.
                    - name: used.bytes
                      type: long
                      format: bytes
                      description: >
                        Size in byte of the data currently in cache.
                    - name: dirty.bytes
                      type: long
                      format: bytes
                      description: >
                        Size in bytes of the dirty data in the cache.
                    - name: pages.read
                      type: long
                      description: >
                        Number of pages read into the cache.
                    - name: pages.write
                      type: long
                      description: >
                        Number of pages written from the cache.
                    - name: pages.evicted
                      type: long
                      description: >
                        Number of pages evicted from the cache.
                - name: log
                  type: group
                  description: >
                    Statistics about the write ahead log used by WiredTiger.
                  fields:
                    - name: size.bytes
                      type: long
                      format: bytes
                      description: >
                        Total log size in bytes.
                    - name: write.bytes
                      type: long
                      format: bytes
                      description: >
                        Number of bytes written into the log.
                    - name: max_file_size.bytes
                      type: long
                      format: bytes
                      description: >
                        Maximum file size.
                    - name: flushes
                      type: long
                      description: >
                        Number of flush operations.
                    - name: writes
                      type: long
                      description: >
                        Number of write operations.
                    - name: scans
                      type: long
                      description: >
                        Number of scan operations.
                    - name: syncs
                      type: long
                      description: >
                        Number of sync operations.
        
            - name: background_flushing
              type: group
              description: >
                Data about the process MongoDB uses to write data to disk. This data is
                only available for instances that use the MMAPv1 storage engine.
              fields:
                - name: flushes
                  type: long
                  description: >
                     A counter that collects the number of times the database has
                     flushed all writes to disk.
                - name: total.ms
                  type: long
                  description: >
                    The total number of milliseconds (ms) that the mongod processes have
                    spent writing (i.e. flushing) data to disk. Because this is an
                    absolute value, consider the value of `flushes` and `average_ms` to
                    provide better context for this datum.
                - name: average.ms
                  type: long
                  description: >
                    The average time spent flushing to disk per flush event.
                - name: last.ms
                  type: long
                  description: >
                    The amount of time, in milliseconds, that the last flush operation
                    took to complete.
                - name: last_finished
                  type: date
                  description: >
                    A timestamp of the last completed flush operation.
        
            - name: journaling
              type: group
              description: >
                Data about the journaling-related operations and performance. Journaling
                information only appears for mongod instances that use the MMAPv1
                storage engine and have journaling enabled.
              fields:
                - name: commits
                  type: long
                  description: >
                    The number of transactions written to the journal during the last
                    journal group commit interval.
                - name: journaled.mb
                  type: long
                  description: >
                    The amount of data in megabytes (MB) written to journal during the
                    last journal group commit interval.
                - name: write_to_data_files.mb
                  type: long
                  description: >
                    The amount of data in megabytes (MB) written from journal to the
                    data files during the last journal group commit interval.
                - name: compression
                  type: long
                  description: >
                    The compression ratio of the data written to the journal.
                - name: commits_in_write_lock
                  type: long
                  description: >
                    Count of the commits that occurred while a write lock was held.
                    Commits in a write lock indicate a MongoDB node under a heavy write
                    load and call for further diagnosis.
                - name: early_commits
                  type: long
                  description: >
                    The number of times MongoDB requested a commit before the scheduled
                    journal group commit interval.
                - name: times
                  type: group
                  description: >
                    Information about the performance of the mongod instance during the
                    various phases of journaling in the last journal group commit
                    interval.
                  fields:
                    - name: dt.ms
                      type: long
                      description: >
                        The amount of time over which MongoDB collected the times data.
                        Use this field to provide context to the other times field values.
                    - name: prep_log_buffer.ms
                      type: long
                      description: >
                        The amount of time spent preparing to write to the journal.
                        Smaller values indicate better journal performance.
                    - name: write_to_journal.ms
                      type: long
                      description: >
                        The amount of time spent actually writing to the journal. File
                        system speeds and device interfaces can affect performance.
                    - name: write_to_data_files.ms
                      type: long
                      description: >
                        The amount of time spent writing to data files after journaling.
                        File system speeds and device interfaces can affect performance.
                    - name: remap_private_view.ms
                      type: long
                      description: >
                        The amount of time spent remapping copy-on-write memory mapped
                        views. Smaller values indicate better journal performance.
                    - name: commits.ms
                      type: long
                      description: >
                        The amount of time spent for commits.
                    - name: commits_in_write_lock.ms
                      type: long
                      description: >
                        The amount of time spent for commits that occurred while a write
                        lock was held.
        
- key: munin
  title: "Munin"
  description: >
    Munin node metrics exporter
  release: ga
  fields:
    - name: munin.metrics.*
      type: object
      object_type: double
      object_type_mapping_type: '*'
      description: >
        Metrics exposed by a plugin of a munin node agent.
    - name: munin.plugin.name
      type: keyword
      description: >
        Name of the plugin collecting these metrics.
    - name: munin
      type: group
      fields:
        - release: ga
- key: mysql
  title: "MySQL"
  description: >
    MySQL server status metrics collected from MySQL.
  short_config: false
  release: ga
  fields:
    - name: mysql
      type: group
      description: >
        `mysql` contains the metrics that were obtained from MySQL
        query.
      fields:
        - name: galera_status
          type: group
          release: beta
          description: >
            `galera_status` contains the metrics that were obtained by the status SQL query on Galera.
          fields:
            - name: apply
              type: group
              description: >
                Apply status fields.
              fields:
                - name: oooe
                  type: double
                  description: >
                    How often applier started write-set applying out-of-order (parallelization efficiency).
        
                - name: oool
                  type: double
                  description: >
                    How often write-set was so slow to apply that write-set with higher seqno's were applied earlier.
                    Values closer to 0 refer to a greater gap between slow and fast write-sets.
        
                - name: window
                  type: double
                  description: >
                    Average distance between highest and lowest concurrently applied seqno.
        
            - name: cert
              type: group
              description: >
                Certification status fields.
              fields:
                - name: deps_distance
                  type: double
                  description: >
                    Average distance between highest and lowest seqno value that can be possibly applied in parallel (potential degree of parallelization).
        
                - name: index_size
                  type: long
                  description: >
                    The number of entries in the certification index.
        
                - name: interval
                  type: double
                  description: >
                    Average number of transactions received while a transaction replicates.
        
            - name: cluster
              type: group
              description: >
                Cluster status fields.
              fields:
                - name: conf_id
                  type: long
                  description: >
                    Total number of cluster membership changes happened.
        
                - name: size
                  type: long
                  description: >
                    Current number of members in the cluster.
        
                - name: status
                  type: keyword
                  description: >
                    Status of this cluster component. That is, whether the node is part of a PRIMARY or NON_PRIMARY component.
        
            - name: commit
              type: group
              description: >
                Commit status fields.
              fields:
                - name: oooe
                  type: double
                  description: >
                    How often a transaction was committed out of order.
        
                - name: window
                  type: long
                  description: >
                    Average distance between highest and lowest concurrently committed seqno.
        
            - name: connected
              type: keyword
              description: >
                If the value is OFF, the node has not yet connected to any of the cluster components.
                This may be due to misconfiguration. Check the error log for proper diagnostics.
        
            - name: evs
              type: group
              description: >
                 Evs Fields.
              fields:
                - name: evict
                  type: keyword
                  description: >
                    Lists the UUID's of all nodes evicted from the cluster.
                    Evicted nodes cannot rejoin the cluster until you restart their mysqld processes.
        
                - name: state
                  type: keyword
                  description: >
                    Shows the internal state of the EVS Protocol.
        
            - name: flow_ctl
              type: group
              description: >
                Flow Control fields.
              fields:
                - name: paused
                  type: double
                  description: >
                    The fraction of time since the last FLUSH STATUS command that replication was paused due to flow control.
                    In other words, how much the slave lag is slowing down the cluster.
        
                - name: paused_ns
                  type: long
                  description: >
                    The total time spent in a paused state measured in nanoseconds.
        
                - name: recv
                  type: long
                  description: >
                    Returns the number of FC_PAUSE events the node has received, including those the node has sent.
                    Unlike most status variables, the counter for this one does not reset every time you run the query.
        
                - name: sent
                  type: long
                  description: >
                    Returns the number of FC_PAUSE events the node has sent.
                    Unlike most status variables, the counter for this one does not reset every time you run the query.
        
            - name: last_committed
              type: long
              description: >
                The sequence number, or seqno, of the last committed transaction.
        
            - name: local
              type: group
              description: >
                Node specific Cluster status fields.
              fields:
                - name: bf_aborts
                  type: long
                  description: >
                    Total number of local transactions that were aborted by slave transactions while in execution.
        
                - name: cert_failures
                  type: long
                  description: >
                    Total number of local transactions that failed certification test.
        
                - name: commits
                  type: long
                  description: >
                    Total number of local transactions committed.
        
                - name: recv
                  type: group
                  description: >
                    Node specific recv fields.
                  fields:
                    - name: queue
                      type: long
                      description: >
                        Current (instantaneous) length of the recv queue.
        
                    - name: queue_avg
                      type: double
                      description: >
                        Recv queue length averaged over interval since the last FLUSH STATUS command.
                        Values considerably larger than 0.0 mean that the node cannot apply write-sets as fast
                        as they are received and will generate a lot of replication throttling.
        
                    - name: queue_max
                      type: long
                      description: >
                        The maximum length of the recv queue since the last FLUSH STATUS command.
        
                    - name: queue_min
                      type: long
                      description: >
                        The minimum length of the recv queue since the last FLUSH STATUS command.
        
                - name: replays
                  type: long
                  description: >
                    Total number of transaction replays due to asymmetric lock granularity.
        
                - name: send
                  type: group
                  description: >
                    Node specific sent fields.
                  fields:
                    - name: queue
                      type: long
                      description: >
                        Current (instantaneous) length of the send queue.
        
                    - name: queue_avg
                      type: double
                      description: >
                        Send queue length averaged over time since the last FLUSH STATUS command.
                        Values considerably larger than 0.0 indicate replication throttling or network throughput issue.
        
                    - name: queue_max
                      type: long
                      description: >
                        The maximum length of the send queue since the last FLUSH STATUS command.
        
                    - name: queue_min
                      type: long
                      description: >
                        The minimum length of the send queue since the last FLUSH STATUS command.
        
                - name: state
                  type: keyword
                  description: >
                    Internal Galera Cluster FSM state number.
        
            - name: ready
              type: keyword
              description: >
                Whether the server is ready to accept queries.
        
            - name: received
              type: group
              description: >
                Write-Set receive status fields.
              fields:
                - name: count
                  type: long
                  description: >
                     Total number of write-sets received from other nodes.
        
                - name: bytes
                  type: long
                  description: >
                    Total size of write-sets received from other nodes.
        
            - name: repl
              type: group
              description: >
                Replication status fields.
              fields:
                - name: data_bytes
                  type: long
                  description: >
                    Total size of data replicated.
        
                - name: keys
                  type: long
                  description: >
                    Total number of keys replicated.
        
                - name: keys_bytes
                  type: long
                  description: >
                    Total size of keys replicated.
        
                - name: other_bytes
                  type: long
                  description: >
                    Total size of other bits replicated.
        
                - name: count
                  type: long
                  description: >
                    Total number of write-sets replicated (sent to other nodes).
        
                - name: bytes
                  type: long
                  description: >
                    Total size of write-sets replicated.
        - name: performance
          type: group
          description: >
            `performance` contains metrics related to the performance of a MySQL instance
          release: beta
          fields:
            - name: events_statements
              description: Records statement events summarized by schema and digest
              type: group
              fields:
                - name: 'max.timer.wait'
                  type: long
                  description: Maximum wait time of the summarized events that are timed
                - name: 'last.seen'
                  type: date
                  description: Time at which the digest was most recently seen
                - name: 'quantile.95'
                  type: long
                  description: The 95th percentile of the statement latency, in picoseconds
                - name: digest
                  type: text
                  description: Performance schema digest
                - name: 'count.star'
                  type: long
                  description: Number of summarized events
                - name: 'avg.timer.wait'
                  type: long
                  description: Average wait time of the summarized events that are timed
            - name: table_io_waits
              type: group
              description: Records table I/O waits by index
              fields:
                - name: object
                  type: group
                  fields:
                    - name: schema
                      type: keyword
                      description: Schema name
                    - name: name
                      type: keyword
                      description: Table name
                - name: index.name
                  type: keyword
                  description: >
                    Name of the index that was used when the table I/O wait event was recorded. PRIMARY indicates that table I/O
                    used the primary index. NULL means that table I/O used no index. Inserts are counted against INDEX_NAME = NULL
                - name: count.fetch
                  type: long
                  description: Number of all fetch operations > 0
        - name: query
          type: group
          release: beta
          description: >
            `query` metricset fetches custom queries from the user to a MySQL instance.
          fields:
        - name: status
          type: group
          description: >
            `status` contains the metrics that were obtained by the status SQL query.
          release: ga
          fields:
            - name: aborted
              type: group
              description: >
                Aborted status fields.
              fields:
                - name: clients
                  type: long
                  description: >
                    The number of connections that were aborted because the client died without closing the connection properly.
        
                - name: connects
                  type: long
                  description: >
                    The number of failed attempts to connect to the MySQL server.
        
            - name: connection
              type: group
              description: >
              fields:
                - name: errors
                  type: group
                  description: >
                  fields:
                    - name: peer_address
                      type: long
                      description: The number of errors that occurred while searching for connecting client IP addresses.
                    - name: accept
                      type: long
                      description: The number of errors that occurred during calls to accept() on the listening port.
                    - name: internal
                      type: long
                      description: >
                        The number of connections refused due to internal errors in the server, such as failure to start a new
                        thread or an out-of-memory condition.
                    - name: max
                      type: long
                      description: The number of connections refused because the server max_connections limit was reached.
                        thread or an out-of-memory condition.
                    - name: tcpwrap
                      type: long
                      description: The number of connections refused by the libwrap library.
                    - name: select
                      type: long
                      description: >
                        The number of errors that occurred during calls to select() or poll() on the listening port.
                        (Failure of this operation does not necessarily means a client connection was rejected.)
        
            - name: cache
              type: group
              description: >
              fields:
                - name: ssl
                  type: group
                  description: SSL session cache hits and misses.
                  fields:
                    - name: hits
                      type: long
                      description: The number of SSL session cache hits.
                    - name: misses
                      type: long
                      description: The number of SSL session cache misses.
                    - name: size
                      type: long
                      description: The SSL session cache size.
                - name: table
                  type: group
                  description: >
                  fields:
                    - name: open_cache
                      type: group
                      description: >
                      fields:
                        - name: hits
                          type: long
                          description: The number of hits for open tables cache lookups.
                        - name: misses
                          type: long
                          description: The number of misses for open tables cache lookups.
                        - name: overflows
                          type: long
                          description: >
                            Number of times, after a table is opened or closed, a cache instance has an unused entry and the
                            size of the instance is larger than table_open_cache / table_open_cache_instances
        
            - name: binlog
              type: group
              description: >
              fields:
                - name: cache.disk_use
                  type: long
                  description: >
        
                - name: cache.use
                  type: long
                  description: >
        
            - name: bytes
              type: group
              description: >
                Bytes stats.
              fields:
                - name: received
                  format: bytes
                  type: long
                  description: >
                    The number of bytes received from all clients.
        
                - name: sent
                  type: long
                  format: bytes
                  description: >
                    The number of bytes sent to all clients.
        
            - name: threads
              type: group
              description: >
                Threads stats.
              fields:
                - name: cached
                  type: long
                  description: >
                    The number of cached threads.
        
                - name: created
                  type: long
                  description: >
                    The number of created threads.
        
                - name: connected
                  type: long
                  description: >
                    The number of connected threads.
        
                - name: running
                  type: long
                  description: >
                    The number of running threads.
        
            - name: connections
              type: long
              description: >
        
            - name: created
              type: group
              description: >
              fields:
                - name: tmp.disk_tables
                  type: long
                  description: >
        
                - name: tmp.files
                  type: long
                  description: >
        
                - name: tmp.tables
                  type: long
                  description: >
        
            - name: delayed
              type: group
              description: >
              fields:
                - name: errors
                  type: long
                  description: >
        
                - name: insert_threads
                  type: long
                  description: >
        
                - name: writes
                  type: long
                  description: >
        
            - name: flush_commands
              type: long
              description: >
        
            - name: max_used_connections
              type: long
              description: >
        
            - name: open
              type: group
              description: >
              fields:
                - name: files
                  type: long
                  description: >
        
                - name: streams
                  type: long
                  description: >
        
                - name: tables
                  type: long
                  description: >
        
            - name: opened_tables
              type: long
              description: >
        
            - name: command
              type: group
              description: >
              fields:
                - name: delete
                  type: long
                  description: >
                    The number of DELETE queries since startup.
        
                - name: insert
                  type: long
                  description: >
                    The number of INSERT queries since startup.
        
                - name: select
                  type: long
                  description: >
                    The number of SELECT queries since startup.
        
                - name: update
                  type: long
                  description: >
                    The number of UPDATE queries since startup.
        
            - name: queries
              type: long
              description: >
                The number of statements executed by the server. This variable includes statements executed within stored programs, unlike the Questions variable. It does not count COM_PING or COM_STATISTICS commands.
        
            - name: questions
              type: long
              description: >
                The number of statements executed by the server. This includes only statements sent to the server by clients and not statements executed within stored programs, unlike the Queries variable. This variable does not count COM_PING, COM_STATISTICS, COM_STMT_PREPARE, COM_STMT_CLOSE, or COM_STMT_RESET commands.
        
            - name: handler
              type: group
              description: >
              fields:
                - name: commit
                  type: long
                  description: >
                    The number of internal COMMIT statements.
        
                - name: delete
                  type: long
                  description: >
                    The number of times that rows have been deleted from tables.
        
                - name: external_lock
                  type: long
                  description: >
                    The server increments this variable for each call to its external_lock() function, which generally occurs at the beginning and end of access to a table instance.
        
                - name: mrr_init
                  type: long
                  description: >
                    The number of times the server uses a storage engine's own Multi-Range Read implementation for table access.
        
                - name: prepare
                  type: long
                  description: >
                    A counter for the prepare phase of two-phase commit operations.
        
                - name: read
                  type: group
                  description: >
                  fields:
                    - name: first
                      type: long
                      description: >
                        The number of times the first entry in an index was read.
        
                    - name: key
                      type: long
                      description: >
                        The number of requests to read a row based on a key.
        
                    - name: last
                      type: long
                      description: >
                        The number of requests to read the last key in an index.
        
                    - name: next
                      type: long
                      description: >
                        The number of requests to read the next row in key order.
        
                    - name: prev
                      type: long
                      description: >
                        The number of requests to read the previous row in key order.
        
                    - name: rnd
                      type: long
                      description: >
                        The number of requests to read a row based on a fixed position.
        
                    - name: rnd_next
                      type: long
                      description: >
                        The number of requests to read the next row in the data file.
        
                - name: rollback
                  type: long
                  description: >
                    The number of requests for a storage engine to perform a rollback operation.
        
                - name: savepoint
                  type: long
                  description: >
                    The number of requests for a storage engine to place a savepoint.
        
                - name: savepoint_rollback
                  type: long
                  description: >
                    The number of requests for a storage engine to roll back to a savepoint.
        
                - name: update
                  type: long
                  description: >
                    The number of requests to update a row in a table.
        
                - name: write
                  type: long
                  description: >
                    The number of requests to insert a row in a table.
        
            - name: innodb
              type: group
              description: >
              fields:
              - name: rows
                type: group
                description: >
                fields:
                  - name: reads
                    type: long
                    description: The number of rows reads into InnoDB tables.
                  - name: inserted
                    type: long
                    description: The number of rows inserted into InnoDB tables.
                  - name: deleted
                    type: long
                    description: The number of rows deleted into InnoDB tables.
                  - name: updated
                    type: long
                    description: The number of rows updated into InnoDB tables.
              - name: buffer_pool
                type: group
                description: >
                fields:
                  - name: dump_status
                    type: long
                    description: >
                      The progress of an operation to record the pages held in the InnoDB buffer pool, triggered by the setting of innodb_buffer_pool_dump_at_shutdown or innodb_buffer_pool_dump_now.
        
                  - name: load_status
                    type: long
                    description: >
                      The progress of an operation to warm up the InnoDB buffer pool by reading in a set of pages corresponding to an earlier point in time, triggered by the setting of innodb_buffer_pool_load_at_startup or innodb_buffer_pool_load_now.
        
                  - name: bytes
                    type: group
                    description: >
                    fields:
                      - name: data
                        type: long
                        description: >
                          The total number of bytes in the InnoDB buffer pool containing data.
        
                      - name: dirty
                        type: long
                        description: >
                          The total current number of bytes held in dirty pages in the InnoDB buffer pool.
        
                  - name: pages
                    type: group
                    description: >
                    fields:
                      - name: data
                        type: long
                        description: >
                          The number of pages in the InnoDB buffer pool containing data.
        
                      - name: dirty
                        type: long
                        description: >
                          The current number of dirty pages in the InnoDB buffer pool.
        
                      - name: flushed
                        type: long
                        description: >
                          The number of requests to flush pages from the InnoDB buffer pool.
        
                      - name: free
                        type: long
                        description: >
                          The number of free pages in the InnoDB buffer pool.
        
                      - name: latched
                        type: long
                        description: >
                          The number of latched pages in the InnoDB buffer pool.
        
                      - name: misc
                        type: long
                        description: >
                          The number of pages in the InnoDB buffer pool that are busy because they have been allocated for administrative overhead, such as row locks or the adaptive hash index.
        
                      - name: total
                        type: long
                        description: >
                          The total size of the InnoDB buffer pool, in pages.
        
                  - name: read
                    type: group
                    description: >
                    fields:
                      - name: ahead
                        type: long
                        description: >
                          The number of pages read into the InnoDB buffer pool by the read-ahead background thread.
        
                      - name: ahead_evicted
                        type: long
                        description: >
                          The number of pages read into the InnoDB buffer pool by the read-ahead background thread that were subsequently evicted without having been accessed by queries.
        
                      - name: ahead_rnd
                        type: long
                        description: >
                          The number of "random" read-aheads initiated by InnoDB.
        
                      - name: requests
                        type: long
                        description: >
                          The number of logical read requests.
        
                  - name: pool
                    type: group
                    description: >
                    fields:
                      - name: reads
                        type: long
                        description: >
                          The number of logical reads that InnoDB could not satisfy from the buffer pool, and had to read directly from disk.
        
                      - name: resize_status
                        type: long
                        description: >
                          The status of an operation to resize the InnoDB buffer pool dynamically, triggered by setting the innodb_buffer_pool_size parameter dynamically.
        
                      - name: wait_free
                        type: long
                        description: >
                          Normally, writes to the InnoDB buffer pool happen in the background. When InnoDB needs to read or create a page and no clean pages are available, InnoDB flushes some dirty pages first and waits for that operation to finish. This counter counts instances of these waits.
        
                  - name: write_requests
                    type: long
                    description: >
                      The number of writes done to the InnoDB buffer pool.
- key: nats
  title: "NATS"
  description: >
    nats Module
  release: ga
  settings: ["ssl", "http"]
  fields:
    - name: nats
      type: group
      description: >
        `nats` contains statistics that were read from Nats
      fields:
        - name: server.id
          type: keyword
          description: >
            The server ID
        - name: server.time
          type: date
          deprecated: 8.0.0
          description: >
            Server time of metric creation
        - name: connection
          type: group
          description: >
            Contains nats connection related metrics
          release: ga
          fields:
            - name: name
              type: keyword
              description: >
                The name of the connection
            - name: subscriptions
              type: integer
              description: >
                The number of subscriptions in this connection
            - name: pending_bytes
              type: long
              format: bytes
              description: >
                The number of pending bytes of this connection
            - name: uptime
              type: long
              format: duration
              description: >
                The period the connection is up (sec)
            - name: idle_time
              type: long
              format: duration
              description: >
                The period the connection is idle (sec)
            - name: in
              type: group
              description: >
                The amount of incoming data
              fields:
                - name: messages
                  type: long
                  description: >
                    The amount of incoming messages
                - name: bytes
                  type: long
                  format: bytes
                  description: >
                    The amount of incoming bytes
            - name: out
              type: group
              description: >
                The amount of outgoing data
              fields:
                - name: messages
                  type: long
                  description: >
                    The amount of outgoing messages
                - name: bytes
                  type: long
                  format: bytes
                  description: >
                    The amount of outgoing bytes
        - name: connections
          type: group
          description: >
            Contains nats connection related metrics
          release: ga
          fields:
            - name: total
              type: integer
              description: >
                The number of currently active clients
        - name: route
          type: group
          description: >
            Contains nats route related metrics
          release: ga
          fields:
            - name: subscriptions
              type: integer
              description: >
                The number of subscriptions in this connection
            - name: remote_id
              type: keyword
              description: >
                The remote id on which the route is connected to
            - name: pending_size
              type: long
              description: >
                The number of pending routes
            - name: port
              type: integer
              description: >
                The port of the route
            - name: ip
              type: ip
              description: >
                The ip of the route
            - name: in
              type: group
              description: >
                The amount of incoming data
              fields:
                - name: messages
                  type: long
                  description: >
                    The amount of incoming messages
                - name: bytes
                  type: long
                  format: bytes
                  description: >
                    The amount of incoming bytes
            - name: out
              type: group
              description: >
                The amount of outgoing data
              fields:
                - name: messages
                  type: long
                  description: >
                    The amount of outgoing messages
                - name: bytes
                  type: long
                  format: bytes
                  description: >
                    The amount of outgoing bytes
        - name: routes
          type: group
          description: >
            Contains nats route related metrics
          release: ga
          fields:
            - name: total
              type: integer
              description: >
                The number of registered routes
        - name: stats
          type: group
          description: >
            Contains nats var related metrics
          release: ga
          fields:
            - name: uptime
              type: long
              format: duration
              description: >
                The period the server is up (sec)
            - name: mem.bytes
              type: long
              format: bytes
              description: >
                The current memory usage of NATS process
            - name: cores
              type: integer
              description: >
                The number of logical cores the NATS process runs on
            - name: cpu
              type: scaled_float
              format: percent
              description: >
                The current cpu usage of NATs process
            - name: total_connections
              type: long
              description: >
                The number of totally created clients
            - name: remotes
              type: integer
              description: >
                The number of registered remotes
            - name: in
              type: group
              description: >
                The amount of incoming data
              fields:
                - name: messages
                  type: long
                  description: >
                    The amount of incoming messages
                - name: bytes
                  type: long
                  format: bytes
                  description: >
                    The amount of incoming bytes
            - name: out
              type: group
              description: >
                The amount of outgoing data
              fields:
                - name: messages
                  type: long
                  description: >
                    The amount of outgoing messages
                - name: bytes
                  type: long
                  format: bytes
                  description: >
                    The amount of outgoing bytes
            - name: slow_consumers
              type: long
              description: >
                The number of slow consumers currently on NATS
            - name: http
              type: group
              description: >
                The http metrics of NATS server
              fields:
                - name: req_stats
                  type: group
                  description: >
                    The requests statistics
                  fields:
                    - name: uri
                      type: group
                      description: >
                        The request distribution on monitoring URIS
                      fields:
                        - name: routez
                          type: long
                          description: >
                            The number of hits on routez monitoring uri
                        - name: connz
                          type: long
                          description: >
                            The number of hits on connz monitoring uri
                        - name: varz
                          type: long
                          description: >
                            The number of hits on varz monitoring uri
                        - name: subsz
                          type: long
                          description: >
                            The number of hits on subsz monitoring uri
                        - name: root
                          type: long
                          description: >
                            The number of hits on root monitoring uri
        - name: subscriptions
          type: group
          description: >
            Contains nats subscriptions related metrics
          release: ga
          fields:
            - name: total
              type: integer
              description: >
                The number of active subscriptions
            - name: inserts
              type: long
              description: >
                The number of insert operations in subscriptions list
            - name: removes
              type: long
              description: >
                The number of remove operations in subscriptions list
            - name: matches
              type: long
              description: >
                The number of times a match is found for a subscription
            - name: cache.size
              type: integer
              description: >
                The number of result sets in the cache
            - name: cache.hit_rate
              type: scaled_float
              format: percent
              description: >
                The rate matches are being retrieved from cache
            - name: cache.fanout.max
              type: integer
              description: >
                The maximum fanout served by cache
            - name: cache.fanout.avg
              type: double
              description: >
                The average fanout served by cache
- key: nginx
  title: "Nginx"
  description: >
    Nginx server status metrics collected from various modules.
  short_config: false
  release: ga
  settings: ["ssl", "http"]
  fields:
    - name: nginx
      type: group
      description: >
        `nginx` contains the metrics that were scraped from nginx.
      fields:
        - name: stubstatus
          type: group
          description: >
            `stubstatus` contains the metrics that were scraped from the ngx_http_stub_status_module status page.
          release: ga
          fields:
            - name: hostname
              type: keyword
              description: >
                Nginx hostname.
            - name: active
              type: long
              description: >
                The current number of active client connections including Waiting connections.
            - name: accepts
              type: long
              description: >
                The total number of accepted client connections.
            - name: handled
              type: long
              description: >
                The total number of handled client connections.
            - name: dropped
              type: long
              description: >
                The total number of dropped client connections.
            - name: requests
              type: long
              description: >
                The total number of client requests.
            - name: current
              type: long
              description: >
                The current number of client requests.
            - name: reading
              type: long
              description: >
                The current number of connections where Nginx is reading the request header.
            - name: writing
              type: long
              description: >
                The current number of connections where Nginx is writing the response back to the client.
            - name: waiting
              type: long
              description: >
                The current number of idle client connections waiting for a request.
- key: openmetrics
  title: 'Openmetrics'
  release: beta
  description: >
    Openmetrics module
  settings: ["http", "ssl"]
  fields:
    - name: openmetrics
      type: group
      release: beta
      description: >
        `openmetrics` contains metrics from endpoints that are following Openmetrics format.
      fields:
        # Order is important here, labels will match first, the rest are double
        - name: help
          type: keyword
          description: >
            Brief description of the MetricFamily
        - name: type
          type: keyword
          description: >
            Metric type
        - name: unit
          type: keyword
          description: >
            Metric unit
        - name: labels.*
          type: object
          object_type: keyword
          description: >
            Openmetrics metric labels
        - name: metrics.*
          type: object
          object_type: double
          object_type_mapping_type: "*"
          description: >
            Openmetrics metric
        - name: exemplar.*
          type: object
          object_type: keyword
          description: >
            Openmetrics exemplars
        - name: exemplar.labels.*
          type: object
          object_type: keyword
          description: >
            Openmetrics metric exemplar labels
        - release: beta
- key: php_fpm
  title: "PHP_FPM"
  description: >
    PHP-FPM server status metrics collected from PHP-FPM.
  short_config: false
  release: ga
  settings: ["ssl", "http"]
  fields:
    - name: php_fpm
      type: group
      description: >
        `php_fpm` contains the metrics that were obtained from PHP-FPM status
        page call.
      fields:
        - name: pool
          type: group
          description: >
            `pool` contains the metrics that were obtained from the PHP-FPM process pool.
          fields:
            - name: name
              type: keyword
              description: >
                The name of the pool.
        - name: pool
          type: group
          description: >
            `pool` contains the metrics that were obtained from the PHP-FPM process
            pool.
          release: ga
          fields:
            - name: process_manager
              type: keyword
              description: >
                Static, dynamic or ondemand.
            - name: connections
              type: group
              description: >
                Connection state specific statistics.
              fields:
              - name: accepted
                type: long
                description: >
                  The number of incoming requests that the PHP-FPM server has accepted;
                  when a connection is accepted it is removed from the listen queue.
              - name: queued
                type: long
                description: >
                  The current number of connections that have been initiated, but not
                  yet accepted. If this value is non-zero it typically means that all
                  the available server processes are currently busy, and there are no
                  processes available to serve the next request. Raising
                  `pm.max_children` (provided the server can handle it) should help
                  keep this number low. This property follows from the fact that
                  PHP-FPM listens via a socket (TCP or file based), and thus inherits
                  some of the characteristics of sockets.
              - name: max_listen_queue
                type: long
                description: >
                  The maximum number of requests in the queue of pending
                  connections since FPM has started.
              - name: listen_queue_len
                type: long
                description: >
                  The size of the socket queue of pending connections.
            - name: processes
              type: group
              description: >
                Process state specific statistics.
              fields:
              - name: idle
                type: long
                description: >
                  The number of servers in the `waiting to process` state (i.e. not
                  currently serving a page). This value should fall between the
                  `pm.min_spare_servers` and `pm.max_spare_servers` values when the
                  process manager is `dynamic`.
              - name: active
                type: long
                description: >
                  The number of servers current processing a page - the minimum is `1`
                  (so even on a fully idle server, the result will be not read `0`).
              - name: total
                type: long
                description: >
                  The number of idle + active processes.
              - name: max_active
                type: long
                description: >
                  The maximum number of active processes since FPM has started.
              - name: max_children_reached
                type: long
                description: >
                  Number of times, the process limit has been reached,
                  when pm tries to start more children (works only for
                  pm 'dynamic' and 'ondemand').
            - name: slow_requests
              type: long
              description: >
                The number of times a request execution time has exceeded
                `request_slowlog_timeout`.
            - name: start_since
              type: long
              description: >
                Number of seconds since FPM has started.
            - name: start_time
              type: date
              description: >
                The date and time FPM has started.
        - name: process
          type: group
          description: >
            process contains the metrics that were obtained from the PHP-FPM process.
          release: ga
          fields:
          - name: pid
            type: alias
            path: process.pid
            migration: true
            description: >
              The PID of the process
          - name: state
            type: keyword
            description: >
              The state of the process (Idle, Running, etc)
          - name: start_time
            type: date
            description: >
              The date and time the process has started
          - name: start_since
            type: integer
            description: >
              The number of seconds since the process has started
          - name: requests
            type: integer
            description: >
              The number of requests the process has served
          - name: request_duration
            type: integer
            description: >
              The duration in microseconds (1 million in a second) of the current request (my own definition)
          - name: request_method
            type: alias
            path: http.request.method
            migration: true
            description: >
              The request method (GET, POST, etc) (of the current request)
          - name: request_uri
            type: alias
            path: url.original
            migration: true
            description: >
              The request URI with the query string (of the current request)
          - name: content_length
            type: alias
            path: http.response.body.bytes
            migration: true
            description: >
              The content length of the request (only with POST) (of the current request)
          - name: user
            type: alias
            path: user.name
            migration: true
            description: >
              The user (PHP_AUTH_USER) (or - if not set) (for the current request)
          - name: script
            type: keyword
            description: >
              The main script called (or - if not set) (for the current request)
          - name: last_request_cpu
            type: long
            description: >
              The CPU percentage the last request consumed. It's always 0 if the process is not in Idle state because CPU calculation is done when the request processing has terminated
          - name: last_request_memory
            type: integer
            description: >
              The max amount of memory the last request consumed. It's always 0 if the process is not in Idle state because memory calculation is done when the request processing has terminated
- key: postgresql
  title: "PostgreSQL"
  description: >
    Metrics collected from PostgreSQL servers.
  short_config: false
  release: ga
  fields:
    - name: postgresql
      type: group
      description: >
        PostgreSQL metrics.
      fields:
        - name: activity
          type: group
          description: >
            One document per server process, showing information related to the current
            activity of that process, such as state and current query. Collected by
            querying pg_stat_activity.
          release: ga
          fields:
            - name: database.oid
              type: long
              description: >
                OID of the database this backend is connected to.
            - name: database.name
              type: keyword
              description: >
                Name of the database this backend is connected to.
            - name: pid
              type: long
              description: >
                Process ID of this backend.
            - name: user.id
              type: long
              description: >
                OID of the user logged into this backend.
            - name: user.name
              description: >
                Name of the user logged into this backend.
            - name: application_name
              description: >
                Name of the application that is connected to this backend.
            - name: client.address
              description: >
                IP address of the client connected to this backend.
            - name: client.hostname
              description: >
                Host name of the connected client, as reported by a reverse DNS lookup of client_addr.
            - name: client.port
              type: long
              description: >
                TCP port number that the client is using for communication with this
                backend, or -1 if a Unix socket is used.
            - name: backend_type
              description: >
                Type of the current backend. Possible types are autovacuum launcher, autovacuum worker,
                logical replication launcher, logical replication worker, parallel worker, background
                writer, client backend, checkpointer, startup, walreceiver, walsender and walwriter.
                Extensions may register workers with additional backend types.
            - name: backend_start
              type: date
              description: >
                Time when this process was started, i.e., when the client connected to
                the server.
            - name: transaction_start
              type: date
              description: >
                Time when this process' current transaction was started.
            - name: query_start
              type: date
              description: >
                Time when the currently active query was started, or if state is not
                active, when the last query was started.
            - name: state_change
              type: date
              description: >
                Time when the state was last changed.
            - name: waiting
              type: boolean
              description: >
                True if this backend is currently waiting on a lock.
            - name: state
              description: >
                Current overall state of this backend. Possible values are:
        
                  * active: The backend is executing a query.
                  * idle: The backend is waiting for a new client command.
                  * idle in transaction: The backend is in a transaction, but is not
                    currently executing a query.
                  * idle in transaction (aborted): This state is similar to idle in
                    transaction, except one of the statements in the transaction caused
                    an error.
                  * fastpath function call: The backend is executing a fast-path function.
                  * disabled: This state is reported if track_activities is disabled in this backend.
            - name: query
              description: >
                Text of this backend's most recent query. If state is active this field
                shows the currently executing query. In all other states, it shows the
                last query that was executed.
            - name: wait_event
              description: >
                Wait event name if the backend is currently waiting.
            - name: wait_event_type
              description: >
                The type of event for which the backend is waiting.
        - name: bgwriter
          type: group
          description: >
            Statistics about the background writer process's activity. Collected using the
            pg_stat_bgwriter query.
          release: ga
          fields:
            - name: checkpoints.scheduled
              type: long
              description: >
                Number of scheduled checkpoints that have been performed.
            - name: checkpoints.requested
              type: long
              description: >
                Number of requested checkpoints that have been performed.
            - name: checkpoints.times.write.ms
              type: float
              description: >
                Total amount of time that has been spent in the portion of checkpoint
                processing where files are written to disk, in milliseconds.
            - name: checkpoints.times.sync.ms
              type: float
              description: >
                Total amount of time that has been spent in the portion of checkpoint
                processing where files are synchronized to disk, in milliseconds.
            - name: buffers.checkpoints
              type: long
              description: >
                Number of buffers written during checkpoints.
            - name: buffers.clean
              type: long
              description: >
                Number of buffers written by the background writer.
            - name: buffers.clean_full
              type: long
              description: >
                Number of times the background writer stopped a cleaning scan because it
                had written too many buffers.
            - name: buffers.backend
              type: long
              description: >
                Number of buffers written directly by a backend.
            - name: buffers.backend_fsync
              type: long
              description: >
                Number of times a backend had to execute its own fsync call (normally
                the background writer handles those even when the backend does its own
                write)
            - name: buffers.allocated
              type: long
              description: >
                Number of buffers allocated.
            - name: stats_reset
              type: date
              description: >
                Time at which these statistics were last reset.
        - name: database
          type: group
          description: >
            One row per database, showing database-wide statistics. Collected by querying
            pg_stat_database
          release: ga
          fields:
            - name: oid
              type: long
              description: >
                OID of the database this backend is connected to, or 0 for shared resources.
            - name: name
              type: keyword
              description: >
                Name of the database this backend is connected to, empty for shared resources.
            - name: number_of_backends
              type: long
              description: >
                Number of backends currently connected to this database.
            - name: transactions.commit
              type: long
              description: >
                Number of transactions in this database that have been committed.
            - name: transactions.rollback
              type: long
              description: >
                Number of transactions in this database that have been rolled back.
            - name: blocks.read
              type: long
              description: >
                Number of disk blocks read in this database.
            - name: blocks.hit
              type: long
              description: >
                Number of times disk blocks were found already in the buffer cache, so
                that a read was not necessary (this only includes hits in the PostgreSQL
                buffer cache, not the operating system's file system cache).
            - name: blocks.time.read.ms
              type: long
              description: >
                Time spent reading data file blocks by backends in this database, in
                milliseconds.
            - name: blocks.time.write.ms
              type: long
              description: >
                Time spent writing data file blocks by backends in this database, in
                milliseconds.
            - name: rows.returned
              type: long
              description: >
                Number of rows returned by queries in this database.
            - name: rows.fetched
              type: long
              description: >
                Number of rows fetched by queries in this database.
            - name: rows.inserted
              type: long
              description: >
                Number of rows inserted by queries in this database.
            - name: rows.updated
              type: long
              description: >
                Number of rows updated by queries in this database.
            - name: rows.deleted
              type: long
              description: >
                Number of rows deleted by queries in this database.
            - name: conflicts
              type: long
              description: >
                Number of queries canceled due to conflicts with recovery in this
                database.
            - name: temporary.files
              type: long
              description: >
                Number of temporary files created by queries in this database. All
                temporary files are counted, regardless of why the temporary file was
                created (e.g., sorting or hashing), and regardless of the log_temp_files
                setting.
            - name: temporary.bytes
              type: long
              description: >
                Total amount of data written to temporary files by queries in this
                database. All temporary files are counted, regardless of why the
                temporary file was created, and regardless of the log_temp_files
                setting.
            - name: deadlocks
              type: long
              description: >
                Number of deadlocks detected in this database.
            - name: stats_reset
              type: date
              description: >
                Time at which these statistics were last reset.
        
        - name: statement
          type: group
          description: >
            One document per query per user per database, showing information related
            invocation of that query, such as cpu usage and total time. Collected by
            querying pg_stat_statements.
          release: ga
          fields:
            - name: user.id
              type: long
              description: >
                OID of the user logged into the backend that ran the query.
            - name: database.oid
              type: long
              description: >
                OID of the database the query was run on.
            - name: query.id
              type: long
              description: >
                ID of the statement.
            - name: query.text
              description: >
                Query text
            - name: query.calls
              type: long
              description: >
                Number of times the query has been run.
            - name: query.rows
              type: long
              description: >
                Total number of rows returned by query.
            - name: query.time.total.ms
              type: float
              description: >
                Total number of milliseconds spent running query.
            - name: query.time.min.ms
              type: float
              description: >
                Minimum number of milliseconds spent running query.
            - name: query.time.max.ms
              type: float
              description: >
                Maximum number of milliseconds spent running query.
            - name: query.time.mean.ms
              type: long
              description: >
                Mean number of milliseconds spent running query.
            - name: query.time.stddev.ms
              type: long
              description: >
                Population standard deviation of time spent running query, in milliseconds.
            - name: query.memory.shared.hit
              type: long
              description: >
                Total number of shared block cache hits by the query.
            - name: query.memory.shared.read
              type: long
              description: >
                Total number of shared block cache read by the query.
            - name: query.memory.shared.dirtied
              type: long
              description: >
                Total number of shared block cache dirtied by the query.
            - name: query.memory.shared.written
              type: long
              description: >
                Total number of shared block cache written by the query.
            - name: query.memory.local.hit
              type: long
              description: >
                Total number of local block cache hits by the query.
            - name: query.memory.local.read
              type: long
              description: >
                Total number of local block cache read by the query.
            - name: query.memory.local.dirtied
              type: long
              description: >
                Total number of local block cache dirtied by the query.
            - name: query.memory.local.written
              type: long
              description: >
                Total number of local block cache written by the query.
            - name: query.memory.temp.read
              type: long
              description: >
                Total number of temp block cache read by the query.
            - name: query.memory.temp.written
              type: long
              description: >
                Total number of temp block cache written by the query.
- key: prometheus
  title: "Prometheus"
  description: >
    Stats scraped from a Prometheus endpoint.
  short_config: false
  release: ga
  settings: ["ssl", "http"]
  fields:
    - name: prometheus
      type: group
      fields:
        # Order is important here, labels will match first, the rest are double
        - name: labels.*
          type: object
          object_type: keyword
          description: >
            Prometheus metric labels
        - name: metrics.*
          type: object
          object_type: double
          object_type_mapping_type: "*"
          description: >
            Prometheus metric
        - name: query.*
          type: object
          object_type: double
          object_type_mapping_type: "*"
          description: >
            Prometheus value resulted from PromQL
        - release: ga
        - name: query
          type: group
          description: >
            query metricset
          release: ga
          fields:
        - name: remote_write
          type: group
          description: >
            remote write metrics from Prometheus server
          release: ga
          fields:
- key: rabbitmq
  title: "RabbitMQ"
  description: >
    RabbitMQ module
  release: ga
  settings: ["ssl", "http"]
  fields:
    - name: rabbitmq
      type: group
      description: >
      fields:
        - name: vhost
          type: keyword
          description: >
            Virtual host name with non-ASCII characters escaped as in C.
        - name: connection
          type: group
          description: >
            connection
          release: ga
          fields:
            - name: name
              type: keyword
              description: >
                The name of the connection with non-ASCII characters escaped as in C.
            - name: vhost
              type: alias
              path: rabbitmq.vhost
              migration: true
              description: >
                Virtual host name with non-ASCII characters escaped as in C.
            - name: user
              type: alias
              path: user.name
              migration: true
              description: >
                User name.
            - name: node
              type: alias
              path: rabbitmq.node.name
              migration: true
              description: >
                Node name.
            - name: state
              type: keyword
              description: >
                Connection state.
            - name: channels
              type: long
              description: >
                The number of channels on the connection.
            - name: channel_max
              type: long
              description: >
                The maximum number of channels allowed on the connection.
            - name: frame_max
              type: long
              description: >
                Maximum permissible size of a frame (in bytes) to negotiate with clients.
              format: bytes
            - name: type
              type: keyword
              description: >
                Type of the connection.
            - name: host
              type: keyword
              description: >
                Server hostname obtained via reverse DNS, or its IP address if reverse DNS failed or was disabled.
            - name: peer.host
              type: keyword
              description: >
                Peer hostname obtained via reverse DNS, or its IP address if reverse DNS failed or was not enabled.
            - name: port
              type: long
              description: >
                Server port.
            - name: peer.port
              type: long
              description: >
                Peer port.
            - name: packet_count.sent
              type: long
              description: >
                Number of packets sent on the connection.
            - name: packet_count.received
              type: long
              description: >
                Number of packets received on the connection.
            - name: packet_count.pending
              type: long
              description: >
                Number of packets pending on the connection.
            - name: octet_count.sent
              type: long
              description: >
                Number of octets sent on the connection.
            - name: octet_count.received
              type: long
              description: >
                Number of octets received on the connection.
            - name: client_provided.name
              type: keyword
              description: >
                User specified connection name.
        - name: exchange
          type: group
          description: >
            exchange
          release: ga
          fields:
            - name: name
              type: keyword
              description: >
                The name of the queue with non-ASCII characters escaped as in C.
            - name: vhost
              type: alias
              path: rabbitmq.vhost
              migration: true
              description: >
                Virtual host name with non-ASCII characters escaped as in C.
            - name: durable
              type: boolean
              description: >
                Whether or not the queue survives server restarts.
            - name: auto_delete
              type: boolean
              description: >
                Whether the queue will be deleted automatically when no longer used.
            - name: internal
              type: boolean
              description: >
                Whether the exchange is internal, i.e. cannot be directly published to by a client.
            - name: user
              type: alias
              path: user.name
              migration: true
              description: >
                User who created the exchange.
        
            - name: messages.publish_in.count
              type: long
              description: >
                 Count of messages published "in" to an exchange, i.e. not taking account of routing.
            - name: messages.publish_in.details.rate
              type: float
              description: >
                  How much the exchange publish-in count has changed per second in the most recent sampling interval.
            - name: messages.publish_out.count
              type: long
              description: >
                 Count of messages published "out" of an exchange, i.e. taking account of routing.
            - name: messages.publish_out.details.rate
              type: float
              description: >
                  How much the exchange publish-out count has changed per second in the most recent sampling interval.
        - name: node
          type: group
          description: >
            node
          release: ga
          fields:
            - name: disk.free.bytes
              type: long
              description: >
                Disk free space in bytes.
              format: bytes
            - name: disk.free.limit.bytes
              type: long
              description: >
                Point at which the disk alarm will go off.
              format: bytes
            - name: fd.total
              type: long
              description: >
                File descriptors available.
            - name: fd.used
              type: long
              description: >
                Used file descriptors.
            - name: gc.num.count
              type: long
              description: >
                Number of GC operations.
            - name: gc.reclaimed.bytes
              type: long
              description: >
                GC bytes reclaimed.
              format: bytes
            - name: io.file_handle.open_attempt.avg.ms
              type: long
              description: >
                File handle open avg time
            - name: io.file_handle.open_attempt.count
              type: long
              description: >
                File handle open attempts
            - name: io.read.avg.ms
              type: long
              description: >
                File handle read avg time
            - name: io.read.bytes
              type: long
              description: >
                Data read in bytes
              format: bytes
            - name: io.read.count
              type: long
              description: >
                Data read operations
            - name: io.reopen.count
              type: long
              description: >
                Data reopen operations
            - name: io.seek.avg.ms
              type: long
              description: >
                Data seek avg time
            - name: io.seek.count
              type: long
              description: >
                Data seek operations
            - name: io.sync.avg.ms
              type: long
              description: >
                Data sync avg time
            - name: io.sync.count
              type: long
              description: >
                Data sync operations
            - name: io.write.avg.ms
              type: long
              description: >
                Data write avg time
            - name: io.write.bytes
              type: long
              description: >
                Data write in bytes
              format: bytes
            - name: io.write.count
              type: long
              description: >
                Data write operations
            - name: mem.limit.bytes
              type: long
              description: >
                Point at which the memory alarm will go off.
              format: bytes
            - name: mem.used.bytes
              type: long
              description: >
                Memory used in bytes.
            - name: mnesia.disk.tx.count
              type: long
              description: >
                Number of Mnesia transactions which have been performed that required writes to disk.
            - name: mnesia.ram.tx.count
              type: long
              description: >
                Number of Mnesia transactions which have been performed that did not require writes to disk.
            - name: msg.store_read.count
              type: long
              description: >
                Number of messages which have been read from the message store.
            - name: msg.store_write.count
              type: long
              description: >
                Number of messages which have been written to the message store.
            - name: name
              type: keyword
              description:
                Node name
            - name: proc.total
              type: long
              description: >
                Maximum number of Erlang processes.
            - name: proc.used
              type: long
              description: >
                Number of Erlang processes in use.
            - name: processors
              type: long
              description: >
                Number of cores detected and usable by Erlang.
            - name: queue.index.journal_write.count
              type: long
              description: >
                Number of records written to the queue index journal.
            - name: queue.index.read.count
              type: long
              description: >
                Number of records read from the queue index.
            - name: queue.index.write.count
              type: long
              description: >
                Number of records written to the queue index.
            - name: run.queue
              type: long
              description: >
                Average number of Erlang processes waiting to run.
            - name: socket.total
              type: long
              description: >
                File descriptors available for use as sockets.
            - name: socket.used
              type: long
              description: >
                File descriptors used as sockets.
            - name: type
              type: keyword
              description: >
                Node type.
            - name: uptime
              type: long
              description: >
                Node uptime.
        - name: queue
          type: group
          description: >
            queue
          release: ga
          fields:
            - name: name
              type: keyword
              description: >
                The name of the queue with non-ASCII characters escaped as in C.
            - name: vhost
              type: alias
              path: rabbitmq.vhost
              migration: true
              description: >
                Virtual host name with non-ASCII characters escaped as in C.
            - name: durable
              type: boolean
              description: >
                Whether or not the queue survives server restarts.
            - name: auto_delete
              type: boolean
              description: >
                Whether the queue will be deleted automatically when no longer used.
            - name: exclusive
              type: boolean
              description: >
                Whether the queue is exclusive (i.e. has owner_pid).
            - name: node
              type: alias
              path: rabbitmq.node.name
              migration: true
              description: >
                Node name.
            - name: state
              type: keyword
              description: >
                The state of the queue. Normally 'running', but may be "{syncing, MsgCount}" if the queue is synchronising. Queues which are located on cluster nodes that are currently down will be shown with a status of 'down'.
            - name: arguments.max_priority
              type: long
              description: >
                Maximum number of priority levels for the queue to support.
            - name: consumers.count
              type: long
              description: >
                Number of consumers.
            - name: consumers.utilisation.pct
              type: long
              format: percent
              description: >
                Fraction of the time (between 0.0 and 1.0) that the queue is able to immediately deliver messages to consumers. This can be less than 1.0 if consumers are limited by network congestion or prefetch count.
            - name: messages.total.count
              type: long
              description: >
                Sum of ready and unacknowledged messages (queue depth).
            - name: messages.total.details.rate
              type: float
              description: >
                How much the queue depth has changed per second in the most recent sampling interval.
            - name: messages.ready.count
              type: long
              description: >
                Number of messages ready to be delivered to clients.
            - name: messages.ready.details.rate
              type: float
              description: >
                How much the count of messages ready has changed per second in the most recent sampling interval.
            - name: messages.unacknowledged.count
              type: long
              description: >
                Number of messages delivered to clients but not yet acknowledged.
            - name: messages.unacknowledged.details.rate
              type: float
              description: >
                How much the count of unacknowledged messages has changed per second in the most recent sampling interval.
            - name: messages.persistent.count
              type: long
              description: >
                Total number of persistent messages in the queue (will always be 0 for transient queues).
            - name: memory.bytes
              type: long
              format: bytes
              description: >
                Bytes of memory consumed by the Erlang process associated with the queue, including stack, heap and internal structures.
            - name: disk.reads.count
              type: long
              description: >
                Total number of times messages have been read from disk by this queue since it started.
            - name: disk.writes.count
              type: long
              description: >
                Total number of times messages have been written to disk by this queue since it started.
        - name: shovel
          type: group
          release: beta
          description: >
            shovel
          fields:
            - name: name
              type: keyword
              description: >
                The name of the shovel with non-ASCII characters escaped as in C.
            - name: vhost
              type: alias
              path: rabbitmq.vhost
              migration: true
              description: >
                Virtual host name with non-ASCII characters escaped as in C.
            - name: node
              type: alias
              path: rabbitmq.node.name
              migration: true
              description: >
                Node name.
            - name: state
              type: keyword
              description: >
                The state of the shovel. Normally 'running', but could be 'starting' or 'terminated'.
            - name: type
              type: keyword
              description: >
                The type of the shovel. Either 'static' or 'dynamic'.
- key: redis
  title: "Redis"
  description: >
    Redis metrics collected from Redis.
  release: ga
  fields:
    - name: redis
      type: group
      description: >
        `redis` contains the information and statistics from Redis.
      fields:
        - name: info
          type: group
          description: >
            `info` contains the information and statistics returned by the `INFO` command.
          release: ga
          fields:
            - name: clients
              type: group
              description: >
                Redis client stats.
              fields:
                - name: connected
                  type: long
                  description: >
                    Number of client connections (excluding connections from slaves).
                - name: max_output_buffer
                  type: long
                  description: >
                    Longest output list among current client connections.
                - name: max_input_buffer
                  type: long
                  description: >
                    Biggest input buffer among current client connections (on redis 5.0).
                - name: blocked
                  type: long
                  description: >
                    Number of clients pending on a blocking call (BLPOP, BRPOP, BRPOPLPUSH).
        
            - name: cluster
              type: group
              description: >
                Redis cluster information.
              fields:
                - name: enabled
                  type: boolean
                  description: >
                    Indicates that the Redis cluster is enabled.
        
            - name: cpu
              type: group
              description: >
                Redis CPU stats
              fields:
                - name: used.sys
                  type: scaled_float
                  description: >
                    System CPU consumed by the Redis server.
                - name: used.sys_children
                  type: scaled_float
                  description: >
                    System CPU consumed by the background processes.
                - name: used.user
                  type: scaled_float
                  description: >
                    User CPU consumed by the Redis server.
                - name: used.user_children
                  type: scaled_float
                  description: >
                    User CPU consumed by the background processes.
        
            - name: memory
              type: group
              description: >
                Redis memory stats.
              fields:
                - name: used.value
                  type: long
                  format: bytes
                  description: >
                    Total number of bytes allocated by Redis.
                - name: used.rss
                  type: long
                  format: bytes
                  description: >
                    Number of bytes that Redis allocated as seen by the operating system (a.k.a resident set size).
                - name: used.peak
                  type: long
                  format: bytes
                  description: >
                    Peak memory consumed by Redis.
                - name: used.lua
                  type: long
                  format: bytes
                  description: >
                    Used memory by the Lua engine.
                - name: used.dataset
                  type: long
                  format: bytes
                  description: >
                    The size in bytes of the dataset
        
                - name: max.value
                  type: long
                  format: bytes
                  description: >
                    Memory limit.
                - name: max.policy
                  type: keyword
                  description: >
                    Eviction policy to use when memory limit is reached.
        
                - name: fragmentation.ratio
                  type: float
                  description: >
                    Ratio between used_memory_rss and used_memory
                - name: fragmentation.bytes
                  type: long
                  format: bytes
                  description: >
                    Bytes between used_memory_rss and used_memory
        
                - name: active_defrag.is_running
                  type: boolean
                  description: >
                    Flag indicating if active defragmentation is active
        
                - name: allocator
                  type: keyword
                  description: >
                    Memory allocator.
        
                - name: allocator_stats
                  type: group
                  fields:
                    - name: allocated
                      type: long
                      format: bytes
                      description: >
                        Allocated memory
                    - name: active
                      type: long
                      format: bytes
                      description: >
                        Active memory
                    - name: resident
                      type: long
                      format: bytes
                      description: >
                        Resident memory
                    - name: fragmentation.ratio
                      type: float
                      description: >
                        Fragmentation ratio
                    - name: fragmentation.bytes
                      type: long
                      format: bytes
                      description: >
                        Fragmented bytes
                    - name: rss.ratio
                      type: float
                      description: >
                        Resident ratio
                    - name: rss.bytes
                      type: long
                      format: bytes
                      description: >
                        Resident bytes
        
            - name: persistence
              type: group
              description: >
                Redis CPU stats.
              fields:
                - name: loading
                  type: boolean
                  description: >
                    Flag indicating if the load of a dump file is on-going
                  # ToDo move `loading` to `loading.enabled` and add other loading stats beside that (start time, total bytes, loaded bytes, ...)
        
                - name: rdb
                  type: group
                  description: >
                    Provides information about RDB persistence
                  fields:
                    - name: last_save.changes_since
                      type: long
                      description: >
                        Number of changes since the last dump
                    - name: last_save.time
                      type: long
                      description: >
                        Epoch-based timestamp of last successful RDB save
        
                    - name: bgsave.in_progress
                      type: boolean
                      description: >
                        Flag indicating a RDB save is on-going
                    - name: bgsave.last_status
                      type: keyword
                      description: >
                        Status of the last RDB save operation
                    - name: bgsave.last_time.sec
                      type: long
                      format: duration
                      description: >
                        Duration of the last RDB save operation in seconds
                    - name: bgsave.current_time.sec
                      type: long
                      format: duration
                      description: >
                        Duration of the on-going RDB save operation if any
        
                    - name: copy_on_write.last_size
                      type: long
                      format: bytes
                      description: >
                        The size in bytes of copy-on-write allocations during the last RBD save operation
        
                - name: aof
                  type: group
                  description: >
                    Provides information about AOF persitence
                  fields:
                    - name: enabled
                      type: boolean
                      description: >
                        Flag indicating AOF logging is activated
        
                    - name: rewrite.in_progress
                      type: boolean
                      description: >
                        Flag indicating a AOF rewrite operation is on-going
                    - name: rewrite.scheduled
                      type: boolean
                      description: >
                        Flag indicating an AOF rewrite operation will be scheduled once the on-going RDB save is complete.
                    - name: rewrite.last_time.sec
                      type: long
                      format: duration
                      description: >
                        Duration of the last AOF rewrite operation in seconds
                    - name: rewrite.current_time.sec
                      type: long
                      format: duration
                      description: >
                        Duration of the on-going AOF rewrite operation if any
                    - name: rewrite.buffer.size
                      type: long
                      format: bytes
                      description: >
                        Size of the AOF rewrite buffer
        
                    - name: bgrewrite.last_status
                      type: keyword
                      description: >
                        Status of the last AOF rewrite operatio
        
                    - name: write.last_status
                      type: keyword
                      description: >
                        Status of the last write operation to the AOF
        
                    - name: copy_on_write.last_size
                      type: long
                      format: bytes
                      description: >
                        The size in bytes of copy-on-write allocations during the last RBD save operation
        
                    - name: buffer.size
                      type: long
                      format: bytes
                      description: >
                        Size of the AOF buffer
        
                    - name: size.current
                      type: long
                      format: bytes
                      description: >
                        AOF current file size
                    - name: size.base
                      type: long
                      format: bytes
                      description: >
                        AOF file size on latest startup or rewrite
        
                    - name: fsync.pending
                      type: long
                      description: >
                        Number of fsync pending jobs in background I/O queue
                    - name: fsync.delayed
                      type: long
                      description: >
                        Delayed fsync counter
        
            - name: replication
              type: group
              description: >
                Replication
              fields:
                - name: role
                  type: keyword
                  description: >
                    Role of the instance (can be "master", or "slave").
        
                - name: connected_slaves
                  type: long
                  description: >
                    Number of connected slaves
        
                - name: backlog.active
                  type: long
                  description: >
                    Flag indicating replication backlog is active
                - name: backlog.size
                  type: long
                  format: bytes
                  description: >
                    Total size in bytes of the replication backlog buffer
                - name: backlog.first_byte_offset
                  type: long
                  description: >
                    The master offset of the replication backlog buffer
                - name: backlog.histlen
                  type: long
                  description: >
                    Size in bytes of the data in the replication backlog buffer
        
                - name: master.offset
                  type: long
                  description: >
                    The server's current replication offset
                - name: master.second_offset
                  type: long
                  description: >
                    The offset up to which replication IDs are accepted
                - name: master.link_status
                  type: keyword
                  description: >
                    Status of the link (up/down)
                - name: master.last_io_seconds_ago
                  type: long
                  format: duration
                  description: >
                    Number of seconds since the last interaction with master
                - name: master.sync.in_progress
                  type: boolean
                  description: >
                     Indicate the master is syncing to the slave
                - name: master.sync.left_bytes
                  type: long
                  format: bytes
                  description: >
                    Number of bytes left before syncing is complete
                - name: master.sync.last_io_seconds_ago
                  type: long
                  format: duration
                  description: >
                    Number of seconds since last transfer I/O during a SYNC operation
        
                - name: slave.offset
                  type: long
                  description: >
                    The replication offset of the slave instance
                - name: slave.priority
                  type: long
                  description: >
                    The priority of the instance as a candidate for failover
                - name: slave.is_readonly
                  type: boolean
                  description: >
                    Flag indicating if the slave is read-only
        
            - name: server
              type: group
              description: >
                Server info
              fields:
                - name: version
                  type: alias
                  path: service.version
                  migration: true
                  description:
        
                - name: git_sha1
                  type: keyword
                  description:
        
                - name: git_dirty
                  type: keyword
                  description:
        
                - name: build_id
                  type: keyword
                  description:
        
                - name: mode
                  type: keyword
                  description:
        
                - name: os
                  type: alias
                  path: os.full
                  migration: true
                  description:
        
                - name: arch_bits
                  type: keyword
                  description:
        
                - name: multiplexing_api
                  type: keyword
                  description:
        
                - name: gcc_version
                  type: keyword
                  description:
        
                - name: process_id
                  type: alias
                  path: process.pid
                  migration: true
                  description:
        
                - name: run_id
                  type: keyword
                  description:
        
                - name: tcp_port
                  type: long
                  description:
        
                - name: uptime
                  type: long
                  description:
        
                - name: hz
                  type: long
                  description:
        
                - name: lru_clock
                  type: long
                  description:
        
                - name: config_file
                  type: keyword
                  description:
        
            - name: stats
              type: group
              description: >
                Redis stats.
              fields:
                - name: connections.received
                  type: long
                  description:
                    Total number of connections received.
                - name: connections.rejected
                  type: long
                  description:
                    Total number of connections rejected.
        
                - name: commands_processed
                  type: long
                  description:
                    Total number of commands processed.
        
                - name: net.input.bytes
                  type: long
                  description:
                    Total network input in bytes.
                - name: net.output.bytes
                  type: long
                  description:
                    Total network output in bytes.
        
                - name: instantaneous.ops_per_sec
                  type: long
                  description: >
                    Number of commands processed per second
                - name: instantaneous.input_kbps
                  type: scaled_float
                  description: >
                    The network's read rate per second in KB/sec
                - name: instantaneous.output_kbps
                  type: scaled_float
                  description: >
                    The network's write rate per second in KB/sec
        
                - name: sync.full
                  type: long
                  description: >
                    The number of full resyncs with slaves
                - name: sync.partial.ok
                  type: long
                  description: >
                    The number of accepted partial resync requests
                - name: sync.partial.err
                  type: long
                  description: >
                    The number of denied partial resync requests
        
                - name: keys.expired
                  type: long
                  description: >
                    Total number of key expiration events
                - name: keys.evicted
                  type: long
                  description: >
                    Number of evicted keys due to maxmemory limit
        
                - name: keyspace.hits
                  type: long
                  description: >
                    Number of successful lookup of keys in the main dictionary
                - name: keyspace.misses
                  type: long
                  description: >
                    Number of failed lookup of keys in the main dictionary
        
                - name: pubsub.channels
                  type: long
                  description: >
                    Global number of pub/sub channels with client subscriptions
                - name: pubsub.patterns
                  type: long
                  description: >
                    Global number of pub/sub pattern with client subscriptions
        
                - name: latest_fork_usec
                  type: long
                  description: >
                    Duration of the latest fork operation in microseconds
        
                - name: migrate_cached_sockets
                  type: long
                  description: >
                    The number of sockets open for MIGRATE purposes
        
                - name: slave_expires_tracked_keys
                  type: long
                  description: >
                    The number of keys tracked for expiry purposes (applicable only to writable slaves)
        
                - name: active_defrag.hits
                  type: long
                  description: >
                    Number of value reallocations performed by active the defragmentation process
                - name: active_defrag.misses
                  type: long
                  description: >
                    Number of aborted value reallocations started by the active defragmentation process
                - name: active_defrag.key_hits
                  type: long
                  description: >
                    Number of keys that were actively defragmented
                - name: active_defrag.key_misses
                  type: long
                  description: >
                    Number of keys that were skipped by the active defragmentation process
            - name: slowlog.count
              type: long
              description: >
                Count of slow operations
        
            - name: commandstats
              type: group
              description: >
                Redis command statistics
              fields:
                - name: "*.calls"
                  type: long
                  description: >
                    The number of calls that reached command execution (not rejected).
                - name: "*.usec"
                  type: long
                  description: >
                    The total CPU time consumed by these commands.
                - name: "*.usec_per_call"
                  type: float
                  description: >
                    The average CPU consumed per command execution.
                - name: "*.rejected_calls"
                  type: long
                  description: >
                    The number of rejected calls (on redis 6.2-rc2).
                - name: "*.failed_calls"
                  type: long
                  description: >
                    The number of failed calls (on redis 6.2-rc2).
        - name: key
          type: group
          description: >
            `key` contains information about keys.
          release: ga
          fields:
            - name: name
              type: keyword
              description: >
                Key name.
        
            - name: id
              type: keyword
              description: >
                Unique id for this key (With the form <keyspace>:<name>).
        
            - name: type
              type: keyword
              description: >
                Key type as shown by `TYPE` command.
        
            - name: length
              type: long
              description: >
                Length of the key (Number of elements for lists, length for strings, cardinality for sets).
        
            - name: expire.ttl
              type: long
              description: >
                Seconds to expire.
        - name: keyspace
          type: group
          description: >
            `keyspace` contains the information about the keyspaces returned by the `INFO` command.
          release: ga
          fields:
            - name: id
              type: keyword
              description: >
                Keyspace identifier.
        
            - name: avg_ttl
              type: long
              description: >
                Average ttl.
        
            - name: keys
              type: long
              description: >
                Number of keys in the keyspace.
        
            - name: expires
              type: long
              description: >
- key: system
  title: "System"
  description: >
    System status metrics, like CPU and memory usage, that are collected from the operating system.
  short_config: true
  release: ga
  fields:
    - name: process
      type: group
      description: >
        Process metrics.
      fields:
        - name: state
          type: keyword
          description: >
            The process state. For example: "running".
        - name: cpu.pct
          type: scaled_float
          format: percent
          description: >
            The percentage of CPU time spent by the process since the last event.
            This value is normalized by the number of CPU cores and it ranges
            from 0 to 1.
        - name: cpu.start_time
          type: date
          description: >
            The time when the process was started.
        - name: memory.pct
          type: scaled_float
          format: percent
          description: >
            The percentage of memory the process occupied in main memory (RAM).
    - name: system
      type: group
      description: >
        `system` contains local system metrics.
      fields:
        - name: core
          type: group
          description: >
            `system-core` contains CPU metrics for a single core of a multi-core system.
          release: ga
          fields:
            - name: id
              type: long
              description: >
                CPU Core number.
        
            # Percentages
            - name: total.pct
              type: scaled_float
              format: percent
              description: >
                Total active time spent by the core
        
            - name: user.pct
              type: scaled_float
              format: percent
              description: >
                The percentage of CPU time spent in user space.
        
            - name: user.ticks
              type: long
              description: >
               The amount of CPU time spent in user space.
        
            - name: system.pct
              type: scaled_float
              format: percent
              description: >
                The percentage of CPU time spent in kernel space.
        
            - name: system.ticks
              type: long
              description: >
                The amount of CPU time spent in kernel space.
        
            - name: nice.pct
              type: scaled_float
              format: percent
              description: >
                The percentage of CPU time spent on low-priority processes.
        
            - name: nice.ticks
              type: long
              description: >
                The amount of CPU time spent on low-priority processes.
        
            - name: idle.pct
              type: scaled_float
              format: percent
              description: >
                The percentage of CPU time spent idle.
        
            - name: idle.ticks
              type: long
              description: >
                The amount of CPU time spent idle.
        
            - name: iowait.pct
              type: scaled_float
              format: percent
              description: >
                The percentage of CPU time spent in wait (on disk).
        
            - name: iowait.ticks
              type: long
              description: >
                The amount of CPU time spent in wait (on disk).
        
            - name: irq.pct
              type: scaled_float
              format: percent
              description: >
                The percentage of CPU time spent servicing and handling hardware interrupts.
        
            - name: irq.ticks
              type: long
              description: >
                The amount of CPU time spent servicing and handling hardware interrupts.
        
            - name: softirq.pct
              type: scaled_float
              format: percent
              description: >
                The percentage of CPU time spent servicing and handling software interrupts.
        
            - name: softirq.ticks
              type: long
              description: >
                The amount of CPU time spent servicing and handling software interrupts.
        
            - name: steal.pct
              type: scaled_float
              format: percent
              description: >
                The percentage of CPU time spent in involuntary wait by the virtual CPU while the hypervisor
                was servicing another processor.
                Available only on Unix.
        
            - name: steal.ticks
              type: long
              description: >
                The amount of CPU time spent in involuntary wait by the virtual CPU while the hypervisor
                was servicing another processor.
                Available only on Unix.
        
            - name: model_number
              type: keyword
              description: >
                CPU model number. Only availabe on Linux
        
            - name: model_name
              type: keyword
              description: >
                CPU model name. Only availabe on Linux
        
            - name: mhz
              type: float
              description: >
                CPU core current clock. Only availabe on Linux
        
            - name: core_id
              type: keyword
              description: >
                CPU physical core ID. One core might might execute multiple threads, hence more than
                one `system.core.id` can share the same `system.core.core_id`. Only availabe on Linux
        
            - name: physical_id
              type: keyword
              description: >
                CPU core physical ID. Only availabe on Linux
        - name: cpu
          type: group
          description: >
            `cpu` contains local CPU stats.
          release: ga
          fields:
            - name: cores
              type: long
              description: >
                The number of CPU cores present on the host. The non-normalized
                percentages will have a maximum value of `100% * cores`. The
                normalized percentages already take this value into account and have
                a maximum value of 100%.
        
            # Percentages
            - name: user.pct
              type: scaled_float
              format: percent
              description: >
                The percentage of CPU time spent in user space. On multi-core systems,
                you can have percentages that are greater than 100%. For example, if 3
                cores are at 60% use, then the `system.cpu.user.pct` will be 180%.
        
            - name: system.pct
              type: scaled_float
              format: percent
              description: >
                The percentage of CPU time spent in kernel space.
        
            - name: nice.pct
              type: scaled_float
              format: percent
              description: >
                The percentage of CPU time spent on low-priority processes.
        
            - name: idle.pct
              type: scaled_float
              format: percent
              description: >
                The percentage of CPU time spent idle.
        
            - name: iowait.pct
              type: scaled_float
              format: percent
              description: >
                The percentage of CPU time spent in wait (on disk).
        
            - name: irq.pct
              type: scaled_float
              format: percent
              description: >
                The percentage of CPU time spent servicing and handling hardware interrupts.
        
            - name: softirq.pct
              type: scaled_float
              format: percent
              description: >
                The percentage of CPU time spent servicing and handling software interrupts.
        
            - name: steal.pct
              type: scaled_float
              format: percent
              description: >
                The percentage of CPU time spent in involuntary wait by the virtual CPU while the hypervisor
                was servicing another processor.
                Available only on Unix.
        
            - name: total.pct
              type: scaled_float
              format: percent
              description: >
                The percentage of CPU time spent in states other than Idle and IOWait.
        
            # Normalized Percentages
            - name: user.norm.pct
              type: scaled_float
              format: percent
              description: >
                The percentage of CPU time spent in user space.
        
            - name: system.norm.pct
              type: scaled_float
              format: percent
              description: >
                The percentage of CPU time spent in kernel space.
        
            - name: nice.norm.pct
              type: scaled_float
              format: percent
              description: >
                The percentage of CPU time spent on low-priority processes.
        
            - name: idle.norm.pct
              type: scaled_float
              format: percent
              description: >
                The percentage of CPU time spent idle.
        
            - name: iowait.norm.pct
              type: scaled_float
              format: percent
              description: >
                The percentage of CPU time spent in wait (on disk).
        
            - name: irq.norm.pct
              type: scaled_float
              format: percent
              description: >
                The percentage of CPU time spent servicing and handling hardware interrupts.
        
            - name: softirq.norm.pct
              type: scaled_float
              format: percent
              description: >
                The percentage of CPU time spent servicing and handling software interrupts.
        
            - name: steal.norm.pct
              type: scaled_float
              format: percent
              description: >
                The percentage of CPU time spent in involuntary wait by the virtual CPU while the hypervisor
                was servicing another processor.
                Available only on Unix.
        
            - name: total.norm.pct
              type: scaled_float
              format: percent
              description: >
                The percentage of CPU time in states other than Idle and IOWait, normalised by the number of cores.
        
        
            # Ticks
            - name: user.ticks
              type: long
              description: >
               The amount of CPU time spent in user space.
        
            - name: system.ticks
              type: long
              description: >
                The amount of CPU time spent in kernel space.
        
            - name: nice.ticks
              type: long
              description: >
                The amount of CPU time spent on low-priority processes.
        
            - name: idle.ticks
              type: long
              description: >
                The amount of CPU time spent idle.
        
            - name: iowait.ticks
              type: long
              description: >
                The amount of CPU time spent in wait (on disk).
        
            - name: irq.ticks
              type: long
              description: >
                The amount of CPU time spent servicing and handling hardware interrupts.
        
            - name: softirq.ticks
              type: long
              description: >
                The amount of CPU time spent servicing and handling software interrupts.
        
            - name: steal.ticks
              type: long
              description: >
                The amount of CPU time spent in involuntary wait by the virtual CPU while the hypervisor
                was servicing another processor.
                Available only on Unix.
        - name: diskio
          type: group
          description: >
            `disk` contains disk IO metrics collected from the operating system.
          release: ga
          fields:
            - name: name
              type: keyword
              example: sda1
              description: >
                The disk name.
        
            - name: serial_number
              type: keyword
              description: >
                The disk's serial number. This may not be provided by all operating
                systems.
        
            - name: read.count
              type: long
              description: >
                The total number of reads completed successfully.
        
            - name: write.count
              type: long
              description: >
                The total number of writes completed successfully.
        
            - name: read.bytes
              type: long
              format: bytes
              description: >
                The total number of bytes read successfully. On Linux this is
                the number of sectors read multiplied by an assumed sector size of 512.
        
            - name: write.bytes
              type: long
              format: bytes
              description: >
                The total number of bytes written successfully. On Linux this is
                the number of sectors written multiplied by an assumed sector size of
                512.
        
            - name: read.time
              type: long
              description: >
                The total number of milliseconds spent by all reads.
        
            - name: write.time
              type: long
              description: >
                The total number of milliseconds spent by all writes.
        
            - name: io.time
              type: long
              description: >
                The total number of of milliseconds spent doing I/Os.
            
            - name: io.ops
              type: long
              description: >
                The total number of I/Os in progress.
        - name: entropy
          type: group
          description: >
            Available system entropy
          release: ga
          fields:
            - name: available_bits
              type: long
              description: >
                The available bits of entropy
            - name: pct
              type: scaled_float
              format: percent
              description: >
                The percentage of available entropy, relative to the pool size of 4096
        - name: filesystem
          type: group
          description: >
            `filesystem` contains local filesystem stats.
          release: ga
          fields:
            - name: available
              type: long
              format: bytes
              description: >
                The disk space available to an unprivileged user in bytes.
            - name: device_name
              type: keyword
              description: >
                The disk name. For example: `/dev/disk1`
            - name: type
              type: keyword
              description: >
                The disk type. For example: `ext4`. In some case for Windows OS the value will be `unavailable` as access to this information is not allowed (ex. external disks).
            - name: mount_point
              type: keyword
              description: >
                The mounting point. For example: `/`
            - name: files
              type: long
              description: >
                Total number of inodes on the system, which will be a combination of files, folders, symlinks, and devices.
            - name: options
              type: keyword
              description: >
                The options present on the filesystem mount.
            - name: free
              type: long
              format: bytes
              description: >
                The disk space available in bytes.
            - name: free_files
              type: long
              description: >
                The number of free inodes in the file system.
            - name: total
              type: long
              format: bytes
              description: >
                The total disk space in bytes.
            - name: used.bytes
              type: long
              format: bytes
              description: >
                The used disk space in bytes.
            - name: used.pct
              type: scaled_float
              format: percent
              description: >
                The percentage of used disk space.
        
        
        - name: fsstat
          type: group
          description: >
            `system.fsstat` contains filesystem metrics aggregated from all mounted
            filesystems.
          release: ga
          fields:
            - name: count
              type: long
              description: Number of file systems found.
            - name: total_files
              type: long
              description: Total number of inodes on the system, which will be a combination of files, folders, symlinks, and devices. Not on Windows.
            - name: total_size
              format: bytes
              type: group
              description: Nested file system docs.
              fields:
                - name: free
                  type: long
                  format: bytes
                  description: >
                    Total free space.
                - name: used
                  type: long
                  format: bytes
                  description: >
                    Total used space.
                - name: total
                  type: long
                  format: bytes
                  description: >
                    Total space (used plus free).
        - name: load
          type: group
          description: >
            CPU load averages.
          release: ga
          fields:
            - name: "1"
              type: scaled_float
              scaling_factor: 100
              description: >
                Load average for the last minute.
            - name: "5"
              type: scaled_float
              scaling_factor: 100
              description: >
                Load average for the last 5 minutes.
            - name: "15"
              type: scaled_float
              scaling_factor: 100
              description: >
                Load average for the last 15 minutes.
        
            - name: "norm.1"
              type: scaled_float
              scaling_factor: 100
              description: >
                Load for the last minute divided by the number of cores.
        
            - name: "norm.5"
              type: scaled_float
              scaling_factor: 100
              description: >
                Load for the last 5 minutes divided by the number of cores.
        
            - name: "norm.15"
              type: scaled_float
              scaling_factor: 100
              description: >
                Load for the last 15 minutes divided by the number of cores.
        
            - name: "cores"
              type: long
              description: >
                The number of CPU cores present on the host.
        - name: memory
          type: group
          description: >
            `memory` contains local memory stats.
          release: ga
          fields:
            - name: total
              type: long
              format: bytes
              description: >
                Total memory.
        
            - name: used.bytes
              type: long
              format: bytes
              description: >
                Used memory.
        
            - name: free
              type: long
              format: bytes
              description: >
                The total amount of free memory in bytes. This value does not include memory consumed by system caches and
                buffers (see system.memory.actual.free).
        
            - name: cached
              type: long
              format: bytes
              description: >
                Total Cached memory on system.
        
            - name: used.pct
              type: scaled_float
              format: percent
              description: >
                The percentage of used memory.
        
            - name: actual
              type: group
              description: >
                Actual memory used and free.
              fields:
        
                - name: used.bytes
                  type: long
                  format: bytes
                  description: >
                    Actual used memory in bytes. It represents the difference between the total and the available memory. The
                    available memory depends on the OS. For more details, please check `system.actual.free`.
        
                - name: free
                  type: long
                  format: bytes
                  description: >
                    Actual free memory in bytes. It is calculated based on the OS. On Linux this value will be MemAvailable from /proc/meminfo, 
                    or calculated from free memory plus caches and buffers if /proc/meminfo is not available.
                    On OSX it is a sum of free memory and the inactive memory. On Windows, it is equal
                    to `system.memory.free`.
        
                - name: used.pct
                  type: scaled_float
                  format: percent
                  description: >
                    The percentage of actual used memory.
        
            - name: swap
              type: group
              prefix: "[float]"
              description: This group contains statistics related to the swap memory usage on the system.
              fields:
                - name: total
                  type: long
                  format: bytes
                  description: >
                    Total swap memory.
        
                - name: used.bytes
                  type: long
                  format: bytes
                  description: >
                    Used swap memory.
        
                - name: free
                  type: long
                  format: bytes
                  description: >
                    Available swap memory.
        
                - name: used.pct
                  type: scaled_float
                  format: percent
                  description: >
                    The percentage of used swap memory.
        - name: network
          type: group
          description: >
            `network` contains network IO metrics for a single network interface.
          release: ga
          fields:
            - name: name
              type: keyword
              example: eth0
              description: >
                The network interface name.
        
            - name: out.bytes
              type: long
              format: bytes
              description: >
                The number of bytes sent.
        
            - name: in.bytes
              type: long
              format: bytes
              description: >
                The number of bytes received.
        
            - name: out.packets
              type: long
              description: >
                The number of packets sent.
        
            - name: in.packets
              type: long
              description: >
                The number or packets received.
        
            - name: in.errors
              type: long
              description: >
                The number of errors while receiving.
        
            - name: out.errors
              type: long
              description: >
                The number of errors while sending.
        
            - name: in.dropped
              type: long
              description: >
                The number of incoming packets that were dropped.
        
            - name: out.dropped
              type: long
              description: >
                The number of outgoing packets that were dropped. This value is always
                0 on Darwin and BSD because it is not reported by the operating system.
        - name: network_summary
          type: group
          release: beta
          description: >
            Metrics relating to global network activity
          fields:
            - name: ip.*
              type: object
              description: >
                IP counters
            - name: tcp.*
              type: object
              description: >
                TCP counters
            - name: udp.*
              type: object
              description: >
                UDP counters
            - name: udp_lite.*
              type: object
              description: >
                UDP Lite counters
            - name: icmp.*
              type: object
              description: >
                ICMP counters
        - name: process
          type: group
          description: >
            `process` contains process metadata, CPU metrics, and memory metrics.
          release: ga
          fields:
            - name: name
              type: alias
              path: process.name
              migration: true
            - name: state
              type: keyword
              description: >
                The process state. For example: "running".
            - name: pid
              type: alias
              path: process.pid
              migration: true
            - name: ppid
              type: alias
              path: process.parent.pid
              migration: true
            - name: pgid
              type: alias
              path: process.pgid
              migration: true
            - name: cmdline
              type: keyword
              description: >
                The full command-line used to start the process, including the
                arguments separated by space.
              ignore_above: 2048
            - name: username
              type: alias
              path: user.name
              migration: true
            - name: cwd
              type: alias
              path: process.working_directory
              migration: true
            - name: env
              type: object
              object_type: keyword
              description: >
                The environment variables used to start the process. The data is
                available on FreeBSD, Linux, and OS X.
            - name: cpu
              type: group
              prefix: "[float]"
              description: CPU-specific statistics per process.
              fields:
                - name: user.ticks
                  type: long
                  description: >
                    The amount of CPU time the process spent in user space.
                - name: total.value
                  type: long
                  description: >
                    The value of CPU usage since starting the process.
                - name: total.pct
                  type: scaled_float
                  format: percent
                  description: >
                    The percentage of CPU time spent by the process since the last update. Its value is similar to the
                    %CPU value of the process displayed by the top command on Unix systems.
                - name: total.norm.pct
                  type: scaled_float
                  format: percent
                  description: >
                    The percentage of CPU time spent by the process since the last event.
                    This value is normalized by the number of CPU cores and it ranges
                    from 0 to 100%.
                - name: system.ticks
                  type: long
                  description: >
                    The amount of CPU time the process spent in kernel space.
                - name: total.ticks
                  type: long
                  description: >
                    The total CPU time spent by the process.
                - name: start_time
                  type: date
                  description: >
                    The time when the process was started.
            - name: memory
              type: group
              description: Memory-specific statistics per process.
              prefix: "[float]"
              fields:
                - name: size
                  type: long
                  format: bytes
                  description: >
                    The total virtual memory the process has. On Windows this represents the Commit Charge (the total amount of memory that the memory manager has committed for a running process) value in bytes for this process.
                - name: rss.bytes
                  type: long
                  format: bytes
                  description: >
                    The Resident Set Size. The amount of memory the process occupied in main memory (RAM). On Windows this represents the current working set size, in bytes.
                - name: rss.pct
                  type: scaled_float
                  format: percent
                  description: >
                    The percentage of memory the process occupied in main memory (RAM).
                - name: share
                  type: long
                  format: bytes
                  description: >
                    The shared memory the process uses.
            - name: fd
              type: group
              description: >
                File descriptor usage metrics. This set of metrics is available for
                Linux and FreeBSD.
              prefix: "[float]"
              fields:
                - name: open
                  type: long
                  description: The number of file descriptors open by the process.
                - name: limit.soft
                  type: long
                  description: >
                    The soft limit on the number of file descriptors opened by the
                    process. The soft limit can be changed by the process at any time.
                - name: limit.hard
                  type: long
                  description: >
                    The hard limit on the number of file descriptors opened by the
                    process. The hard limit can only be raised by root.
            - name: cgroup
              type: group
              description: >
                Metrics and limits from the cgroup of which the task is a member.
                cgroup metrics are reported when the process has membership in a
                non-root cgroup. These metrics are only available on Linux.
              fields:
                - name: id
                  type: keyword
                  description: >
                    The ID common to all cgroups associated with this task.
                    If there isn't a common ID used by all cgroups this field will be
                    absent.
        
                - name: path
                  type: keyword
                  description: >
                    The path to the cgroup relative to the cgroup subsystem's mountpoint.
                    If there isn't a common path used by all cgroups this field will be
                    absent.
        
                - name: cgroups_version
                  type: long
                  description: The version of cgroups reported for the process
        
                - name: cpu
                  type: group
                  description: >
                    The cpu subsystem schedules CPU access for tasks in the cgroup.
                    Access can be controlled by two separate schedulers, CFS and RT.
                    CFS stands for completely fair scheduler which proportionally
                    divides the CPU time between cgroups based on weight. RT stands for
                    real time scheduler which sets a maximum amount of CPU time that
                    processes in the cgroup can consume during a given period.
                    In CPU under cgroups V2, the cgroup is merged with many of the metrics
                    from cpuacct. In addition, per-scheduler metrics are gone in V2.
        
                  fields:
                    - name: id
                      type: keyword
                      description: ID of the cgroup.
        
                    - name: path
                      type: keyword
                      description: >
                        Path to the cgroup relative to the cgroup subsystem's
                        mountpoint.
        
                    - name: stats
                      type: group
                      description: cgroupv2 stats
                      fields:
                        - name: usage.ns
                          type: long
                          description: cgroups v2 usage in nanoseconds
                        - name: usage.pct
                          type: float
                          description: cgroups v2 usage
                        - name: usage.norm.pct
                          type: float
                          description: cgroups v2 normalized usage
        
                        - name: user.ns
                          type: long
                          description: cgroups v2 cpu user time in nanoseconds
                        - name: user.pct
                          type: float
                          description: cgroups v2 cpu user time
                        - name: user.norm.pct
                          type: float
                          description: cgroups v2 normalized cpu user time
        
                        - name: system.ns
                          type: long
                          description: cgroups v2 system time in nanoseconds
                        - name: system.pct
                          type: float
                          description: cgroups v2 system time
                        - name: system.norm.pct
                          type: float
                          description: cgroups v2 normalized system time
        
                    - name: cfs.period.us
                      type: long
                      description: >
                        Period of time in microseconds for how regularly a
                        cgroup's access to CPU resources should be reallocated.
        
                    - name: cfs.quota.us
                      type: long
                      description: >
                        Total amount of time in microseconds for which all
                        tasks in a cgroup can run during one period (as defined by
                        cfs.period.us).
        
                    - name: cfs.shares
                      type: long
                      description: >
                        An integer value that specifies a relative share of CPU time
                        available to the tasks in a cgroup. The value specified in the
                        cpu.shares file must be 2 or higher.
        
                    - name: rt.period.us
                      type: long
                      description: >
                        Period of time in microseconds for how regularly a cgroup's
                        access to CPU resources is reallocated.
        
                    - name: rt.runtime.us
                      type: long
                      description: >
                        Period of time in microseconds for the longest continuous period
                        in which the tasks in a cgroup have access to CPU resources.
        
                    - name: stats.periods
                      type: long
                      description: >
                        Number of period intervals (as specified in cpu.cfs.period.us)
                        that have elapsed.
        
                    - name: stats.throttled.periods
                      type: long
                      description: >
                        Number of times tasks in a cgroup have been throttled (that is,
                        not allowed to run because they have exhausted all of the
                        available time as specified by their quota).
        
                    - name: stats.throttled.us
                      type: long
                      description: >
                        The total time duration (in microseconds) for which tasks in a
                        cgroup have been throttled, as reported by cgroupsv2
                    - name: stats.throttled.ns
                      type: long
                      description: >
                        The total time duration (in nanoseconds) for which tasks in a
                        cgroup have been throttled.
                    - name: pressure
                      type: group
                      description: Pressure (resource contention) stats.
                      fields:
                        - name: some
                          type: group
                          description: Share of time in which at least some tasks are stalled on a given resource
                          fields:
                            - name: 10.pct
                              type: float
                              format: percent
                              description: Pressure over 10 seconds
                            - name: 60.pct
                              type: float
                              format: percent
                              description: Pressure over 60 seconds
                            - name: 300.pct
                              type: float
                              format: percent
                              description: Pressure over 300 seconds
                            - name: total
                              type: long
                              format: percent
                              description: total Some pressure time
                        - name: full
                          type: group
                          description: Share of time in which all non-idle tasks are stalled on a given resource simultaneously
                          fields:
                            - name: 10.pct
                              type: float
                              format: percent
                              description: Pressure over 10 seconds
                            - name: 60.pct
                              type: float
                              format: percent
                              description: Pressure over 60 seconds
                            - name: 300.pct
                              type: float
                              format: percent
                              description: Pressure over 300 seconds
                            - name: total
                              type: long
                              description: total Full pressure time
        
                - name: cpuacct
                  type: group
                  description: CPU accounting metrics.
                  fields:
                    - name: id
                      type: keyword
                      description: ID of the cgroup.
        
                    - name: path
                      type: keyword
                      description: >
                        Path to the cgroup relative to the cgroup subsystem's
                        mountpoint.
        
                    - name: total.ns
                      type: long
                      description: >
                        Total CPU time in nanoseconds consumed by all tasks in the
                        cgroup.
        
                    - name: total.pct
                      type: scaled_float
                      description: >
                        CPU time of the cgroup as a percentage of overall CPU time.
        
                    - name: total.norm.pct
                      type: scaled_float
                      description: >
                        CPU time of the cgroup as a percentage of overall CPU time, normalized by CPU count. This is functionally an average of time spent across individual CPUs.
        
                    - name: stats.user.ns
                      type: long
                      description: CPU time consumed by tasks in user mode.
        
                    - name: stats.user.pct
                      type: scaled_float
                      description: time the cgroup spent in user space, as a percentage of total CPU time
                    
                    - name: stats.user.norm.pct
                      type: scaled_float
                      description: time the cgroup spent in user space, as a percentage of total CPU time, normalized by CPU count.
        
                    - name: stats.system.ns
                      type: long
                      description: CPU time consumed by tasks in user (kernel) mode.
        
                    - name: stats.system.pct
                      type: scaled_float
                      description: Time the cgroup spent in kernel space, as a percentage of total CPU time
        
                    - name: stats.system.norm.pct
                      type: scaled_float
                      description: Time the cgroup spent in kernel space, as a percentage of total CPU time, normalized by CPU count.
        
                    - name: percpu
                      type: object
                      object_type: long
                      description: >
                        CPU time (in nanoseconds) consumed on each CPU by all tasks in
                        this cgroup.
        
                - name: memory
                  type: group
                  description: Memory limits and metrics.
                  fields:
                    - name: id
                      type: keyword
                      description: ID of the cgroup.
        
                    - name: path
                      type: keyword
                      description: >
                        Path to the cgroup relative to the cgroup subsystem's mountpoint.
        
                    - name: mem.usage.bytes
                      type: long
                      format: bytes
                      description: >
                        Total memory usage by processes in the cgroup (in bytes).
        
                    - name: mem.usage.max.bytes
                      type: long
                      format: bytes
                      description: >
                        The maximum memory used by processes in the cgroup (in bytes).
        
                    - name: mem.limit.bytes
                      type: long
                      format: bytes
                      description: >
                        The maximum amount of user memory in bytes (including file
                        cache) that tasks in the cgroup are allowed to use.
        
                    - name: mem.failures
                      type: long
                      description: >
                        The number of times that the memory limit (mem.limit.bytes) was
                        reached.
        
                    - name: mem.low.bytes
                      type: long
                      format: bytes
                      description: memory low threshhold
                    - name: mem.high.bytes
                      type: long
                      format: bytes
                      description: memory high threshhold
                    - name: mem.max.bytes
                      type: long
                      format: bytes
                      description: memory max threshhold
                    
                    - name: mem.events
                      type: group
                      description: number of times the controller tripped a given usage level
                      fields:
                        - name: low
                          type: long
                          description: low threshold
                        - name: high
                          type: long
                          description: high threshold
                        - name: max
                          type: long
                          description: max threshold
                        - name: oom
                          type: long
                          description: oom threshold
                        - name: oom_kill
                          type: long
                          description: oom killer threshold
                        - name: fail
                          type: long
                          description: failed threshold
        
        
                    - name: memsw.usage.bytes
                      type: long
                      format: bytes
                      description: >
                        The sum of current memory usage plus swap space used by
                        processes in the cgroup (in bytes).
        
                    - name: memsw.usage.max.bytes
                      type: long
                      format: bytes
                      description: >
                        The maximum amount of memory and swap space used by processes in
                        the cgroup (in bytes).
        
                    - name: memsw.limit.bytes
                      type: long
                      format: bytes
                      description: >
                        The maximum amount for the sum of memory and swap usage
                        that tasks in the cgroup are allowed to use.
        
                    - name: memsw.low.bytes
                      type: long
                      format: bytes
                      description: memory low threshhold
                    - name: memsw.high.bytes
                      type: long
                      format: bytes
                      description: memory high threshhold
                    - name: memsw.max.bytes
                      type: long
                      format: bytes
                      description: memory max threshhold
        
                    - name: memsw.failures
                      type: long
                      description: >
                        The number of times that the memory plus swap space limit
                        (memsw.limit.bytes) was reached.
                    - name: memsw.events
                      type: group
                      description: number of times the controller tripped a given usage level
                      fields:
                        - name: low
                          type: long
                          description: low threshold
                        - name: high
                          type: long
                          description: high threshold
                        - name: max
                          type: long
                          description: max threshold
                        - name: oom
                          type: long
                          description: oom threshold
                        - name: oom_kill
                          type: long
                          description: oom killer threshold
                        - name: fail
                          type: long
                          description: failed threshold
        
                    - name: kmem.usage.bytes
                      type: long
                      format: bytes
                      description: >
                        Total kernel memory usage by processes in the cgroup (in bytes).
        
                    - name: kmem.usage.max.bytes
                      type: long
                      format: bytes
                      description: >
                        The maximum kernel memory used by processes in the cgroup (in
                        bytes).
        
                    - name: kmem.limit.bytes
                      type: long
                      format: bytes
                      description: >
                        The maximum amount of kernel memory that tasks in the cgroup are
                        allowed to use.
        
                    - name: kmem.failures
                      type: long
                      description: >
                        The number of times that the memory limit (kmem.limit.bytes) was
                        reached.
        
                    - name: kmem_tcp.usage.bytes
                      type: long
                      format: bytes
                      description: >
                        Total memory usage for TCP buffers in bytes.
        
                    - name: kmem_tcp.usage.max.bytes
                      type: long
                      format: bytes
                      description: >
                        The maximum memory used for TCP buffers by processes in the
                        cgroup (in bytes).
        
                    - name: kmem_tcp.limit.bytes
                      type: long
                      format: bytes
                      description: >
                        The maximum amount of memory for TCP buffers that tasks in the
                        cgroup are allowed to use.
        
                    - name: kmem_tcp.failures
                      type: long
                      description: >
                        The number of times that the memory limit (kmem_tcp.limit.bytes)
                        was reached.
        
                    - name: stats.*
                      type: object
                      description: detailed memory IO stats
                    - name: stats.*.bytes
                      type: object
                      description: detailed memory IO stats
        
                    - name: stats.active_anon.bytes
                      type: long
                      format: bytes
                      description: >
                        Anonymous and swap cache on active least-recently-used (LRU)
                        list, including tmpfs (shmem), in bytes.
        
                    - name: stats.active_file.bytes
                      type: long
                      format: bytes
                      description: File-backed memory on active LRU list, in bytes.
        
                    - name: stats.cache.bytes
                      type: long
                      format: bytes
                      description: Page cache, including tmpfs (shmem), in bytes.
        
                    - name: stats.hierarchical_memory_limit.bytes
                      type: long
                      format: bytes
                      description: >
                        Memory limit for the hierarchy that contains the memory cgroup,
                        in bytes.
        
                    - name: stats.hierarchical_memsw_limit.bytes
                      type: long
                      format: bytes
                      description: >
                        Memory plus swap limit for the hierarchy that contains the
                        memory cgroup, in bytes.
        
                    - name: stats.inactive_anon.bytes
                      type: long
                      format: bytes
                      description: >
                        Anonymous and swap cache on inactive LRU list, including tmpfs
                        (shmem), in bytes
        
                    - name: stats.inactive_file.bytes
                      type: long
                      format: bytes
                      description: >
                        File-backed memory on inactive LRU list, in bytes.
        
                    - name: stats.mapped_file.bytes
                      type: long
                      format: bytes
                      description: >
                        Size of memory-mapped mapped files, including tmpfs (shmem),
                        in bytes.
        
                    - name: stats.page_faults
                      type: long
                      description: >
                        Number of times that a process in the cgroup triggered a page
                        fault.
        
                    - name: stats.major_page_faults
                      type: long
                      description: >
                        Number of times that a process in the cgroup triggered a major
                        fault. "Major" faults happen when the kernel actually has to
                        read the data from disk.
        
                    - name: stats.pages_in
                      type: long
                      description: >
                        Number of pages paged into memory. This is a counter.
        
                    - name: stats.pages_out
                      type: long
                      description: >
                        Number of pages paged out of memory. This is a counter.
        
                    - name: stats.rss.bytes
                      type: long
                      format: bytes
                      description: >
                        Anonymous and swap cache (includes transparent hugepages), not
                        including tmpfs (shmem), in bytes.
        
                    - name: stats.rss_huge.bytes
                      type: long
                      format: bytes
                      description: >
                        Number of bytes of anonymous transparent hugepages.
        
                    - name: stats.swap.bytes
                      type: long
                      format: bytes
                      description: >
                        Swap usage, in bytes.
        
                    - name: stats.unevictable.bytes
                      type: long
                      format: bytes
                      description: >
                        Memory that cannot be reclaimed, in bytes.
        
                - name: blkio
                  type: group
                  description: Block IO metrics.
                  fields:
                    - name: id
                      type: keyword
                      description: ID of the cgroup.
        
                    - name: path
                      type: keyword
                      description: >
                        Path to the cgroup relative to the cgroup subsystems mountpoint.
        
                    - name: total.bytes
                      type: long
                      format: bytes
                      description: >
                        Total number of bytes transferred to and from all block devices
                        by processes in the cgroup.
        
                    - name: total.ios
                      type: long
                      description: >
                        Total number of I/O operations performed on all devices
                        by processes in the cgroup as seen by the throttling policy.
                - name: io
                  type: group
                  description: cgroup V2 IO Metrics, replacing blkio.
                  fields:
                    - name: id
                      type: keyword
                      description: ID of the cgroup.
        
                    - name: path
                      type: keyword
                      description: >
                        Path to the cgroup relative to the cgroup subsystems mountpoint.
                    - name: stats.*
                      type: object
                      description: per-device IO usage stats
                    - name: stats.*.*
                      type: object
                    - name: stats.*.*.bytes
                      type: object
                      description: per-device IO usage stats
                    - name: stats.*.*.ios
                      type: object
                      description: per-device IO usage stats
                    - name: pressure
                      type: group
                      description: Pressure (resource contention) stats.
                      fields:
                        - name: full
                          type: group
                          description: Share of time in which at least some tasks are stalled on a given resource
                          fields:
                            - name: 10.pct
                              type: float
                              format: percent
                              description: Pressure over 10 seconds
                            - name: 60.pct
                              type: float
                              format: percent
                              description: Pressure over 60 seconds
                            - name: 300.pct
                              type: float
                              format: percent
                              description: Pressure over 300 seconds
                            - name: total
                              type: long
                              description: total Some pressure time
                        - name: some
                          type: group
                          description: Share of time in which all tasks are stalled on a given resource
                          fields:
                            - name: 10.pct
                              type: float
                              format: percent
                              description: Pressure over 10 seconds
                            - name: 60.pct
                              type: float
                              format: percent
                              description: Pressure over 60 seconds
                            - name: 300.pct
                              type: float
                              description: Pressure over 300 seconds
                            - name: total
                              type: long
                              description: total Some pressure time
        - name: process.summary
          title: Process Summary
          type: group
          description: >
            Summary metrics for the processes running on the host.
          release: ga
          fields:
            - name: total
              type: long
              description: >
                Total number of processes on this host.
            - name: running
              type: long
              description: >
                Number of running processes on this host.
            - name: idle
              type: long
              description: >
                Number of idle processes on this host.
            - name: sleeping
              type: long
              description: >
                Number of sleeping processes on this host.
            - name: stopped
              type: long
              description: >
                Number of stopped processes on this host.
            - name: zombie
              type: long
              description: >
                Number of zombie processes on this host.
            - name: dead
              type: long
              description: >
                Number of dead processes on this host. It's very unlikely that it will appear but in some special situations it may happen.
            - name: wakekill
              type: long
              description: >
                Number of wakekill-state processes on this host. Only found on older Linux Kernel versions.
            - name: wake
              type: long
              description: >
                Number of wake-state processes on this host. Only found on older Linux Kernel versions.
            - name: parked
              type: long
              description: >
                Number of parked-state processes on this host. Only found on older Linux Kernel versions, or under certain conditions.
            - name: unknown
              type: long
              description: >
                Number of processes for which the state couldn't be retrieved or is unknown.
            - name: threads
              title: Process Threads
              type: group
              description: Counts of individual threads on a system.
              fields:
                - name: running
                  type: long
                  description: Count of currently running threads.
                - name: blocked
                  type: long
                  description: Count of threads blocked by I/O.
        - name: raid
          type: group
          description: >
            raid
          release: ga
          fields:
            - name: name
              type: keyword
              description: >
                Name of the device.
            - name: status
              type: keyword
              description: >
                activity-state of the device.
            - name: level
              type: keyword
              description: >
                The raid level of the device
            - name: sync_action
              type: keyword
              description: >
                Current sync action, if the RAID array is redundant 
            - name: disks.active
              type: long
              description: >
                 Number of active disks.
            - name: disks.total
              type: long
              description: >
                Total number of disks the device consists of.
            - name: disks.spare
              type: long
              description: >
                 Number of spared disks.
            - name: disks.failed
              type: long
              description: >
                 Number of failed disks.
            - name: disks.states.*
              type: object
              object_type: keyword
              description: >
                 map of raw disk states
            - name: blocks.total
              type: long
              description: >
                Number of blocks the device holds, in 1024-byte blocks.
            - name: blocks.synced
              type: long
              description: >
                Number of blocks on the device that are in sync, in 1024-byte blocks.
        - name: service
          type: group
          release: beta
          description: >
            metrics for system services
          fields:
            - name: name
              type: keyword
              description: The name of the service
            - name: load_state
              type: keyword
              description: The load state of the service
            - name: state
              type: keyword
              description: The activity state of the service
            - name: sub_state
              type: keyword
              description: The sub-state of the service
            - name: state_since
              type: date
              description: The timestamp of the last state change. If the service is active and running, this is its uptime.
            - name: exec_code
              type: keyword
              description: The SIGCHLD code from the service's main process
            - name: unit_file.state
              type: keyword
              description: The state of the unit file
            - name: unit_file.vendor_preset
              type: keyword
              description: The default state of the unit file
            - name: resources
              type: group
              description: system metrics associated with the service
              fields:
                - name: cpu.usage.ns
                  type: long
                  description: CPU usage in nanoseconds
                - name: memory.usage.bytes
                  type: long
                  description: memory usage in bytes
                - name: tasks.count
                  type: long
                  description: number of tasks associated with the service
                - name: network
                  type: group
                  description: network resource usage
                  fields:
                    - name: in.bytes
                      type: long
                      format: bytes
                      description: bytes in
                    - name: in.packets
                      type: long
                      format: bytes
                      description: packets in
                    - name: out.packets
                      type: long
                      description: packets out
                    - name: out.bytes
                      type: long
                      description: bytes out
        
        - name: socket
          type: group
          description: >
            TCP sockets that are active.
          release: ga
          fields:
            - name: direction
              type: alias
              path: network.direction
              migration: true
        
            - name: family
              type: alias
              path: network.type
              migration: true
        
            - name: local.ip
              type: ip
              example: 192.0.2.1 or 2001:0DB8:ABED:8536::1
              description: >
                Local IP address. This can be an IPv4 or IPv6 address.
        
            - name: local.port
              type: long
              example: 22
              description: >
                Local port.
        
            - name: remote.ip
              type: ip
              example: 192.0.2.1 or 2001:0DB8:ABED:8536::1
              description: >
                Remote IP address. This can be an IPv4 or IPv6 address.
        
            - name: remote.port
              type: long
              example: 22
              description: >
                Remote port.
        
            - name: remote.host
              type: keyword
              example: 76-211-117-36.nw.example.com.
              description: >
                PTR record associated with the remote IP. It is obtained via reverse
                IP lookup.
        
            - name: remote.etld_plus_one
              type: keyword
              example: example.com.
              description: >
               The effective top-level domain (eTLD) of the remote host plus one more
               label. For example, the eTLD+1 for "foo.bar.golang.org." is "golang.org.".
               The data for determining the eTLD comes from an embedded copy of the data
               from http://publicsuffix.org.
        
            - name: remote.host_error
              type: keyword
              description: >
                Error describing the cause of the reverse lookup failure.
        
            - name: process.pid
              type: alias
              path: process.pid
              migration: true
        
            - name: process.command
              type: alias
              path: process.name
              migration: true
        
            - name: process.cmdline
              type: keyword
              description: >
                Full command line
        
            - name: process.exe
              type: alias
              path: process.executable
              migration: true
        
            - name: user.id
              type: alias
              path: user.id
              migration: true
        
            - name: user.name
              type: alias
              path: user.full_name
              migration: true
        - name: socket.summary
          title: Socket summary
          type: group
          description: >
            Summary metrics of open sockets in the host system
          release: ga
          fields:
            - name: all
              type: group
              description: >
                All connections
              fields:
                - name: count
                  type: integer
                  description: >
                    All open connections
                - name: listening
                  type: integer
                  description: >
                    All listening ports
            - name: tcp
              type: group
              description: >
                All TCP connections
              fields:
                - name: memory
                  type: integer
                  format: bytes
                  description: >
                    Memory used by TCP sockets in bytes, based on number of allocated pages and system page size. Corresponds to limits set in /proc/sys/net/ipv4/tcp_mem. Only available on Linux. 
                - name: all
                  type: group
                  description: >
                    All TCP connections
                  fields:
                    - name: orphan
                      type: integer
                      description: >
                        A count of all orphaned tcp sockets. Only available on Linux.
                    - name: count
                      type: integer
                      description: >
                        All open TCP connections
                    - name: listening
                      type: integer
                      description: >
                        All TCP listening ports
                    - name: established
                      type: integer
                      description: >
                        Number of established TCP connections
                    - name: close_wait
                      type: integer
                      description: >
                        Number of TCP connections in _close_wait_ state
                    - name: time_wait
                      type: integer
                      description: >
                        Number of TCP connections in _time_wait_ state
                    - name: syn_sent
                      type: integer
                      description: >
                        Number of TCP connections in _syn_sent_ state
                    - name: syn_recv
                      type: integer
                      description: >
                        Number of TCP connections in _syn_recv_ state
                    - name: fin_wait1
                      type: integer
                      description: >
                        Number of TCP connections in _fin_wait1_ state
                    - name: fin_wait2
                      type: integer
                      description: >
                        Number of TCP connections in _fin_wait2_ state
                    - name: last_ack
                      type: integer
                      description: >
                        Number of TCP connections in _last_ack_ state
                    - name: closing
                      type: integer
                      description: >
                        Number of TCP connections in _closing_ state
            - name: udp
              type: group
              description: >
                All UDP connections
              fields:
                - name: memory
                  type: integer
                  format: bytes
                  description: >
                    Memory used by UDP sockets in bytes, based on number of allocated pages and system page size. Corresponds to limits set in /proc/sys/net/ipv4/udp_mem. Only available on Linux. 
                - name: all
                  type: group
                  description: >
                    All UDP connections
                  fields:
                    - name: count
                      type: integer
                      description: >
                        All open UDP connections
        
        
        
        - name: uptime
          type: group
          description: >
            `uptime` contains the operating system uptime metric.
          release: ga
          fields:
            - name: duration.ms
              type: long
              format: duration
              input_format: milliseconds
              description: >
                The OS uptime in milliseconds.
        - name: users
          type: group
          release: beta
          description: >
            Logged-in user session data
          fields:
            - name: id
              type: keyword
              description: >
                The ID of the session
            - name: seat
              type: keyword
              description: >
                An associated logind seat
            - name: path
              type: keyword
              description: >
                The DBus object path of the session
            - name: type
              type: keyword
              description: >
                The type of the user session
            - name: service
              type: keyword
              description: >
                A session associated with the service
            - name: remote
              type: boolean
              description: >
                A bool indicating a remote session
            - name: state
              type: keyword
              description: >
                The current state of the session
            - name: scope
              type: keyword
              description: >
                The associated systemd scope
            - name: leader
              type: long
              description: >
                The root PID of the session
            - name: remote_host
              type: keyword
              description: >
                  A remote host address for the session
        
        
- key: traefik
  title: "Traefik"
  description: >
    Traefik reverse proxy / load balancer metrics
  release: ga
  settings: ["ssl", "http"]
  fields:
    - name: traefik
      type: group
      description: >
        Traefik reverse proxy / load balancer metrics
      fields:
        - name: health
          type: group
          description: >
            Metrics obtained from Traefik's health API endpoint
          release: ga
          fields:
            - name: uptime.sec
              type: long
              description: >
                Uptime of Traefik instance in seconds
            - name: response
              type: group
              description: >
                Response metrics
              fields:
                - name: count
                  type: long
                  description: >
                    Number of responses
                - name: avg_time.us
                  type: long
                  description: >
                    Average response time in microseconds
                - name: status_codes.*
                  type: object
                  object_type: long
                  description: >
                    Number of responses per status code
- key: uwsgi
  title: "uWSGI"
  description: >
    uwsgi module
  release: ga
  fields:
    - name: uwsgi
      type: group
      description: >
      fields:
        - name: status
          type: group
          release: ga
          description: >
            uwsgi.status metricset fields
          fields:
            - name: total.requests
              type: long
              description: >
                Total requests handled
            - name: total.exceptions
              type: long
              description: >
                Total exceptions
            - name: total.write_errors
              type: long
              description: >
                Total requests write errors
            - name: total.read_errors
              type: long
              description: >
                Total read errors
            - name: total.pid
              type: long
              description: >
                Process id
            - name: worker.id
              type: long
              description: >
                Worker id
            - name: worker.pid
              type: long
              description: >
                Worker process id
            - name: worker.accepting
              type: long
              description: >
                State of worker, 1 if still accepting new requests otherwise 0
            - name: worker.requests
              type: long
              description: >
                Number of requests served by this worker
            - name: worker.delta_requests
              type: long
              description: >
                Number of requests served by this worker after worker is reloaded when reached MAX_REQUESTS
            - name: worker.exceptions
              type: long
              description: >
                Exceptions raised
            - name: worker.harakiri_count
              type: long
              description: >
                Dropped requests by timeout
            - name: worker.signals
              type: long
              description: >
                Emitted signals count
            - name: worker.signal_queue
              type: long
              description: >
                Number of signals waiting to be handled
            - name: worker.status
              type: keyword
              description: >
                Worker status (cheap, pause, sig, busy, idle)
            - name: worker.rss
              type: long
              description: >
                Resident Set Size. memory currently used by a process. if always zero try `--memory-report` option of uwsgi
            - name: worker.vsz
              type: long
              description: >
                Virtual Set Size. memory size assigned to a process. if always zero try `--memory-report` option of uwsgi
            - name: worker.running_time
              type: long
              description: >
                Process running time
            - name: worker.respawn_count
              type: long
              description: >
                Respawn count
            - name: worker.tx
              type: long
              description: >
                Transmitted size
            - name: worker.avg_rt
              type: long
              description: >
                Average response time
            - name: core.id
              type: long
              description: >
                worker ID
            - name: core.worker_pid
              type: long
              description: >
                Parent worker PID
            - name: core.requests.total
              type: long
              description: >
                Number of total requests served
            - name: core.requests.static
              type: long
              description: >
                Number of static file serves
            - name: core.requests.routed
              type: long
              description: >
                Routed requests
            - name: core.requests.offloaded
              type: long
              description: >
                Offloaded requests
            - name: core.write_errors
              type: long
              description: >
                Number of failed writes
            - name: core.read_errors
              type: long
              description: >
                Number of failed reads
- key: vsphere
  title: "vSphere"
  description: >
    vSphere module
  release: ga
  fields:
    - name: vsphere
      type: group
      description: >
      fields:
        - name: datastore
          type: group
          description: >
            datastore
          release: ga
          fields:
            - name: name
              type: keyword
              description: >
                Datastore name
            - name: fstype
              type: keyword
              description: >
                Filesystem type
            - name: capacity.total.bytes
              type: long
              description: >
                Total bytes of the datastore
              format: bytes
            - name: capacity.free.bytes
              type: long
              description: >
                Free bytes of the datastore
              format: bytes
            - name: capacity.used.bytes
              type: long
              description: >
                Used bytes of the datastore
              format: bytes
            - name: capacity.used.pct
              type: scaled_float
              description: >
                Used percent of the datastore
              format: percent
        
        - name: host
          type: group
          description: >
            host
          release: ga
          fields:
            - name: name
              type: keyword
              description: >
                Host name
            - name: cpu.used.mhz
              type: long
              description: >
                Used CPU in Mhz
            - name: cpu.total.mhz
              type: long
              description: >
                Total CPU in Mhz
            - name: cpu.free.mhz
              type: long
              description: >
                Free CPU in Mhz
            - name: memory.used.bytes
              type: long
              description: >
                Used Memory in bytes
              format: bytes
            - name: memory.total.bytes
              type: long
              description: >
                Total Memory in bytes
              format: bytes
            - name: memory.free.bytes
              type: long
              description: >
                Free Memory in bytes
              format: bytes
            - name: network_names
              type: keyword
              description: >
                Network names
        - name: virtualmachine
          type: group
          description: >
            virtualmachine
          release: ga
          fields:
            - name: host.id
              type: keyword
              description: >
                Host id
            - name: host.hostname
              type: keyword
              description: >
                Host name of the host
            - name: name
              type: keyword
              description: >
                Virtual Machine name
            - name: os
              type: keyword
              description: >
                Virtual Machine Operating System name
            - name: cpu.used.mhz
              type: long
              description: >
                Used CPU in Mhz
            - name: cpu.total.mhz
              type: long
              description: >
                Total CPU in Mhz
            - name: cpu.free.mhz
              type: long
              description: >
                Available CPU in Mhz
            - name: memory.used.guest.bytes
              type: long
              description: >
                Used Memory of Guest in bytes
              format: bytes
            - name: memory.used.host.bytes
              type: long
              description: >
                Used Memory of Host in bytes
              format: bytes
            - name: memory.total.guest.bytes
              type: long
              description: >
                Total Memory of Guest in bytes
              format: bytes
            - name: memory.free.guest.bytes
              type: long
              description: >
                Free Memory of Guest in bytes
              format: bytes
            - name: custom_fields
              type: object
              object_type: keyword
              description: >
                Custom fields
            - name: network_names
              type: keyword
              description: >
                Network names
- key: windows
  title: "Windows"
  description: >
    Module for Windows
  short_config: false
  release: ga
  fields:
    - name: windows
      type: group
      description: >
      fields:
        - name: perfmon
          type: group
          release: ga
          description: >
            perfmon
          fields:
          - name: instance
            type: keyword
            description: |
              Instance value.
          - name: metrics.*.*
            type: object
            object_type: float
            object_type_mapping_type: "*"
            description: >
              Metric values returned.
        
        - name: service
          type: group
          description: >
            `service` contains the status for Windows services.
          release: ga
          fields:
            - name: id
              type: keyword
              example: hW3NJFc1Ap
              description: >
                A unique ID for the service. It is a hash of the machine's GUID and the
                service name.
        
            - name: name
              type: keyword
              example: Wecsvc
              description: >
                The service name.
        
            - name: display_name
              type: keyword
              example: Windows Event Collector
              description: >
                The display name of the service.
        
            - name: start_type
              type: keyword
              description: >
                The startup type of the service. The possible values are `Automatic`,
                `Boot`, `Disabled`, `Manual`, and `System`.
        
            - name: start_name
              type: keyword
              example: NT AUTHORITY\LocalService
              description: >
                Account name under which a service runs.
        
            - name: path_name
              type: keyword
              example: C:\WINDOWS\system32\svchost.exe -k LocalService -p
              description: >
                Fully qualified path to the file that implements the service,
                including arguments.
        
            - name: state
              type: keyword
              description: >
                The actual state of the service. The possible values are `Continuing`,
                `Pausing`, `Paused`, `Running`, `Starting`, `Stopping`, and `Stopped`.
        
            - name: exit_code
              type: keyword
              description: >
                For `Stopped` services this is the error code that service reports
                when starting to stopping. This will be the generic Windows service
                error code unless the service provides a service-specific error code.
        
            - name: pid
              type: long
              example: 1092
              description: >
                For `Running` services this is the associated process PID.
        
            - name: uptime.ms
              type: long
              format: duration
              input_format: milliseconds
              description: >
                The service's uptime specified in milliseconds.
- key: zookeeper
  title: "ZooKeeper"
  description: >
    ZooKeeper metrics collected by the four-letter monitoring commands.
  short_config: false
  release: ga
  fields:
    - name: zookeeper
      type: group
      description: >
        `zookeeper` contains the metrics reported by ZooKeeper
        commands.
      fields:
        - name: connection
          type: group
          release: ga
          description: >
            connections
          fields:
            - name: interest_ops
              type: long
              description: >
                Interest ops
            - name: queued
              type: long
              description: >
                Queued connections
            - name: received
              type: long
              description: >
                Received connections
            - name: sent
              type: long
              description: >
                Connections sent
        - name: mntr
          type: group
          description: >
            `mntr` contains the metrics reported by the four-letter `mntr`
            command.
          release: ga
          fields:
            - name: hostname
              type: keyword
              description: >
                ZooKeeper hostname.
            - name: approximate_data_size
              type: long
              description: >
                Approximate size of ZooKeeper data.
            - name: latency.avg
              type: long
              description: >
                Average latency between ensemble hosts in milliseconds.
            - name: ephemerals_count
              type: long
              description: >
                Number of ephemeral znodes.
            - name: followers
              type: long
              description: >
                Number of followers seen by the current host (Up to ZooKeeper 3.5.9).
            - name: max_file_descriptor_count
              type: long
              description: >
                Maximum number of file descriptors allowed for the ZooKeeper process.
            - name: latency.max
              type: long
              description: >
                Maximum latency in milliseconds.
            - name: latency.min
              type: long
              description: >
                Minimum latency in milliseconds.
            - name: num_alive_connections
              type: long
              description: >
                Number of connections to ZooKeeper that are currently alive.
            - name: open_file_descriptor_count
              type: long
              description: >
                Number of file descriptors open by the ZooKeeper process.
            - name: outstanding_requests
              type: long
              description: >
                Number of outstanding requests that need to be processed by the cluster.
            - name: packets.received
              type: long
              description: >
                Number of ZooKeeper network packets received.
            - name: packets.sent
              type: long
              description: >
                Number of ZooKeeper network packets sent.
            - name: pending_syncs
              type: long
              description: >
                Number of pending syncs to carry out to ZooKeeper ensemble followers.
            - name: server_state
              type: keyword
              description: >
                Role in the ZooKeeper ensemble.
            - name: synced_followers
              type: long
              description: >
                Number of synced followers reported when a node server_state is leader.
            - name: version
              type: alias
              path: service.version
              description: >
                ZooKeeper version and build string reported.
            - name: watch_count
              type: long
              description: >
                Number of watches currently set on the local ZooKeeper process.
            - name: znode_count
              type: long
              description: >
                Number of znodes reported by the local ZooKeeper process.
            - name: learners
              type: long
              description: >
                Number of learners (either followers or observers) seen by the current host (From ZooKeeper 3.6.0)
        - name: server
          type: group
          description: 'server contains the metrics reported by the four-letter `srvr` command.'
          release: ga
          fields:
            - name: connections
              type: long
              description: Number of clients currently connected to the server
            - name: latency
              type: group
              fields:
                - name: avg
                  type: long
                  description: Average amount of time taken for the server to respond to a client request
                - name: max
                  type: long
                  description: Maximum amount of time taken for the server to respond to a client request
                - name: min
                  type: long
                  description: Minimum amount of time taken for the server to respond to a client request
            - name: mode
              type: keyword
              description: Mode of the server. In an ensemble, this may either be leader or follower. Otherwise, it is standalone
            - name: node_count
              type: long
              description: Total number of nodes
            - name: outstanding
              type: long
              description: Number of requests queued at the server. This exceeds zero when the server receives more requests than it is able to process
            - name: received
              type: long
              description: Number of requests received by the server
            - name: sent
              type: long
              description: Number of requests sent by the server
            - name: version_date
              type: date
              description: Date of the Zookeeper release currently in use
            - name: zxid
              type: keyword
              description: Unique value of the Zookeeper transaction ID. The zxid consists of an epoch and a counter. It is established by the leader and is used to determine the temporal ordering of changes
            - name: count
              type: long
              description: Total transactions of the leader in epoch
            - name: epoch
              type: long
              description: Epoch value of the Zookeeper transaction ID. An epoch signifies the period in which a server is a leader
- key: activemq
  title: "ActiveMQ"
  release: ga
  description: >
    activemq module
  fields:
    - name: activemq
      type: group
      description: >
      fields:
        - name: broker
          type: group
          description: Broker metrics from org.apache.activemq:brokerName=*,type=Broker
          release: ga
          fields:
          - name: mbean
            description: Mbean that this event is related to
            type: keyword
          - name: name
            description: Broker name
            type: keyword
          - name: memory.broker.pct
            description: The percentage of the memory limit used.
            type: scaled_float
            format: percent
          - name: memory.store.pct
            description: Percent of store limit used.
            type: scaled_float
            format: percent
          - name: memory.temp.pct
            description: The percentage of the temp usage limit used.
            type: scaled_float
            format: percent
          - name: connections.count
            description: Total number of connections.
            type: long
          - name: consumers.count
            description: Number of message consumers.
            type: long
          - name: messages.dequeue.count
            description: Number of messages that have been acknowledged on the broker.
            type: long
          - name: messages.enqueue.count
            description: Number of messages that have been sent to the destination.
            type: long
          - name: messages.count
            description: Number of unacknowledged messages on the broker.
            type: long
          - name: producers.count
            description: Number of message producers active on destinations on the broker.
            type: long
        - name: queue
          type: group
          description: Queue metrics from org.apache.activemq:brokerName=*,destinationName=*,destinationType=Queue,type=Broker
          release: ga
          fields:
          - name: mbean
            description: Mbean that this event is related to
            type: keyword
          - name: name
            description: Queue name
            type: keyword
          - name: size
            description: Queue size
            type: long
          - name: messages.enqueue.time.avg
            description: Average time a message was held on this destination.
            type: double
          - name: messages.size.avg
            description: Average message size on this destination.
            type: long
          - name: consumers.count
            description: Number of consumers subscribed to this destination.
            type: long
          - name: messages.dequeue.count
            description: Number of messages that has been acknowledged (and removed) from the destination.
            type: long
          - name: messages.dispatch.count
            description: Number of messages that has been delivered to consumers, including those not acknowledged.
            type: long
          - name: messages.enqueue.count
            description: Number of messages that have been sent to the destination.
            type: long
          - name: messages.expired.count
            description: Number of messages that have been expired.
            type: long
          - name: messages.inflight.count
            description: Number of messages that have been dispatched to, but not acknowledged by, consumers.
            type: long
          - name: messages.enqueue.time.max
            description: The longest time a message was held on this destination.
            type: long
          - name: memory.broker.pct
            description: Percent of memory limit used.
            type: scaled_float
            format: percent
          - name: messages.enqueue.time.min
            description: The shortest time a message was held on this destination.
            type: long
          - name: producers.count
            description: Number of producers attached to this destination.
            type: long
        - name: topic
          type: group
          description: Topic metrics from org.apache.activemq:brokerName=*,destinationName=*,destinationType=Topic,type=Broker
          release: ga
          fields:
          - name: mbean
            description: Mbean that this event is related to
            type: keyword
          - name: name
            description: Topic name
            type: keyword
          - name: messages.enqueue.time.avg
            description: Average time a message was held on this destination.
            type: double
          - name: messages.size.avg
            description: Average message size on this destination.
            type: long
          - name: consumers.count
            description: Number of consumers subscribed to this destination.
            type: long
          - name: messages.dequeue.count
            description: Number of messages that has been acknowledged (and removed) from the destination.
            type: long
          - name: messages.dispatch.count
            description: Number of messages that has been delivered to consumers, including those not acknowledged.
            type: long
          - name: messages.enqueue.count
            description: Number of messages that have been sent to the destination.
            type: long
          - name: messages.expired.count
            description: Number of messages that have been expired.
            type: long
          - name: messages.inflight.count
            description: Number of messages that have been dispatched to, but not acknowledged by, consumers.
            type: long
          - name: messages.enqueue.time.max
            description: The longest time a message was held on this destination.
            type: long
          - name: memory.broker.pct
            description: Percent of memory limit used.
            type: scaled_float
            format: percent
          - name: messages.enqueue.time.min
            description: The shortest time a message was held on this destination.
            type: long
          - name: producers.count
            description: Number of producers attached to this destination.
            type: long
- key: airflow
  title: "Airflow"
  description: >
    Airflow module
  release: beta
  fields:
    - name: airflow
      type: group
      fields:
        - name: '*.1m_rate'
          type: object
          object_type: double
          object_type_mapping_type: "*"
          description: >
            Airflow 1m rate timers metric
        - name: '*.5m_rate'
          type: object
          object_type: double
          object_type_mapping_type: "*"
          description: >
            Airflow 5m rate timers metric
        - name: '*.15m_rate'
          type: object
          object_type: double
          object_type_mapping_type: "*"
          description: >
            Airflow 15 rate timers metric
        - name: '*.count'
          type: object
          object_type: double
          object_type_mapping_type: "*"
          description: >
            Airflow counters
        - name: '*.max'
          type: object
          object_type: double
          object_type_mapping_type: "*"
          description: >
            Airflow max timers metric
        - name: '*.mean_rate'
          type: object
          object_type: double
          object_type_mapping_type: "*"
          description: >
            Airflow mean rate timers metric
        - name: '*.mean'
          type: object
          object_type: double
          object_type_mapping_type: "*"
          description: >
            Airflow mean timers metric
        - name: '*.median'
          type: object
          object_type: double
          object_type_mapping_type: "*"
          description: >
            Airflow median timers metric
        - name: '*.min'
          type: object
          object_type: double
          object_type_mapping_type: "*"
          description: >
            Airflow min timers metric
        - name: '*.p75'
          type: object
          object_type: double
          object_type_mapping_type: "*"
          description: >
            Airflow 75 percentile timers metric
        - name: '*.p95'
          type: object
          object_type: double
          object_type_mapping_type: "*"
          description: >
            Airflow 95 percentile timers metric
        - name: '*.p99_9'
          type: object
          object_type: double
          object_type_mapping_type: "*"
          description: >
            Airflow 99.9 percentile timers metric
        - name: '*.p99'
          type: object
          object_type: double
          object_type_mapping_type: "*"
          description: >
            Airflow 99 percentile timers metric
        - name: '*.stddev'
          type: object
          object_type: double
          object_type_mapping_type: "*"
          description: >
            Airflow standard deviation timers metric
        - name: '*.value'
          type: object
          object_type: double
          object_type_mapping_type: "*"
          description: >
            Airflow gauges
        - name: 'dag_file'
          type: keyword
          description: >
            Airflow dag file metadata
        - name: 'dag_id'
          type: keyword
          description: >
            Airflow dag id metadata
        - name: 'job_name'
          type: keyword
          description: >
            Airflow job name metadata
        - name: 'operator_name'
          type: keyword
          description: >
            Airflow operator name metadata
        - name: 'pool_name'
          type: keyword
          description: >
            Airflow pool name metadata
        - name: 'status'
          type: keyword
          description: >
            Airflow status metadata
        - name: 'task_id'
          type: keyword
          description: >
            Airflow task id metadata
        - release: beta
- key: aws
  title: "AWS"
  description: >
    `aws` module collects AWS monitoring metrics from AWS Cloudwatch.
  release: ga
  fields:
    - name: aws
      type: group
      description: >
      fields:
        - name: tags.*
          type: object
          object_type: keyword
          object_type_mapping_type: "*"
          description: >
            Tag key value pairs from aws resources.
        - name: s3.bucket.name
          type: keyword
          description: >
            Name of a S3 bucket.
        - name: dimensions.*
          type: object
          object_type: keyword
          object_type_mapping_type: "*"
          description: >
            Metric dimensions.
        - name: '*.metrics.*.*'
          type: object
          object_type: double
          object_type_mapping_type: "*"
          description: >
            Metrics that returned from Cloudwatch API query.
        - name: linked_account
          type: group
          fields:
            - name: id
              type: keyword
              description: >
                ID used to identify linked account.
            - name: name
              type: keyword
              description: >
                Name or alias used to identify linked account.
        - name: billing
          type: group
          description: >
            `billing` contains the estimated charges for your AWS account in Cloudwatch.
          release: beta
          fields:
            - name: EstimatedCharges
              type: long
              description: Maximum estimated charges for AWS acccount.
            - name: Currency
              type: keyword
              description: Estimated charges currency unit.
            - name: ServiceName
              type: keyword
              description: Service name for the maximum estimated charges.
            - name: AmortizedCost
              type: group
              fields:
                - name: amount
                  type: double
                  description: Amortized cost amount
                - name: unit
                  type: keyword
                  description: Amortized cost unit
            - name: BlendedCost
              type: group
              fields:
                - name: amount
                  type: double
                  description: Blended cost amount
                - name: unit
                  type: keyword
                  description: Blended cost unit
            - name: NormalizedUsageAmount
              type: group
              fields:
                - name: amount
                  type: double
                  description: Normalized usage amount
                - name: unit
                  type: keyword
                  description: Normalized usage amount unit
            - name: UnblendedCost
              type: group
              fields:
                - name: amount
                  type: double
                  description: Unblended cost amount
                - name: unit
                  type: keyword
                  description: Unblended cost unit
            - name: UsageQuantity
              type: group
              fields:
                - name: amount
                  type: double
                  description: Usage quantity amount
                - name: unit
                  type: keyword
                  description: Usage quantity unit
            - name: start_date
              type: keyword
              description: Start date for retrieving AWS costs
            - name: end_date
              type: keyword
              description: End date for retrieving AWS costs
            - name: group_definition
              type: group
              fields:
                - name: key
                  type: keyword
                  description: The string that represents a key for a specified group
                - name: type
                  type: keyword
                  description: The string that represents the type of group
            - name: group_by.*
              type: object
              object_type: keyword
              object_type_mapping_type: "*"
              description: >
                Cost explorer group by key values
        - name: cloudwatch
          type: group
          description: >
            `cloudwatch` contains the metrics that were scraped from AWS CloudWatch which contains monitoring metrics sent by different namespaces.
          release: ga
          fields:
            - name: namespace
              type: keyword
              description: >
                The namespace specified when query cloudwatch api.
        - name: dynamodb
          type: group
          description: >
            `dynamodb` contains the metrics that were scraped from AWS CloudWatch which contains monitoring metrics sent by AWS DynamoDB.
          release: beta
          fields:
            - name: metrics
              type: group
              fields:
                - name: SuccessfulRequestLatency.avg
                  type: double
                  description: >
                    The average latency of successful requests to DynamoDB or Amazon DynamoDB Streams
                    during the specified time period.
                - name: SuccessfulRequestLatency.max
                  type: double
                  description: >
                    The maximum latency of successful requests to DynamoDB or Amazon DynamoDB Streams
                    during the specified time period.
                - name: OnlineIndexPercentageProgress.avg
                  type: double
                  description: >
                    The percentage of completion when a new global secondary index is being added to a table.
                - name: ProvisionedWriteCapacityUnits.avg
                  type: double
                  description: >
                    The number of provisioned write capacity units for a table or a global secondary index.
                - name: ProvisionedReadCapacityUnits.avg
                  type: double
                  description: >
                    The number of provisioned read capacity units for a table or a global secondary index.
                - name: ConsumedReadCapacityUnits.avg
                  type: double
                  description: >
                    The average number of read capacity units consumed over the specified time period,
                    so you can track how much of your provisioned throughput is used.
                - name: ConsumedReadCapacityUnits.sum
                  type: long
                  description: >
                    The sum of read capacity units consumed over the specified time period,
                    so you can track how much of your provisioned throughput is used.
                - name: ConsumedWriteCapacityUnits.avg
                  type: double
                  description: >
                    The average number of write capacity units consumed over the specified time period,
                    so you can track how much of your provisioned throughput is used.
                - name: ConsumedWriteCapacityUnits.sum
                  type: long
                  description: >
                    The sum of write capacity units consumed over the specified time period,
                    so you can track how much of your provisioned throughput is used.
                - name: ReplicationLatency.avg
                  type: double
                  description: >
                    The average elapsed time between an updated item appearing in the DynamoDB stream for
                    one replica table, and that item appearing in another replica in the global table.
                - name: ReplicationLatency.max
                  type: double
                  description: >
                    The maximum elapsed time between an updated item appearing in the DynamoDB stream for
                    one replica table, and that item appearing in another replica in the global table.
                - name: TransactionConflict.avg
                  type: double
                  description: >
                    Average rejected item-level requests due to transactional conflicts between concurrent
                    requests on the same items.
                - name: TransactionConflict.sum
                  type: long
                  description: >
                    Total rejected item-level requests due to transactional conflicts between concurrent
                    requests on the same items.
                - name: AccountProvisionedReadCapacityUtilization.avg
                  type: double
                  description: >
                    The average percentage of provisioned read capacity units utilized by the account.
                - name: AccountProvisionedWriteCapacityUtilization.avg
                  type: double
                  description: >
                    The average percentage of provisioned write capacity units utilized by the account.
                - name: SystemErrors.sum
                  type: long
                  description: >
                    The requests to DynamoDB or Amazon DynamoDB Streams that generate
                    an HTTP 500 status code during the specified time period.
                - name: ConditionalCheckFailedRequests.sum
                  type: long
                  description: >
                    The number of failed attempts to perform conditional writes.
                - name: PendingReplicationCount.sum
                  type: long
                  description: >
                    The number of item updates that are written to one replica table,
                    but that have not yet been written to another replica in the global table.
                - name: ReadThrottleEvents.sum
                  type: long
                  description: >
                    Requests to DynamoDB that exceed the provisioned read capacity
                    units for a table or a global secondary index.
                - name: ThrottledRequests.sum
                  type: long
                  description: >
                    Requests to DynamoDB that exceed the provisioned throughput limits
                    on a resource (such as a table or an index).
                - name: WriteThrottleEvents.sum
                  type: long
                  description: >
                    Requests to DynamoDB that exceed the provisioned write capacity
                    units for a table or a global secondary index.
                - name: AccountMaxReads.max
                  type: long
                  description: >
                    The maximum number of read capacity units that can be used by an account.
                    This limit does not apply to on-demand tables or global secondary indexes.
                - name: AccountMaxTableLevelReads.max
                  type: long
                  description: >
                    The maximum number of read capacity units that can be used by a table or global
                    secondary index of an account. For on-demand tables this limit caps the maximum
                    read request units a table or a global secondary index can use.
                - name: AccountMaxTableLevelWrites.max
                  type: long
                  description: >
                    The maximum number of write capacity units that can be used by a table or global
                    secondary index of an account. For on-demand tables this limit caps the maximum
                    write request units a table or a global secondary index can use.
                - name: AccountMaxWrites.max
                  type: long
                  description: >
                    The maximum number of write capacity units that can be used by an account.
                    This limit does not apply to on-demand tables or global secondary indexes.
                - name: MaxProvisionedTableReadCapacityUtilization.max
                  type: double
                  description: >
                    The percentage of provisioned read capacity units utilized by the highest
                    provisioned read table or global secondary index of an account.
                - name: MaxProvisionedTableWriteCapacityUtilization.max
                  type: double
                  description: >
                    The percentage of provisioned write capacity utilized by the highest provisioned
                    write table or global secondary index of an account.
        - name: ebs
          type: group
          description: >
            `ebs` contains the metrics that were scraped from AWS CloudWatch which contains monitoring metrics sent by AWS EBS.
          release: ga
          fields:
            - name: metrics
              type: group
              fields:
                - name: VolumeReadBytes.avg
                  type: double
                  description: Average size of each read operation during the period, except on volumes attached to a Nitro-based instance, where the average represents the average over the specified period.
                - name: VolumeWriteBytes.avg
                  type: double
                  description: Average size of each write operation during the period, except on volumes attached to a Nitro-based instance, where the average represents the average over the specified period.
                - name: VolumeReadOps.avg
                  type: double
                  description: The total number of read operations in a specified period of time.
                - name: VolumeWriteOps.avg
                  type: double
                  description: The total number of write operations in a specified period of time.
                - name: VolumeQueueLength.avg
                  type: double
                  description: The number of read and write operation requests waiting to be completed in a specified period of time.
                - name: VolumeThroughputPercentage.avg
                  type: double
                  description: The percentage of I/O operations per second (IOPS) delivered of the total IOPS provisioned for an Amazon EBS volume. Used with Provisioned IOPS SSD volumes only.
                - name: VolumeConsumedReadWriteOps.avg
                  type: double
                  description: The total amount of read and write operations (normalized to 256K capacity units) consumed in a specified period of time. Used with Provisioned IOPS SSD volumes only.
                - name: BurstBalance.avg
                  type: double
                  description: Used with General Purpose SSD (gp2), Throughput Optimized HDD (st1), and Cold HDD (sc1) volumes only. Provides information about the percentage of I/O credits (for gp2) or throughput credits (for st1 and sc1) remaining in the burst bucket.
                - name: VolumeTotalReadTime.sum
                  type: double
                  description: The total number of seconds spent by all read operations that completed in a specified period of time.
                - name: VolumeTotalWriteTime.sum
                  type: double
                  description: The total number of seconds spent by all write operations that completed in a specified period of time.
                - name: VolumeIdleTime.sum
                  type: double
                  description: The total number of seconds in a specified period of time when no read or write operations were submitted.
        - name: ec2
          type: group
          description: >
            `ec2` contains the metrics that were scraped from AWS CloudWatch which contains monitoring metrics sent by AWS EC2.
          release: ga
          fields:
            - name: cpu.total.pct
              type: scaled_float
              description: >
                The percentage of allocated EC2 compute units that are currently in use on the instance.
            - name: cpu.credit_usage
              type: long
              description: >
                The number of CPU credits spent by the instance for CPU utilization.
            - name: cpu.credit_balance
              type: long
              description: >
                The number of earned CPU credits that an instance has accrued since it was launched or started.
            - name: cpu.surplus_credit_balance
              type: long
              description: >
                The number of surplus credits that have been spent by an unlimited instance when its CPUCreditBalance value is zero.
            - name: cpu.surplus_credits_charged
              type: long
              description: >
                The number of spent surplus credits that are not paid down by earned CPU credits, and which thus incur an additional charge.
            - name: network.in.packets
              type: long
              description: >
                The total number of packets received on all network interfaces by the instance in collection period.
            - name: network.in.packets_per_sec
              type: scaled_float
              description: >
                The number of packets per second sent out on all network interfaces by the instance.
            - name: network.out.packets
              type: long
              description: >
                The total number of packets sent out on all network interfaces by the instance in collection period.
            - name: network.out.packets_per_sec
              type: scaled_float
              description: >
                The number of packets per second sent out on all network interfaces by the instance.
            - name: network.in.bytes
              type: long
              format: bytes
              description: >
                The total number of bytes received on all network interfaces by the instance in collection period.
            - name: network.in.bytes_per_sec
              type: scaled_float
              description: >
                The number of bytes per second received on all network interfaces by the instance.
            - name: network.out.bytes
              type: long
              format: bytes
              description: >
                The total number of bytes sent out on all network interfaces by the instance in collection period.
            - name: network.out.bytes_per_sec
              type: scaled_float
              description: >
                The number of bytes per second sent out on all network interfaces by the instance.
            - name: diskio.read.bytes
              type: long
              format: bytes
              description: >
                Total bytes read from all instance store volumes available to the instance in collection period.
            - name: diskio.read.bytes_per_sec
              type: scaled_float
              description: >
                Bytes read per second from all instance store volumes available to the instance.
            - name: diskio.write.bytes
              type: long
              format: bytes
              description: >
                Total bytes written to all instance store volumes available to the instance in collection period.
            - name: diskio.write.bytes_per_sec
              type: scaled_float
              description: >
                Bytes written per second to all instance store volumes available to the instance.
            - name: diskio.read.count
              type: long
              description: >
                Total completed read operations from all instance store volumes available to the instance in collection period.
            - name: diskio.read.count_per_sec
              type: long
              description: >
                Completed read operations per second from all instance store volumes available to the instance in a specified period of time.
            - name: diskio.write.count
              type: long
              description: >
                Total completed write operations to all instance store volumes available to the instance in collection period.
            - name: diskio.write.count_per_sec
              type: long
              description: >
                Completed write operations per second to all instance store volumes available to the instance in a specified period of time.
            - name: status.check_failed
              type: long
              description: >
                Reports whether the instance has passed both the instance status check and the system status check in the last minute.
            - name: status.check_failed_system
              type: long
              description: >
                Reports whether the instance has passed the system status check in the last minute.
            - name: status.check_failed_instance
              type: long
              description: >
                Reports whether the instance has passed the instance status check in the last minute.
            - name: instance.core.count
              type: integer
              description: >
                The number of CPU cores for the instance.
            - name: instance.image.id
              type: keyword
              description: >
                The ID of the image used to launch the instance.
            - name: instance.monitoring.state
              type: keyword
              description: >
                Indicates whether detailed monitoring is enabled.
            - name: instance.private.dns_name
              type: keyword
              description: >
                The private DNS name of the network interface.
            - name: instance.private.ip
              type: ip
              description: >
                The private IPv4 address associated with the network interface.
            - name: instance.public.dns_name
              type: keyword
              description: >
                The public DNS name of the instance.
            - name: instance.public.ip
              type: ip
              description: >
                The address of the Elastic IP address (IPv4) bound to the network interface.
            - name: instance.state.code
              type: integer
              description: >
                The state of the instance, as a 16-bit unsigned integer.
            - name: instance.state.name
              type: keyword
              description: >
                The state of the instance (pending | running | shutting-down | terminated | stopping | stopped).
            - name: instance.threads_per_core
              type: integer
              description: >
                The number of threads per CPU core.
        - name: elb
          type: group
          description: >
            `elb` contains the metrics that were scraped from AWS CloudWatch which contains monitoring metrics sent by AWS ELB.
          release: ga
          fields:
            - name: metrics
              type: group
              fields:
                - name: BackendConnectionErrors.sum
                  type: long
                  description: The number of connections that were not successfully established between the load balancer and the registered instances.
                - name: HTTPCode_Backend_2XX.sum
                  type: long
                  description: The number of HTTP 2XX response code generated by registered instances.
                - name: HTTPCode_Backend_3XX.sum
                  type: long
                  description: The number of HTTP 3XX response code generated by registered instances.
                - name: HTTPCode_Backend_4XX.sum
                  type: long
                  description: The number of HTTP 4XX response code generated by registered instances.
                - name: HTTPCode_Backend_5XX.sum
                  type: long
                  description: The number of HTTP 5XX response code generated by registered instances.
                - name: HTTPCode_ELB_4XX.sum
                  type: long
                  description: The number of HTTP 4XX client error codes generated by the load balancer.
                - name: HTTPCode_ELB_5XX.sum
                  type: long
                  description: The number of HTTP 5XX server error codes generated by the load balancer.
                - name: RequestCount.sum
                  type: long
                  description: The number of requests completed or connections made during the specified interval.
                - name: SpilloverCount.sum
                  type: long
                  description: The total number of requests that were rejected because the surge queue is full.
                - name: HealthyHostCount.max
                  type: long
                  description: The number of healthy instances registered with your load balancer.
                - name: SurgeQueueLength.max
                  type: long
                  description: The total number of requests (HTTP listener) or connections (TCP listener) that are pending routing to a healthy instance.
                - name: UnHealthyHostCount.max
                  type: long
                  description: The number of unhealthy instances registered with your load balancer.
                - name: Latency.avg
                  type: double
                  description: The total time elapsed, in seconds, from the time the load balancer sent the request to a registered instance until the instance started to send the response headers.
                - name: EstimatedALBActiveConnectionCount.avg
                  type: double
                  description: The estimated number of concurrent TCP connections active from clients to the load balancer and from the load balancer to targets.
                - name: EstimatedALBConsumedLCUs.avg
                  type: double
                  description: The estimated number of load balancer capacity units (LCU) used by an Application Load Balancer.
                - name: EstimatedALBNewConnectionCount.avg
                  type: double
                  description: The estimated number of new TCP connections established from clients to the load balancer and from the load balancer to targets.
                - name: EstimatedProcessedBytes.avg
                  type: double
                  description: The estimated number of bytes processed by an Application Load Balancer.
        - name: applicationelb
          type: group
          description: >
            `applicationelb` contains the metrics that were scraped from AWS CloudWatch which contains monitoring metrics sent by AWS ApplicationELB.
          release: ga
          fields:
            - name: metrics
              type: group
              fields:
                - name: ActiveConnectionCount.sum
                  type: long
                  description: The total number of concurrent TCP connections active from clients to the load balancer and from the load balancer to targets.
                - name: ClientTLSNegotiationErrorCount.sum
                  type: long
                  description: The number of TLS connections initiated by the client that did not establish a session with the load balancer due to a TLS error.
                - name: HTTP_Fixed_Response_Count.sum
                  type: long
                  description: The number of fixed-response actions that were successful.
                - name: HTTP_Redirect_Count.sum
                  type: long
                  description: The number of redirect actions that were successful.
                - name: HTTP_Redirect_Url_Limit_Exceeded_Count.sum
                  type: long
                  description: The number of redirect actions that couldn't be completed because the URL in the response location header is larger than 8K.
                - name: HTTPCode_ELB_3XX_Count.sum
                  type: long
                  description: The number of HTTP 3XX redirection codes that originate from the load balancer.
                - name: HTTPCode_ELB_4XX_Count.sum
                  type: long
                  description: The number of HTTP 4XX client error codes that originate from the load balancer.
                - name: HTTPCode_ELB_5XX_Count.sum
                  type: long
                  description: The number of HTTP 5XX server error codes that originate from the load balancer.
                - name: HTTPCode_ELB_500_Count.sum
                  type: long
                  description: The number of HTTP 500 error codes that originate from the load balancer.
                - name: HTTPCode_ELB_502_Count.sum
                  type: long
                  description: The number of HTTP 502 error codes that originate from the load balancer.
                - name: HTTPCode_ELB_503_Count.sum
                  type: long
                  description: The number of HTTP 503 error codes that originate from the load balancer.
                - name: HTTPCode_ELB_504_Count.sum
                  type: long
                  description: The number of HTTP 504 error codes that originate from the load balancer.
                - name: IPv6ProcessedBytes.sum
                  type: long
                  description: The total number of bytes processed by the load balancer over IPv6.
                - name: IPv6RequestCount.sum
                  type: long
                  description: The number of IPv6 requests received by the load balancer.
                - name: NewConnectionCount.sum
                  type: long
                  description: The total number of new TCP connections established from clients to the load balancer and from the load balancer to targets.
                - name: ProcessedBytes.sum
                  type: long
                  description: The total number of bytes processed by the load balancer over IPv4 and IPv6.
                - name: RejectedConnectionCount.sum
                  type: long
                  description: The number of connections that were rejected because the load balancer had reached its maximum number of connections.
                - name: RequestCount.sum
                  type: long
                  description: The number of requests processed over IPv4 and IPv6.
                - name: RuleEvaluations.sum
                  type: long
                  description: The number of rules processed by the load balancer given a request rate averaged over an hour.
                - name: ConsumedLCUs.avg
                  type: double
                  description: The number of load balancer capacity units (LCU) used by your load balancer.
                - name: HealthyHostCount.max
                  type: long
                  description: The number of targets that are considered healthy.
                - name: UnHealthyHostCount.max
                  type: long
                  description: The number of targets that are considered unhealthy.
        - name: networkelb
          type: group
          description: >
            `networkelb` contains the metrics that were scraped from AWS CloudWatch which contains monitoring metrics sent by AWS NetworkELB.
          release: ga
          fields:
            - name: metrics
              type: group
              fields:
                - name: ActiveFlowCount.avg
                  type: double
                  description: The total number of concurrent flows (or connections) from clients to targets.
                - name: ActiveFlowCount_TCP.avg
                  type: double
                  description: The total number of concurrent TCP flows (or connections) from clients to targets.
                - name: ActiveFlowCount_TLS.avg
                  type: double
                  description: The total number of concurrent TLS flows (or connections) from clients to targets.
                - name: ActiveFlowCount_UDP.avg
                  type: double
                  description: The total number of concurrent UDP flows (or connections) from clients to targets.
                - name: ConsumedLCUs.avg
                  type: double
                  description: The number of load balancer capacity units (LCU) used by your load balancer.
                - name: ClientTLSNegotiationErrorCount.sum
                  type: long
                  description: The total number of TLS handshakes that failed during negotiation between a client and a TLS listener.
                - name: NewFlowCount.sum
                  type: long
                  description: The total number of new flows (or connections) established from clients to targets in the time period.
                - name: NewFlowCount_TLS.sum
                  type: long
                  description: The total number of new TLS flows (or connections) established from clients to targets in the time period.
                - name: ProcessedBytes.sum
                  type: long
                  description: The total number of bytes processed by the load balancer, including TCP/IP headers.
                - name: ProcessedBytes_TLS.sum
                  type: long
                  description: The total number of bytes processed by TLS listeners.
                - name: TargetTLSNegotiationErrorCount.sum
                  type: long
                  description: The total number of TLS handshakes that failed during negotiation between a TLS listener and a target.
                - name: TCP_Client_Reset_Count.sum
                  type: long
                  description: The total number of reset (RST) packets sent from a client to a target.
                - name: TCP_ELB_Reset_Count.sum
                  type: long
                  description: The total number of reset (RST) packets generated by the load balancer.
                - name: TCP_Target_Reset_Count.sum
                  type: long
                  description: The total number of reset (RST) packets sent from a target to a client.
                - name: HealthyHostCount.max
                  type: long
                  description: The number of targets that are considered healthy.
                - name: UnHealthyHostCount.max
                  type: long
                  description: The number of targets that are considered unhealthy.
        - name: kinesis
          type: group
          description: >
            `kinesis` contains the metrics that were scraped from AWS CloudWatch which contains monitoring metrics sent by Amazon Kinesis.
          release: beta
          fields:
            - name: metrics
              type: group
              fields:
                - name: GetRecords_Bytes.avg
                  type: double
                  description: >
                    The average number of bytes retrieved from the Kinesis stream, measured over the specified time period.
                - name: GetRecords_IteratorAgeMilliseconds.avg
                  type: double
                  description: >
                    The age of the last record in all GetRecords calls made against a Kinesis stream, measured over the specified time period.
                    Age is the difference between the current time and when the last record of the GetRecords call was written to the stream.
                - name: GetRecords_Latency.avg
                  type: double
                  description: >
                    The time taken per GetRecords operation, measured over the specified time period.
                - name: GetRecords_Records.sum
                  type: long
                  description: >
                    The number of records retrieved from the shard, measured over the specified time period.
                - name: GetRecords_Success.sum
                  type: long
                  description: >
                    The number of successful GetRecords operations per stream, measured over the specified time period.
                - name: IncomingBytes.avg
                  type: double
                  description: >
                    The number of bytes successfully put to the Kinesis stream over the specified time period. This metric includes bytes from PutRecord and PutRecords operations.
                - name: IncomingRecords.avg
                  type: double
                  description: >
                    The number of records successfully put to the Kinesis stream over the specified time period. This metric includes record counts from PutRecord and PutRecords operations.
                - name: PutRecord_Bytes.avg
                  type: double
                  description: >
                    The number of bytes put to the Kinesis stream using the PutRecord operation over the specified time period.
                - name: PutRecord_Latency.avg
                  type: double
                  description: >
                    The time taken per PutRecord operation, measured over the specified time period.
                - name: PutRecord_Success.avg
                  type: double
                  description: >
                    The percentage of successful writes to a Kinesis stream, measured over the specified time period.
                - name: PutRecords_Bytes.avg
                  type: double
                  description: >
                    The average number of bytes put to the Kinesis stream using the PutRecords operation over the specified time period.
                - name: PutRecords_Latency.avg
                  type: double
                  description: >
                    The average time taken per PutRecords operation, measured over the specified time period.
                - name: PutRecords_Success.avg
                  type: long
                  description: >
                    The total number of PutRecords operations where at least one record succeeded, per Kinesis stream, measured over the specified time period.
                - name: PutRecords_TotalRecords.sum
                  type: long
                  description: >
                    The total number of records sent in a PutRecords operation per Kinesis data stream, measured over the specified time period.
                - name: PutRecords_SuccessfulRecords.sum
                  type: long
                  description: >
                    The number of successful records in a PutRecords operation per Kinesis data stream, measured over the specified time period.
                - name: PutRecords_FailedRecords.sum
                  type: long
                  description: >
                    The number of records rejected due to internal failures in a PutRecords operation per Kinesis data stream, measured over the specified time period.
                - name: PutRecords_ThrottledRecords.sum
                  type: long
                  description: >
                    The number of records rejected due to throttling in a PutRecords operation per Kinesis data stream, measured over the specified time period.
                - name: ReadProvisionedThroughputExceeded.avg
                  type: long
                  description: >
                    The number of GetRecords calls throttled for the stream over the specified time period.
                - name: SubscribeToShard_RateExceeded.avg
                  type: long
                  description: >
                    This metric is emitted when a new subscription attempt fails because there already is an active subscription by the same consumer or if you exceed the number of calls per second allowed for this operation.
                - name: SubscribeToShard_Success.avg
                  type: long
                  description: >
                    This metric records whether the SubscribeToShard subscription was successfully established.
                - name: SubscribeToShardEvent_Bytes.avg
                  type: long
                  description: >
                    The number of bytes received from the shard, measured over the specified time period.
                - name: SubscribeToShardEvent_MillisBehindLatest.avg
                  type: long
                  description: >
                    The difference between the current time and when the last record of the SubscribeToShard event was written to the stream.
                - name: SubscribeToShardEvent_Records.sum
                  type: long
                  description: >
                    The number of records received from the shard, measured over the specified time period.
                - name: SubscribeToShardEvent_Success.avg
                  type: long
                  description: >
                    This metric is emitted every time an event is published successfully. It is only emitted when there's an active subscription.
                - name: WriteProvisionedThroughputExceeded.avg
                  type: long
                  description: >
                    The number of records rejected due to throttling for the stream over the specified time period. This metric includes throttling from PutRecord and PutRecords operations.
        - name: lambda
          type: group
          description: >
            `lambda` contains the metrics that were scraped from AWS CloudWatch which contains monitoring metrics sent by AWS Lambda.
          release: ga
          fields:
            - name: metrics
              type: group
              fields:
                - name: Invocations.avg
                  type: double
                  description: The number of times your function code is executed, including successful executions and executions that result in a function error.
                - name: Errors.avg
                  type: double
                  description: The number of invocations that result in a function error.
                - name: DeadLetterErrors.avg
                  type: double
                  description: For asynchronous invocation, the number of times Lambda attempts to send an event to a dead-letter queue but fails.
                - name: DestinationDeliveryFailures.avg
                  type: double
                  description: For asynchronous invocation, the number of times Lambda attempts to send an event to a destination but fails.
                - name: Duration.avg
                  type: double
                  description: The amount of time that your function code spends processing an event.
                - name: Throttles.avg
                  type: double
                  description: The number of invocation requests that are throttled.
                - name: IteratorAge.avg
                  type: double
                  description: For event source mappings that read from streams, the age of the last record in the event.
                - name: ConcurrentExecutions.avg
                  type: double
                  description: The number of function instances that are processing events.
                - name: UnreservedConcurrentExecutions.avg
                  type: double
                  description: For an AWS Region, the number of events that are being processed by functions that don't have reserved concurrency.
                - name: ProvisionedConcurrentExecutions.max
                  type: long
                  description: The number of function instances that are processing events on provisioned concurrency.
                - name: ProvisionedConcurrencyUtilization.max
                  type: long
                  description: For a version or alias, the value of ProvisionedConcurrentExecutions divided by the total amount of provisioned concurrency allocated.
                - name: ProvisionedConcurrencyInvocations.sum
                  type: long
                  description: The number of times your function code is executed on provisioned concurrency.
                - name: ProvisionedConcurrencySpilloverInvocations.sum
                  type: long
                  description: The number of times your function code is executed on standard concurrency when all provisioned concurrency is in use.
        - name: natgateway
          type: group
          description: >
            `natgateway` contains the metrics from Cloudwatch to track usage of NAT gateway related resources.
          release: beta
          fields:
            - name: metrics
              type: group
              fields:
                - name: BytesInFromDestination.sum
                  type: long
                  description: The number of bytes received by the NAT gateway from the destination.
                - name: BytesInFromSource.sum
                  type: long
                  description: The number of bytes received by the NAT gateway from clients in your VPC.
                - name: BytesOutToDestination.sum
                  type: long
                  description: The number of bytes sent out through the NAT gateway to the destination.
                - name: BytesOutToSource.sum
                  type: long
                  description: The number of bytes sent through the NAT gateway to the clients in your VPC.
                - name: ConnectionAttemptCount.sum
                  type: long
                  description: The number of connection attempts made through the NAT gateway.
                - name: ConnectionEstablishedCount.sum
                  type: long
                  description: The number of connections established through the NAT gateway.
                - name: ErrorPortAllocation.sum
                  type: long
                  description: The number of times the NAT gateway could not allocate a source port.
                - name: IdleTimeoutCount.sum
                  type: long
                  description: The number of connections that transitioned from the active state to the idle state.
                - name: PacketsDropCount.sum
                  type: long
                  description: The number of packets dropped by the NAT gateway.
                - name: PacketsInFromDestination.sum
                  type: long
                  description: The number of packets received by the NAT gateway from the destination.
                - name: PacketsInFromSource.sum
                  type: long
                  description: The number of packets received by the NAT gateway from clients in your VPC.
                - name: PacketsOutToDestination.sum
                  type: long
                  description: The number of packets sent out through the NAT gateway to the destination.
                - name: PacketsOutToSource.sum
                  type: long
                  description: The number of packets sent through the NAT gateway to the clients in your VPC.
                - name: ActiveConnectionCount.max
                  type: long
                  description: The total number of concurrent active TCP connections through the NAT gateway.
        - name: rds
          type: group
          description: >
            `rds` contains the metrics that were scraped from AWS CloudWatch which contains monitoring metrics sent by AWS RDS.
          release: ga
          fields:
            - name: burst_balance.pct
              type: scaled_float
              format: percent
              description: >
                The percent of General Purpose SSD (gp2) burst-bucket I/O credits available.
            - name: cpu.total.pct
              type: scaled_float
              format: percent
              description: >
                The percentage of CPU utilization.
            - name: cpu.credit_usage
              type: long
              description: >
                The number of CPU credits spent by the instance for CPU utilization.
            - name: cpu.credit_balance
              type: long
              description: >
                The number of earned CPU credits that an instance has accrued since it was launched or started.
            - name: database_connections
              type: long
              description: >
                The number of database connections in use.
            - name: db_instance.arn
              type: keyword
              description: >
                Amazon Resource Name(ARN) for each rds.
            - name: db_instance.class
              type: keyword
              description: >
                Contains the name of the compute and memory capacity class of the DB instance.
            - name: db_instance.identifier
              type: keyword
              description: >
                Contains a user-supplied database identifier. This identifier is the unique key that identifies a DB instance.
            - name: db_instance.status
              type: keyword
              description: >
                Specifies the current state of this database.
            - name: disk_queue_depth
              type: float
              description: >
                The number of outstanding IOs (read/write requests) waiting to access the disk.
            - name: failed_sql_server_agent_jobs
              type: long
              description: >
                The number of failed SQL Server Agent jobs during the last minute.
            - name: freeable_memory.bytes
              type: long
              format: bytes
              description: >
                The amount of available random access memory.
            - name: free_storage.bytes
              type: long
              format: bytes
              description: >
                The amount of available storage space.
            - name: maximum_used_transaction_ids
              type: long
              description: >
                The maximum transaction ID that has been used. Applies to PostgreSQL.
            - name: oldest_replication_slot_lag.mb
              type: long
              description: >
                The lagging size of the replica lagging the most in terms of WAL data received. Applies to PostgreSQL.
            - name: read.iops
              type: float
              description: >
                The average number of disk read I/O operations per second.
            - name: replica_lag.sec
              type: long
              format: duration
              description: >
                The amount of time a Read Replica DB instance lags behind the source DB instance. Applies to MySQL, MariaDB, and PostgreSQL Read Replicas.
            - name: swap_usage.bytes
              type: long
              format: bytes
              description: >
                The amount of swap space used on the DB instance. This metric is not available for SQL Server.
            - name: transaction_logs_generation
              type: long
              description: >
                The disk space used by transaction logs. Applies to PostgreSQL.
            - name: write.iops
              type: float
              description: >
                The average number of disk write I/O operations per second.
            - name: queries
              type: long
              description: >
                The average number of queries executed per second.
            - name: deadlocks
              type: long
              description: >
                The average number of deadlocks in the database per second.
            - name: volume_used.bytes
              type: long
              format: bytes
              description: >
                The amount of storage used by your Aurora DB instance, in bytes.
            - name: volume.read.iops
              type: long
              format: bytes
              description: >
                The number of billed read I/O operations from a cluster volume, reported at 5-minute intervals.
            - name: volume.write.iops
              type: long
              format: bytes
              description: >
                The number of write disk I/O operations to the cluster volume, reported at 5-minute intervals.
            - name: free_local_storage.bytes
              type: long
              format: bytes
              description: >
                The amount of storage available for temporary tables and logs, in bytes.
            - name: login_failures
              type: long
              description: >
                The average number of failed login attempts per second.
            - name: throughput.commit
              type: float
              description: >
                The average number of commit operations per second.
            - name: throughput.delete
              type: float
              description: >
                The average number of delete queries per second.
            - name: throughput.ddl
              type: float
              description: >
                The average number of DDL requests per second.
            - name: throughput.dml
              type: float
              description: >
                The average number of inserts, updates, and deletes per second.
            - name: throughput.insert
              type: float
              description: >
                The average number of insert queries per second.
            - name: throughput.network
              type: float
              description: >
                The amount of network throughput both received from and transmitted to clients by each instance in the Aurora MySQL DB cluster, in bytes per second.
            - name: throughput.network_receive
              type: float
              description: >
                The incoming (Receive) network traffic on the DB instance, including both customer database traffic and Amazon RDS traffic used for monitoring and replication.
            - name: throughput.network_transmit
              type: float
              description: >
                The outgoing (Transmit) network traffic on the DB instance, including both customer database traffic and Amazon RDS traffic used for monitoring and replication.
            - name: throughput.read
              type: float
              description: >
                The average amount of time taken per disk I/O operation.
            - name: throughput.select
              type: float
              description: >
                The average number of select queries per second.
            - name: throughput.update
              type: float
              description: >
                The average number of update queries per second.
            - name: throughput.write
              type: float
              description: >
                The average number of bytes written to disk per second.
            - name: latency.commit
              type: float
              format: duration
              description: >
                The amount of latency for commit operations, in milliseconds.
            - name: latency.ddl
              type: float
              format: duration
              description: >
                The amount of latency for data definition language (DDL) requests, in milliseconds.
            - name: latency.dml
              type: float
              format: duration
              description: >
                The amount of latency for inserts, updates, and deletes, in milliseconds.
            - name: latency.insert
              type: float
              format: duration
              description: >
                The amount of latency for insert queries, in milliseconds.
            - name: latency.read
              type: float
              format: duration
              description: >
                The average amount of time taken per disk I/O operation.
            - name: latency.select
              type: float
              format: duration
              description: >
                The amount of latency for select queries, in milliseconds.
            - name: latency.update
              type: float
              format: duration
              description: >
                The amount of latency for update queries, in milliseconds.
            - name: latency.write
              type: float
              format: duration
              description: >
                The average amount of time taken per disk I/O operation.
            - name: latency.delete
              type: float
              format: duration
              description: >
                The amount of latency for delete queries, in milliseconds.
            - name: disk_usage.bin_log.bytes
              type: long
              format: bytes
              description: >
                The amount of disk space occupied by binary logs on the master. Applies to MySQL read replicas.
            - name: disk_usage.replication_slot.mb
              type: long
              description: >
                The disk space used by replication slot files. Applies to PostgreSQL.
            - name: disk_usage.transaction_logs.mb
              type: long
              description: >
                The disk space used by transaction logs. Applies to PostgreSQL.
            - name: transactions.active
              type: long
              description: >
                The average number of current transactions executing on an Aurora database instance per second.
            - name: transactions.blocked
              type: long
              description: >
                The average number of transactions in the database that are blocked per second.
            - name: db_instance.db_cluster_identifier
              type: keyword
              description: >
                This identifier is the unique key that identifies a DB cluster specifically for Amazon Aurora DB cluster.
            - name: db_instance.role
              type: keyword
              description: >
                DB roles like WRITER or READER, specifically for Amazon Aurora DB cluster.
            - name: db_instance.engine_name
              type: keyword
              description: >
                Each DB instance runs a DB engine, like MySQL, MariaDB, PostgreSQL and etc.
            - name: aurora_bin_log_replica_lag
              type: long
              description: >
                The amount of time a replica DB cluster running on Aurora with MySQL compatibility lags behind the source DB cluster.
            - name: aurora_global_db.replicated_write_io.bytes
              type: long
              description: >
                In an Aurora Global Database, the number of write I/O operations replicated from the primary AWS Region to the cluster volume in a secondary AWS Region.
            - name: aurora_global_db.data_transfer.bytes
              type: long
              description: >
                In an Aurora Global Database, the amount of redo log data transferred from the master AWS Region to a secondary AWS Region.
            - name: aurora_global_db.replication_lag.ms
              type: long
              description: >
                For an Aurora Global Database, the amount of lag when replicating updates from the primary AWS Region, in milliseconds.
            - name: aurora_replica.lag.ms
              type: long
              description: >
                For an Aurora Replica, the amount of lag when replicating updates from the primary instance, in milliseconds.
            - name: aurora_replica.lag_max.ms
              type: long
              description: >
                The maximum amount of lag between the primary instance and each Aurora DB instance in the DB cluster, in milliseconds.
            - name: aurora_replica.lag_min.ms
              type: long
              description: >
                The minimum amount of lag between the primary instance and each Aurora DB instance in the DB cluster, in milliseconds.
            - name: backtrack_change_records.creation_rate
              type: long
              description: >
                The number of backtrack change records created over five minutes for your DB cluster.
            - name: backtrack_change_records.stored
              type: long
              description: >
                The actual number of backtrack change records used by your DB cluster.
            - name: backtrack_window.actual
              type: long
              description: >
                The difference between the target backtrack window and the actual backtrack window.
            - name: backtrack_window.alert
              type: long
              description: >
                The number of times that the actual backtrack window is smaller than the target backtrack window for a given period of time.
            - name: storage_used.backup_retention_period.bytes
              type: long
              description: >
                The total amount of backup storage in bytes used to support the point-in-time restore feature within the Aurora DB cluster's backup retention window.
            - name: storage_used.snapshot.bytes
              type: long
              description: >
                The total amount of backup storage in bytes consumed by all Aurora snapshots for an Aurora DB cluster outside its backup retention window.
            - name: cache_hit_ratio.buffer
              type: long
              description: >
                The percentage of requests that are served by the buffer cache.
            - name: cache_hit_ratio.result_set
              type: long
              description: >
                The percentage of requests that are served by the Resultset cache.
            - name: engine_uptime.sec
              type: long
              description: >
                The amount of time that the instance has been running, in seconds.
            - name: rds_to_aurora_postgresql_replica_lag.sec
              type: long
              description: >
                The amount of lag in seconds when replicating updates from the primary RDS PostgreSQL instance to other nodes in the cluster.
            - name: backup_storage_billed_total.bytes
              type: long
              description: >
                The total amount of backup storage in bytes for which you are billed for a given Aurora DB cluster.
            - name: aurora_volume_left_total.bytes
              type: long
              description: >
                The remaining available space for the cluster volume, measured in bytes.
        - name: s3_daily_storage
          type: group
          description: >
            `s3_daily_storage` contains the daily storage metrics that were scraped from AWS CloudWatch which contains monitoring metrics sent by AWS S3.
          release: ga
          fields:
            - name: bucket.size.bytes
              type: long
              format: bytes
              description: >
                The amount of data in bytes stored in a bucket.
            - name: number_of_objects
              type: long
              description: >
                The total number of objects stored in a bucket for all storage classes.
        - name: s3_request
          type: group
          description: >
            `s3_request` contains request metrics that were scraped from AWS CloudWatch which contains monitoring metrics sent by AWS S3.
          release: ga
          fields:
            - name: requests.total
              type: long
              description: >
                The total number of HTTP requests made to an Amazon S3 bucket, regardless of type.
            - name: requests.get
              type: long
              description: >
                The number of HTTP GET requests made for objects in an Amazon S3 bucket.
            - name: requests.put
              type: long
              description: >
                The number of HTTP PUT requests made for objects in an Amazon S3 bucket.
            - name: requests.delete
              type: long
              description: >
                The number of HTTP DELETE requests made for objects in an Amazon S3 bucket.
            - name: requests.head
              type: long
              description: >
                The number of HTTP HEAD requests made to an Amazon S3 bucket.
            - name: requests.post
              type: long
              description: >
                The number of HTTP POST requests made to an Amazon S3 bucket.
            - name: requests.select
              type: long
              description: >
                The number of Amazon S3 SELECT Object Content requests made for objects in an Amazon S3 bucket.
            - name: requests.select_scanned.bytes
              type: long
              format: bytes
              description: >
                The number of bytes of data scanned with Amazon S3 SELECT Object Content requests in an Amazon S3 bucket.
            - name: requests.select_returned.bytes
              type: long
              format: bytes
              description: >
                The number of bytes of data returned with Amazon S3 SELECT Object Content requests in an Amazon S3 bucket.
            - name: requests.list
              type: long
              description: >
                The number of HTTP requests that list the contents of a bucket.
            - name: downloaded.bytes
              type: long
              format: bytes
              description: >
                The number bytes downloaded for requests made to an Amazon S3 bucket, where the response includes a body.
            - name: uploaded.bytes
              type: long
              format: bytes
              description: >
                The number bytes uploaded that contain a request body, made to an Amazon S3 bucket.
            - name: errors.4xx
              type: long
              description: >
                The number of HTTP 4xx client error status code requests made to an Amazon S3 bucket with a value of either 0 or 1.
            - name: errors.5xx
              type: long
              description: >
                The number of HTTP 5xx server error status code requests made to an Amazon S3 bucket with a value of either 0 or 1.
            - name: latency.first_byte.ms
              type: long
              format: duration
              description: >
                The per-request time from the complete request being received by an Amazon S3 bucket to when the response starts to be returned.
            - name: latency.total_request.ms
              type: long
              format: duration
              description: >
                The elapsed per-request time from the first byte received to the last byte sent to an Amazon S3 bucket.
        - name: sns
          type: group
          description: >
            `sns` contains the metrics that were scraped from AWS CloudWatch which contains monitoring metrics sent by AWS SNS.
          release: beta
          fields:
            - name: metrics
              type: group
              fields:
                - name: PublishSize.avg
                  type: double
                  description: The size of messages published.
                - name: SMSSuccessRate.avg
                  type: double
                  description: The rate of successful SMS message deliveries.
                - name: NumberOfMessagesPublished.sum
                  type: long
                  description: The number of messages published to your Amazon SNS topics.
                - name: NumberOfNotificationsDelivered.sum
                  type: long
                  description: The number of messages successfully delivered from your Amazon SNS topics to subscribing endpoints.
                - name: NumberOfNotificationsFailed.sum
                  type: long
                  description: The number of messages that Amazon SNS failed to deliver.
                - name: NumberOfNotificationsFilteredOut.sum
                  type: long
                  description: The number of messages that were rejected by subscription filter policies.
                - name: NumberOfNotificationsFilteredOut-InvalidAttributes.sum
                  type: long
                  description: The number of messages that were rejected by subscription filter policies because the messages' attributes are invalid - for example, because the attribute JSON is incorrectly formatted.
                - name: NumberOfNotificationsFilteredOut-NoMessageAttributes.sum
                  type: long
                  description: The number of messages that were rejected by subscription filter policies because the messages have no attributes.
                - name: NumberOfNotificationsRedrivenToDlq.sum
                  type: long
                  description: The number of messages that have been moved to a dead-letter queue.
                - name: NumberOfNotificationsFailedToRedriveToDlq.sum
                  type: long
                  description: The number of messages that couldn't be moved to a dead-letter queue.
                - name: SMSMonthToDateSpentUSD.sum
                  type: long
                  description: The charges you have accrued since the start of the current calendar month for sending SMS messages.
        - name: sqs
          type: group
          description: >
            `sqs` contains the metrics that were scraped from AWS CloudWatch which contains monitoring metrics sent by AWS SQS.
          release: ga
          fields:
            - name: oldest_message_age.sec
              type: long
              format: duration
              description: >
                The approximate age of the oldest non-deleted message in the queue.
            - name: messages.delayed
              type: long
              description: >
                TThe number of messages in the queue that are delayed and not available for reading immediately.
            - name: messages.not_visible
              type: long
              description: >
                The number of messages that are in flight.
            - name: messages.visible
              type: long
              description: >
                The number of messages available for retrieval from the queue.
            - name: messages.deleted
              type: long
              description: >
                The number of messages deleted from the queue.
            - name: messages.received
              type: long
              description: >
                The number of messages returned by calls to the ReceiveMessage action.
            - name: messages.sent
              type: long
              description: >
                The number of messages added to a queue.
            - name: empty_receives
              type: long
              description: >
                The number of ReceiveMessage API calls that did not return a message.
            - name: sent_message_size.bytes
              type: long
              format: bytes
              description: >
                The size of messages added to a queue.
            - name: queue.name
              type: keyword
              description: >
                SQS queue name
        - name: transitgateway
          type: group
          description: >
            `transitgateway` contains the metrics from Cloudwatch to track usage of transit gateway related resources.
          release: beta
          fields:
            - name: metrics
              type: group
              fields:
                - name: BytesIn.sum
                  type: long
                  description: The number of bytes received by the transit gateway.
                - name: BytesOut.sum
                  type: long
                  description: The number of bytes sent from the transit gateway.
                - name: PacketsIn.sum
                  type: long
                  description: The number of packets received by the transit gateway.
                - name: PacketsOut.sum
                  type: long
                  description: The number of packets sent by the transit gateway.
                - name: PacketDropCountBlackhole.sum
                  type: long
                  description: The number of packets dropped because they matched a blackhole route.
                - name: PacketDropCountNoRoute.sum
                  type: long
                  description: The number of packets dropped because they did not match a route.
                - name: BytesDropCountNoRoute.sum
                  type: long
                  description: The number of bytes dropped because they did not match a route.
                - name: BytesDropCountBlackhole.sum
                  type: long
                  description: The number of bytes dropped because they matched a blackhole route.
        - name: usage
          type: group
          description: >
            `usage` contains the metrics from Cloudwatch to track usage of some AWS resources.
          release: beta
          fields:
            - name: metrics
              type: group
              fields:
                - name: CallCount.sum
                  type: long
                  description: The number of specified API operations performed in your account.
                - name: ResourceCount.sum
                  type: long
                  description: The number of the specified resources running in your account. The resources are defined by the dimensions associated with the metric.
        - name: vpn
          type: group
          description: >
            `vpn` contains the metrics from Cloudwatch to track usage of VPN related resources.
          release: beta
          fields:
            - name: metrics
              type: group
              fields:
                - name: TunnelState.avg
                  type: double
                  description: The state of the tunnel. For static VPNs, 0 indicates DOWN and 1 indicates UP. For BGP VPNs, 1 indicates ESTABLISHED and 0 is used for all other states.
                - name: TunnelDataIn.sum
                  type: double
                  description: The bytes received through the VPN tunnel.
                - name: TunnelDataOut.sum
                  type: double
                  description: The bytes sent through the VPN tunnel.
- key: awsfargate
  title: "AWS Fargate"
  description: >
    `awsfargate` module collects AWS fargate metrics from task metadata endpoint.
  release: beta
  fields:
    - name: awsfargate
      type: group
      fields:
        - name: container.labels.com_amazonaws_ecs_cluster
          type: keyword
          description: ECS Cluster name
        - name: container.labels.com_amazonaws_ecs_container-name
          type: keyword
          description: ECS container name
        - name: container.labels.com_amazonaws_ecs_task-arn
          type: keyword
          description: ECS task ARN
        - name: container.labels.com_amazonaws_ecs_task-definition-family
          type: keyword
          description: ECS task definition family
        - name: container.labels.com_amazonaws_ecs_task-definition-version
          type: keyword
          description: ECS task definition version      
        - name: task_stats
          type: group
          description: >
            `task_stats` contains the metrics that were scraped from AWS fargate task stats ${ECS_CONTAINER_METADATA_URI_V4}/task/stats metadata endpoint.
          release: beta
          fields:
            - name: cluster_name
              type: keyword
              description: Cluster name (Pippero)
            - name: task_name
              type: keyword
              description: ECS task name
            - name: identifier
              type: keyword
              description: >
                Container identifier across tasks and clusters, which equals to container.name + '/' + container.id.
            - name: task_desired_status
              type: keyword
              description: >
                The desired status for the task from Amazon ECS.
            - name: task_known_status
              type: keyword
              description: >
                The known status for the task from Amazon ECS.
            - name: cpu
              type: group
              description: Runtime CPU metrics.
              fields:
                - name: kernel.pct
                  type: scaled_float
                  format: percent
                  description: >
                    Percentage of time in kernel space.
                - name: kernel.norm.pct
                  type: scaled_float
                  format: percent
                  description: >
                    Percentage of time in kernel space normalized by the number of CPU cores.
                - name: kernel.ticks
                  type: long
                  description: >
                    CPU ticks in kernel space.
                - name: system.pct
                  type: scaled_float
                  format: percent
                  description: >
                    Percentage of total CPU time in the system.
                - name: system.norm.pct
                  type: scaled_float
                  format: percent
                  description: >
                    Percentage of total CPU time in the system normalized by the number of CPU cores.
                - name: system.ticks
                  type: long
                  description: >
                    CPU system ticks.
                - name: user.pct
                  type: scaled_float
                  format: percent
                  description: >
                    Percentage of time in user space.
                - name: user.norm.pct
                  type: scaled_float
                  format: percent
                  description: >
                    Percentage of time in user space normalized by the number of CPU cores.
                - name: user.ticks
                  type: long
                  description: >
                    CPU ticks in user space.
                - name: total.pct
                  type: scaled_float
                  format: percent
                  description: >
                    Total CPU usage.
                - name: total.norm.pct
                  type: scaled_float
                  format: percent
                  description: >
                    Total CPU usage normalized by the number of CPU cores.
            - name: diskio
              type: group
              description: Disk I/O metrics.
              fields:
                - name: read
                  type: group
                  description: >
                    Accumulated reads during the life of the container
                  fields:
                    - name: ops
                      type: long
                      description: >
                        Number of reads during the life of the container
                    - name: bytes
                      type: long
                      format: bytes
                      description: >
                        Bytes read during the life of the container
                    - name: rate
                      type: long
                      description: >
                        Number of current reads per second
                    - name: service_time
                      type: long
                      description: >
                        Total time to service IO requests, in nanoseconds
                    - name: wait_time
                      type: long
                      description: >
                        Total time requests spent waiting in queues for service, in nanoseconds
                    - name: queued
                      type: long
                      description: >
                        Total number of queued requests
                - name: reads
                  type: scaled_float
                  deprecated: 6.4
                  description: >
                    Number of current reads per second
                - name: write
                  type: group
                  description: >
                    Accumulated writes during the life of the container
                  fields:
                    - name: ops
                      type: long
                      description: >
                        Number of writes during the life of the container
                    - name: bytes
                      type: long
                      format: bytes
                      description: >
                        Bytes written during the life of the container
                    - name: rate
                      type: long
                      description: >
                        Number of current writes per second
                    - name: service_time
                      type: long
                      description: >
                        Total time to service IO requests, in nanoseconds
                    - name: wait_time
                      type: long
                      description: >
                        Total time requests spent waiting in queues for service, in nanoseconds
                    - name: queued
                      type: long
                      description: >
                        Total number of queued requests
                - name: writes
                  type: scaled_float
                  deprecated: 6.4
                  description: >
                    Number of current writes per second
                - name: summary
                  type: group
                  description: >
                    Accumulated reads and writes during the life of the container
                  fields:
                    - name: ops
                      type: long
                      description: >
                        Number of I/O operations during the life of the container
                    - name: bytes
                      type: long
                      format: bytes
                      description: >
                        Bytes read and written during the life of the container
                    - name: rate
                      type: long
                      description: >
                        Number of current operations per second
                    - name: service_time
                      type: long
                      description: >
                        Total time to service IO requests, in nanoseconds
                    - name: wait_time
                      type: long
                      description: >
                        Total time requests spent waiting in queues for service, in nanoseconds
                    - name: queued
                      type: long
                      description: >
                        Total number of queued requests
                - name: total
                  type: scaled_float
                  deprecated: 6.4
                  description: >
                    Number of reads and writes per second
            - name: memory
              type: group
              description: Memory metrics.
              fields:
                - name: stats
                  type: object
                  object_type: long
                  object_type_mapping_type: "*"
                  description: >
                    Raw memory stats from the cgroups memory.stat interface
                - name: commit
                  type: group
                  description: >
                    Committed bytes on Windows
                  fields:
                    - name: total
                      type: long
                      format: bytes
                      description: >
                        Total bytes
                    - name: peak
                      type: long
                      format: bytes
                      description: >
                        Peak committed bytes on Windows
                - name: private_working_set.total
                  type: long
                  format: bytes
                  description: >
                    private working sets on Windows
                - name: fail.count
                  type: scaled_float
                  description: >
                    Fail counter.
                - name: limit
                  type: long
                  format: bytes
                  description: >
                    Memory limit.
                - name: rss
                  type: group
                  description: >
                    RSS memory stats.
                  fields:
                    - name: total
                      type: long
                      format: bytes
                      description: >
                        Total memory resident set size.
                    - name: pct
                      type: scaled_float
                      format: percent
                      description: >
                        Memory resident set size percentage.
                - name: usage
                  type: group
                  description: >
                    Usage memory stats.
                  fields:
                    - name: max
                      type: long
                      format: bytes
                      description: >
                        Max memory usage.
                    - name: pct
                      type: scaled_float
                      format: percent
                      description: >
                        Memory usage percentage.
                    - name: total
                      type: long
                      format: bytes
                      description: >
                        Total memory usage.
            - name: network.*.inbound
              type: group
              fields:
                - name: bytes
                  type: long
                  format: bytes
                  description: |
                    Total number of incoming bytes.
                - name: dropped
                  type: long
                  description: |
                    Total number of dropped incoming packets.
                - name: errors
                  type: long
                  description: |
                    Total errors on incoming packets.
                - name: packets
                  type: long
                  description: |
                    Total number of incoming packets.
            - name: network.*.outbound
              type: group
              fields:
                - name: bytes
                  type: long
                  format: bytes
                  description: |
                    Total number of incoming bytes.
                - name: dropped
                  type: long
                  description: |
                    Total number of dropped incoming packets.
                - name: errors
                  type: long
                  description: |
                    Total errors on incoming packets.
                - name: packets
                  type: long
                  description: |
                    Total number of incoming packets.
- key: azure
  title: "Azure"
  description: >
    azure module
  release: ga
  fields:
    - name: azure
      type: group
      fields:
        - name: timegrain
          type: keyword
          description: >
            The Azure metric timegrain
        - name: resource
          type: group
          description: >
            The resource specified
          fields:
            - name: type
              type: keyword
              description: >
                The type of the resource
            - name: name
              type: keyword
              description: >
                The name of the resource
            - name: group
              type: keyword
              description: >
                The resource group
            - name: tags.*
              type: object
              object_type: keyword
              object_type_mapping_type: "*"
              description: >
                Azure resource tags.
        - name: namespace
          type: keyword
          description: >
            The namespace selected
        - name: subscription_id
          type: keyword
          description: >
            The subscription ID
        - name: subscription_name
          type: keyword
          description: >
            The subscription name
        - name: application_id
          type: keyword
          description: >
            The application ID
        - name: dimensions.*
          type: object
          object_type: keyword
          object_type_mapping_type: "*"
          description: >
            Azure metric dimensions.
        - name: metrics.*.*
          type: object
          object_type: float
          object_type_mapping_type: "*"
          description: >
            Metrics returned.
        - name: app_insights
          type: group
          release: beta
          description: >
            application insights
          fields:
            - name: start_date
              type: date
              description: >
                The start date
            - name: end_date
              type: date
              description: >
                The end date
            - name: metrics.*.*
              type: object
              object_type: float
              object_type_mapping_type: "*"
              description: >
               The metrics
        - name: app_state
          type: group
          release: beta
          description: >
            application state
          fields:
            - name: start_date
              type: date
              description: >
                The start date
            - name: end_date
              type: date
              description: >
                The end date
            - name: requests_count.sum
              type: float
              description: >
                Request count
            - name: requests_failed.sum
              type: float
              description: >
                Request failed count
            - name: users_count.unique
              type: float
              description: >
                User count
            - name: sessions_count.unique
              type: float
              description: >
                Session count
            - name: users_authenticated.unique
              type: float
              description: >
                Authenticated users count
            - name: browser_timings_network_duration.avg
              type: float
              description: >
                Browser timings network duration
            - name: browser_timings_send_duration.avg
              type: float
              description: >
                Browser timings send duration
            - name: browser_timings_receive_uration.avg
              type: float
              description: >
                Browser timings receive duration
            - name: browser_timings_processing_duration.avg
              type: float
              description: >
                Browser timings processing duration
            - name: browser_timings_total_duration.avg
              type: float
              description: >
                Browser timings total duration
            - name: exceptions_count.sum
              type: float
              description: >
                Exception count
            - name: exceptions_browser.sum
              type: float
              description: >
                Exception count at browser level
            - name: exceptions_server.sum
              type: float
              description: >
                Exception count at server level
            - name: performance_counters_memory_available_bytes.avg
              type: float
              description: >
                Performance counters memory available bytes
            - name: performance_counters_process_private_bytes.avg
              type: float
              description: >
                Performance counters process private bytes
            - name: performance_counters_process_cpu_percentage_total.avg
              type: float
              description: >
                Performance counters process cpu percentage total
            - name: performance_counters_process_cpu_percentage.avg
              type: float
              description: >
                Performance counters process cpu percentage
            - name: performance_counters_processiobytes_per_second.avg
              type: float
              description: >
                Performance counters process IO bytes per second
        - name: billing
          type: group
          release: beta
          description: >
            billing and usage details
          fields:
            - name: currency
              type: keyword
              description: >
                Billing Currency.
            - name: pretax_cost
              type: float
              description: >
                The amount of cost before tax.
            - name: unit_price
              type: float
              description: >
                Unit Price is the price applicable to you. (your EA or other contract price).
            - name: quantity
              type: float
              description: >
                Measure the quantity purchased or consumed. The amount of the meter used during the billing period.
            - name: department_name
              type: keyword
              description: >
                The department name
            - name: product
              type: keyword
              description: >
                Product name for the consumed service or purchase.
            - name: usage_start
              type: date
              description: >
                The usage start date
            - name: usage_end
              type: date
              description: >
                The usage end date
            - name: billing_period_id
              type: keyword
              description: >
                The billing period id.
            - name: account_name
              type: keyword
              description: >
                Name of the Billing Account.
            - name: account_id
              type: keyword
              description: >
                Billing Account identifier.
            - name: actual_cost
              type: float
              description: >
                The actual cost
            - name: forecast_cost
              type: float
              description: >
                The forecast cost
            - name: usage_date
              type: date
              description: >
                The usage date
        - name: compute_vm.*.*
          release: ga
          type: object
          object_type: float
          object_type_mapping_type: "*"
          description: >
            compute_vm
        - name: compute_vm_scaleset.*.*
          release: ga
          type: object
          object_type: float
          object_type_mapping_type: "*"
          description: >
            compute_vm_scaleset
        
        - name: container_instance.*.*
          release: ga
          type: object
          object_type: float
          object_type_mapping_type: "*"
          description: >
            container instance
        - name: container_registry.*.*
          release: ga
          type: object
          object_type: float
          object_type_mapping_type: "*"
          description: >
            container registry
        - name: container_service.*.*
          release: ga
          type: object
          object_type: float
          object_type_mapping_type: "*"
          description: >
            container service
        - name: database_account.*.*
          release: ga
          type: object
          object_type: float
          object_type_mapping_type: "*"
          description: >
            database account
        - name: monitor
          type: group
          release: ga
          description: >
            monitor
          fields:
        
        
        - name: storage.*.*
          release: ga
          type: object
          object_type: float
          object_type_mapping_type: "*"
          description: >
            storage account
        - name: storage_account.*.*
          release: ga
          type: object
          object_type: float
          object_type_mapping_type: "*"
          description: >
            storage account
- key: cloudfoundry
  title: "Cloudfoundry"
  description: >
    Cloud Foundry module
  release: beta
  fields:
    - name: cloudfoundry
      type: group
      description: >
      fields:
        - name: type
          type: keyword
          description: >
            The type of event from Cloud Foundry.
            Possible values include 'container', 'counter' and 'value'.
        - name: app
          type: group
          description: >
            The application the metric is associated with.
          fields:
            - name: id
              type: keyword
              description: >
                The ID of the application.
        - name: container
          type: group
          description: >
            `container` contains container metrics from Cloud Foundry.
          release: beta
          fields:
            - name: instance_index
              type: long
              description: >
               Index of the instance the metric belongs to.
            - name: cpu.pct
              type: scaled_float
              description: >
                CPU usage percentage.
            - name: memory.bytes
              type: long
              description: >
                Bytes of used memory.
            - name: memory.quota.bytes
              type: long
              description: >
                Bytes of available memory.
            - name: disk.bytes
              type: long
              description: >
                Bytes of used storage.
            - name: disk.quota.bytes
              type: long
              description: >
                Bytes of available storage.
        - name: counter
          type: group
          description: >
            `counter` contains counter metrics from Cloud Foundry.
          release: beta
          fields:
            - name: name
              type: keyword
              description: >
                The name of the counter.
            - name: delta
              type: long
              description: >
                The difference between the last time the counter event occurred.
            - name: total
              type: long
              description: >
                The total value for the counter.
        - name: value
          type: group
          description: >
            `value` contains counter metrics from Cloud Foundry.
          release: beta
          fields:
            - name: name
              type: keyword
              description: >
                The name of the value.
            - name: unit
              type: keyword
              description: >
                The unit of the value.
            - name: value
              type: float
              description: >
                The value of the value.
- key: cockroachdb
  title: 'CockroachDB'
  release: ga
  description: >
    CockroachDB module scrape metrics using Prometheus endpoint.
  settings: ["ssl", "http"]
  fields:
    - name: cockroachdb
      type: group
      fields:
        - release: ga
- key: containerd
  title: "Containerd"
  release: beta
  description: >
    Containerd stats collected from containerd
  fields:
    - name: containerd
      type: group
      description: >
        Information and statistics about containerd's running containers.
      fields:
        - name: namespace
          type: keyword
          description: >
            Containerd namespace
        - name: blkio
          type: group
          release: beta
          description: >
            Block I/O metrics.
          fields:
            - name: device
              type: keyword
              description: >
                Name of block device
            - name: read
              type: group
              description: >
                Accumulated reads during the life of the container
              fields:
                - name: ops
                  type: long
                  description: >
                    Number of reads during the life of the container
                - name: bytes
                  type: long
                  format: bytes
                  description: >
                    Bytes read during the life of the container
            - name: write
              type: group
              description: >
                Accumulated writes during the life of the container
              fields:
                - name: ops
                  type: long
                  description: >
                    Number of writes during the life of the container
                - name: bytes
                  type: long
                  format: bytes
                  description: >
                    Bytes written during the life of the container
            - name: summary
              type: group
              description: >
                Accumulated reads and writes during the life of the container
              fields:
                - name: ops
                  type: long
                  description: >
                    Number of I/O operations during the life of the container
                - name: bytes
                  type: long
                  format: bytes
                  description: >
                    Bytes read and written during the life of the container
        
        - name: cpu
          type: group
          description: >
            Containerd Runtime CPU metrics.
          release: beta
          fields:
            - name: system.total
              type: double
              description: >
                Total user and system CPU time spent in seconds.
            - name: usage
              type: group
              fields:
                - name: kernel
                  type: group
                  fields:
                    - name: ns
                      type: double
                      description: >
                        CPU Kernel usage nanoseconds
                - name: user
                  type: group
                  fields:
                    - name: ns
                      type: double
                      description: >
                        CPU User usage nanoseconds
                - name: total
                  type: group
                  fields:
                    - name: ns
                      type: double
                      description: >
                        CPU total usage nanoseconds
                - name: total.pct
                  type: scaled_float
                  format: percent
                  description: >
                    Percentage of total CPU time normalized by the number of CPU cores
                - name: kernel.pct
                  type: scaled_float
                  format: percent
                  description: >
                    Percentage of time in kernel space normalized by the number of CPU cores.
                - name: user.pct
                  type: scaled_float
                  format: percent
                  description: >
                    Percentage of time in user space normalized by the number of CPU cores.
                - name: cpu.*.ns
                  type: object
                  object_type: double
                  description: >
                    CPU usage nanoseconds in this cpu.
        - name: memory
          type: group
          release: beta
          description: >
            memory
          fields:
            - name: workingset.pct
              type: scaled_float
              format: percent
              description: >
                Memory working set percentage.
            - name: rss
              type: long
              format: bytes
              description: >
                Total memory resident set size.
            - name: activeFiles
              type: long
              format: bytes
              description: >
                Total active file bytes.
            - name: cache
              type: long
              format: bytes
              description: >
                Total cache bytes.
            - name: inactiveFiles
              type: long
              format: bytes
              description: >
                Total inactive file bytes.
            - name: usage
              type: group
              description: >
                Usage memory stats.
              fields:
                - name: max
                  type: long
                  format: bytes
                  description: >
                    Max memory usage.
                - name: pct
                  type: scaled_float
                  format: percent
                  description: >
                    Total allocated memory percentage.
                - name: total
                  type: long
                  format: bytes
                  description: >
                    Total memory usage.
                - name: fail.count
                  type: scaled_float
                  description: >
                    Fail counter.
                - name: limit
                  type: long
                  format: bytes
                  description: >
                    Memory usage limit.
            - name: kernel
              type: group
              description: >
                Kernel memory stats.
              fields:
                - name: max
                  type: long
                  format: bytes
                  description: >
                    Kernel max memory usage.
                - name: total
                  type: long
                  format: bytes
                  description: >
                    Kernel total memory usage.
                - name: fail.count
                  type: scaled_float
                  description: >
                    Kernel fail counter.
                - name: limit
                  type: long
                  format: bytes
                  description: >
                    Kernel memory limit.
            - name: swap
              type: group
              description: >
                Swap memory stats.
              fields:
                - name: max
                  type: long
                  format: bytes
                  description: >
                    Swap max memory usage.
                - name: total
                  type: long
                  format: bytes
                  description: >
                    Swap total memory usage.
                - name: fail.count
                  type: scaled_float
                  description: >
                    Swap fail counter.
                - name: limit
                  type: long
                  format: bytes
                  description: >
                    Swap memory limit.
        
- key: coredns
  title: "Coredns"
  description: >
    coredns Module
  release: ga
  fields:
    - name: coredns
      type: group
      description: >
        `coredns` contains statistics that were read from coreDNS
      fields:
        - name: stats
          type: group
          description: >
            Contains statistics related to the coreDNS service
          release: ga
          fields:
            - name: panic.count
              type: long
              description: >
                 Total number of panics
            - name: dns.request.count
              type: long
              description: >
                 Total query count
            - name: dns.request.duration.ns.bucket.*
              type: object
              object_type: long
              description: >
                 Request duration histogram buckets in nanoseconds
            - name: dns.request.duration.ns.sum
              type: long
              format: duration
              description: >
                 Requests duration, sum of durations in nanoseconds
            - name: dns.request.duration.ns.count
              type: long
              description: >
                 Requests duration, number of requests
            - name: dns.request.size.bytes.bucket.*
              type: object
              object_type: long
              description: >
                 Request Size histogram buckets
            - name: dns.request.size.bytes.sum
              type: long
              description: >
                Request Size histogram sum
            - name: dns.request.size.bytes.count
              type: long
              description: >
                Request Size histogram count
            - name: dns.request.do.count
              type: long
              description: >
                 Number of queries that have the DO bit set
            - name: dns.request.type.count
              type: long
              description: >
                  Counter of queries per zone and type
            - name: type
              type: keyword
              description: >
                Holds the query type of the request
            - name: dns.response.rcode.count
              type: long
              description: >
                Counter of responses per zone and rcode
            - name: rcode
              type: keyword
              description: >
                Holds the rcode of the response
            - name: family
              type: keyword
              description: >
                The address family of the transport (1 = IP (IP version 4), 2 = IP6 (IP version 6))
            - name: dns.response.size.bytes.bucket.*
              type: object
              object_type: long
              description: >
                  Response Size histogram buckets
            - name: dns.response.size.bytes.sum
              type: long
              description: >
                Response Size histogram sum
            - name: dns.response.size.bytes.count
              type: long
              description: >
                Response Size histogram count
            - name: server
              type: keyword
              description: >
                The server responsible for the request
            - name: zone
              type: keyword
              description: >
                The zonename used for the request/response
            - name: proto
              type: keyword
              description: >
                The transport of the response ("udp" or "tcp")
        
        
            - name: dns.cache.hits.count
              type: long
              description: >
                Cache hits count for the cache plugin
            - name: dns.cache.misses.count
              type: long
              description: >
                Cache misses count for the cache plugin
- key: enterprisesearch
  title: "Enterprise Search"
  release: beta
  settings: ["ssl", "http"]
  description: >
    Enterprise Search module
  fields:
    - name: enterprisesearch
      type: group
      description: >
        `enterprisesearch` contains metrics and health information for Enterprise Search
      fields:
        - name: cluster_uuid
          type: keyword
          description: Cluster UUID for the Elasticsearch cluster used as the data store for Enterprise Search.
        - name: health
          type: group
          release: beta
          description: Enterprise Search health
          fields:
            - name: name
              type: keyword
              description: Host name for the Enterprise Search node
        
            - name: version
              type: group
              description: Enterprise Search version information
              fields:
                - name: number
                  type: keyword
                  description: Enterprise Search version number using the semantic versioning format
        
                - name: build_hash
                  type: keyword
                  description: A unique build hash for the Enterprise Search package
        
            - name: process
              type: group
              description: Enterprise Search process information
              fields:
                - name: pid
                  type: long
                  description: Process ID for the Enterprise Search instance
        
                - name: uptime.sec
                  type: long
                  description: Process uptime for the Enterprise Search instance
        
                - name: filebeat
                  type: group
                  description: Health information for the embedded Filebeat instance
                  fields:
                    - name: pid
                      type: long
                      description: Process ID for the embedded Filebeat instance
        
                    - name: restart_count
                      type: long
                      description: Number of times embedded Filebeat instance had to be restarted due to some issues
        
                    - name: time_since_last_restart.sec
                      type: long
                      description: Time since the last embedded Filebeat instance restart (-1 if never restarted)
        
            - name: jvm
              type: group
              description: JVM health
              fields:
                - name: version
                  type: keyword
                  description: JVM version used to run Enterprise Search
        
                - name: gc
                  type: group
                  description: Java garbage collection metrics
                  fields:
                    - name: collection_count
                      type: long
                      description: Total number of Java garbage collector invocations since the start of the process
        
                    - name: collection_time.ms
                      type: long
                      description: Total time spent running Java garbage collector since the start of the process
        
                - name: memory_usage
                  type: group
                  description: Memory usage
                  fields:
                    - name: heap_init.bytes
                      type: long
                      format: bytes
                      description: Heap init used by the JVM in bytes.
        
                    - name: heap_used.bytes
                      type: long
                      format: bytes
                      description: Heap used by the JVM in bytes.
        
                    - name: heap_committed.bytes
                      type: long
                      format: bytes
                      description: Committed heap to the JVM in bytes.
        
                    - name: heap_max.bytes
                      type: long
                      format: bytes
                      description: Max heap used by the JVM in bytes
        
                    - name: non_heap_init.bytes
                      type: long
                      format: bytes
                      description: Non-Heap initial memory used by the JVM in bytes.
        
                    - name: non_heap_committed.bytes
                      type: long
                      format: bytes
                      description: Non-Heap committed memory used by the JVM in bytes.
        
                    - name: object_pending_finalization_count
                      type: long
                      description: >
                        Displays the approximate number of objects for which finalization is pending.
        
                - name: threads
                  type: group
                  description: Threads information
                  fields:
                    - name: current
                      type: long
                      description: Current number of live threads.
        
                    - name: daemon
                      type: long
                      description: Current number of live daemon threads.
        
                    - name: max
                      type: long
                      description: Peak live thread count since the JVM started or the peak was reset.
        
                    - name: total_started
                      type: long
                      description: Total number of threads created and/or started since the JVM started.
        
            - name: crawler
              type: group
              description: Crawler health
              fields:
                - name: workers
                  type: group
                  description: Crawler workers
                  fields:
                    - name: pool_size
                      type: long
                      description: Workers pool size.
        
                    - name: active
                      type: long
                      description: Number of active workers.
        
                    - name: available
                      type: long
                      description: Number of available workers.
        - name: stats
          type: group
          release: beta
          description: Enterprise Search stats.
          fields:
            - name: connectors
              type: group
              description: Workplace Search connectors subsystem stats.
              fields:
                - name: job_store
                  type: group
                  description: Workplace Search connectors job store stats.
                  fields:
                    - name: waiting
                      type: long
                      description: Number of connectors jobs waiting to be processed.
        
                    - name: working
                      type: long
                      description: Number of connectors jobs currently being processed.
        
                    - name: job_types
                      type: group
                      description: Breakdown of connectors jobs by types.
                      fields:
                        - name: delete
                          type: long
                          description: Number of delete jobs in the jobs store.
        
                        - name: full
                          type: long
                          description: Number of full sync jobs in the jobs store.
        
                        - name: incremental
                          type: long
                          description: Number of incremental sync jobs in the jobs store.
        
                        - name: permissions
                          type: long
                          description: Number of permissions sync jobs in the jobs store.
        
                - name: pool
                  type: group
                  description: Workplace Search worker pools stats.
                  fields:
                    - name: extract_worker_pool
                      type: group
                      description: Status information for the extractor workers pool.
                      fields:
                        - name: size
                          type: long
                          description: Worker pool size.
        
                        - name: busy
                          type: long
                          description: Number of busy workers.
        
                        - name: queue_depth
                          type: long
                          description: Number of items waiting to be processed.
        
                        - name: idle
                          type: long
                          description: Number of idle workers.
        
                        - name: total_completed
                          type: long
                          description: Number of jobs completed since the start.
        
                        - name: total_scheduled
                          type: long
                          description: Number of jobs scheduled since the start.
        
                    - name: subextract_worker_pool
                      type: group
                      description: Status information for the sub-extractor workers pool.
                      fields:
                        - name: size
                          type: long
                          description: Worker pool size.
        
                        - name: busy
                          type: long
                          description: Number of busy workers.
        
                        - name: queue_depth
                          type: long
                          description: Number of items waiting to be processed.
        
                        - name: idle
                          type: long
                          description: Number of idle workers.
        
                        - name: total_completed
                          type: long
                          description: Number of jobs completed since the start.
        
                        - name: total_scheduled
                          type: long
                          description: Number of jobs scheduled since the start.
        
                    - name: publish_worker_pool
                      type: group
                      description: Status information for the publish workers pool.
                      fields:
                        - name: size
                          type: long
                          description: Worker pool size.
        
                        - name: busy
                          type: long
                          description: Number of busy workers.
        
                        - name: queue_depth
                          type: long
                          description: Number of items waiting to be processed.
        
                        - name: idle
                          type: long
                          description: Number of idle workers.
        
                        - name: total_completed
                          type: long
                          description: Number of jobs completed since the start.
        
                        - name: total_scheduled
                          type: long
                          description: Number of jobs scheduled since the start.
        
            - name: http
              type: group
              description: Incoming HTTP request metrics.
              fields:
                - name: connections
                  type: group
                  description: Incoming HTTP connection statistics.
                  fields:
                    - name: current
                      type: long
                      description: Current number of HTTP connections opened to the Enterprise Search instance.
        
                    - name: max
                      type: long
                      description: Maximum number of concurrent HTTP connections open to the Enterprise Search instance since the start.
        
                    - name: total
                      type: long
                      description: Total number of HTTP connections opened to the Enterprise Search instance since the start.
        
                - name: network
                  type: group
                  description: Network traffic metrics.
                  fields:
                    - name: received.bytes
                      type: long
                      format: bytes
                      description: Total number of bytes received by the Enterprise Search instance since the start.
        
                    - name: sent.bytes
                      type: long
                      format: bytes
                      description: Total number of bytes sent by the Enterprise Search instance since the start.
        
                    - name: received.bytes_per_sec
                      type: long
                      format: bytes
                      description: Average number of bytes received by the Enterprise Search instance per second since the start.
        
                    - name: sent.bytes_per_sec
                      type: long
                      format: bytes
                      description: Average number of bytes sent by the Enterprise Search instance per second since the start.
        
                - name: request_duration
                  type: group
                  description: Aggregate HTTP request duration statistics.
                  fields:
                    - name: max.ms
                      type: long
                      description: Longest HTTP connection duration since the start of the instance.
        
                    - name: mean.ms
                      type: long
                      description: Average HTTP connection duration since the start of the instance.
        
                    - name: std_dev.ms
                      type: long
                      description: Standard deviation for HTTP connection duration values since the start of the instance.
        
                - name: responses
                  type: group
                  description: Aggregate HTTP response counts broken down by HTTP status type.
                  fields:
                    - name: 1xx
                      type: long
                      description: Total number of HTTP requests finished with a 1xx response code since the start of the instance.
        
                    - name: 2xx
                      type: long
                      description: Total number of HTTP requests finished with a 2xx response code since the start of the instance.
        
                    - name: 3xx
                      type: long
                      description: Total number of HTTP requests finished with a 3xx response code since the start of the instance.
        
                    - name: 4xx
                      type: long
                      description: Total number of HTTP requests finished with a 4xx response code since the start of the instance.
        
                    - name: 5xx
                      type: long
                      description: Total number of HTTP requests finished with a 5xx response code since the start of the instance.
        
            - name: queues
              type: group
              description: Aggregate stats on the functioning of the background jobs processing pipeline within Enterprise Search.
              fields:
                - name: engine_destroyer.count
                  type: long
                  description: Total number of jobs processed via the engine_destroyer queue since the start of the instance.
        
                - name: mailer.count
                  type: long
                  description: Total number of jobs processed via the mailer queue since the start of the instance.
        
                - name: process_crawl.count
                  type: long
                  description: Total number of jobs processed via the process_crawl queue since the start of the instance.
        
                - name: failed.count
                  type: long
                  description: Total number of jobs waiting in the failed queue.
        
        
            - name: crawler
              type: group
              description: Aggregate stats on the functioning of the crawler subsystem within Enterprise Search.
              fields:
                - name: global
                  type: group
                  description: Global deployment-wide metrics for the crawler.
                  fields:
                    - name: crawl_requests
                      type: group
                      description: Crawl request summary for the deployment.
                      fields:
                        - name: pending
                          type: long
                          description: Total number of crawl requests waiting to be processed.
                        - name: active
                          type: long
                          description: Total number of crawl requests currently being processed (running crawls).
                        - name: successful
                          type: long
                          description: Total number of crawl requests that have succeeded.
                        - name: failed
                          type: long
                          description: Total number of failed crawl requests.
        
                - name: node
                  type: group
                  description: Node-level statistics for the crawler.
                  fields:
                    - name: pages_visited
                      type: long
                      description: Total number of pages visited by the crawler since the instance start.
        
                    - name: urls_allowed
                      type: long
                      description: Total number of URLs allowed by the crawler during discovery since the instance start.
        
                    - name: urls_denied
                      type: group
                      description: Total number of URLs denied by the crawler during discovery since the instance start, broken down by deny reason.
                      fields:
                        - name: already_seen
                          type: long
                          description: Total number of URLs not followed because of URL de-duplication (each URL is visited only once).
        
                        - name: domain_filter_denied
                          type: long
                          description: Total number of URLs denied because of an unknown domain.
        
                        - name: incorrect_protocol
                          type: long
                          description: Total number of URLs with incorrect/invalid/unsupported protocols.
        
                        - name: link_too_deep
                          type: long
                          description: Total number of URLs not followed due to crawl depth limits.
        
                        - name: nofollow
                          type: long
                          description: Total number of URLs denied due to a nofollow meta tag or an HTML link attribute.
        
                        - name: unsupported_content_type
                          type: long
                          description: Total number of URLs denied due to an unsupported content type.
        
                    - name: status_codes
                      type: group
                      description: HTTP request result counts, by status code.
                      fields:
                        - name: "200"
                          type: long
                          description: Total number of HTTP 200 responses seen by the crawler since the instance start.
                        - name: "301"
                          type: long
                          description: Total number of HTTP 301 responses seen by the crawler since the instance start.
                        - name: "302"
                          type: long
                          description: Total number of HTTP 302 responses seen by the crawler since the instance start.
                        - name: "400"
                          type: long
                          description: Total number of HTTP 400 responses seen by the crawler since the instance start.
                        - name: "401"
                          type: long
                          description: Total number of HTTP 401 responses seen by the crawler since the instance start.
                        - name: "402"
                          type: long
                          description: Total number of HTTP 402 responses seen by the crawler since the instance start.
                        - name: "403"
                          type: long
                          description: Total number of HTTP 403 responses seen by the crawler since the instance start.
                        - name: "404"
                          type: long
                          description: Total number of HTTP 404 responses seen by the crawler since the instance start.
                        - name: "405"
                          type: long
                          description: Total number of HTTP 405 responses seen by the crawler since the instance start.
                        - name: "410"
                          type: long
                          description: Total number of HTTP 410 responses seen by the crawler since the instance start.
                        - name: "422"
                          type: long
                          description: Total number of HTTP 422 responses seen by the crawler since the instance start.
                        - name: "429"
                          type: long
                          description: Total number of HTTP 429 responses seen by the crawler since the instance start.
                        - name: "500"
                          type: long
                          description: Total number of HTTP 500 responses seen by the crawler since the instance start.
                        - name: "501"
                          type: long
                          description: Total number of HTTP 501 responses seen by the crawler since the instance start.
                        - name: "502"
                          type: long
                          description: Total number of HTTP 502 responses seen by the crawler since the instance start.
                        - name: "503"
                          type: long
                          description: Total number of HTTP 503 responses seen by the crawler since the instance start.
                        - name: "504"
                          type: long
                          description: Total number of HTTP 504 responses seen by the crawler since the instance start.
        
                    - name: queue_size
                      type: group
                      description: Total current URL queue size for the instance.
                      fields:
                        - name: primary
                          type: long
                          description: Total number of URLs waiting to be crawled by the instance.
                        - name: purge
                          type: long
                          description: Total number of URLs waiting to be checked by the purge crawl phase.
        
                    - name: active_threads
                      type: long
                      description: Total number of crawler worker threads currently active on the instance.
        
                    - name: workers
                      type: group
                      description: Crawler workers information for the instance.
                      fields:
                        - name: pool_size
                          type: long
                          description: Total size of the crawl workers pool (number of concurrent crawls possible) for the instance.
                        - name: active
                          type: long
                          description: Total number of currently active crawl workers (running crawls) for the instance.
                        - name: available
                          type: long
                          description: Total number of currently available (free) crawl workers for the instance.
        
            - name: product_usage
              type: group
              description: Aggregate product usage statistics for the Enterprise Search deployment.
              fields:
                - name: app_search
                  type: group
                  description: App Search product usage statistics.
                  fields:
                  - name: total_engines
                    type: long
                    description: Current number of App Search engines within the deployment.
        
                - name: workplace_search
                  type: group
                  description: Workplace Search product usage statistics.
                  fields:
                    - name: total_org_sources
                      type: long
                      description: Current number of Workplace Search org-wide content sources within the deployment.
        
                    - name: total_private_sources
                      type: long
                      description: Current number of Workplace Search private content sources within the deployment.
- key: gcp
  title: 'Google Cloud Platform'
  release: ga
  description: >
    GCP module
  fields:
    - name: gcp
      type: group
      fields:
        - name: labels
          type: object
          description: >
            GCP monitoring metrics labels
          fields:
            - name: user.*
              type: object
              object_type: keyword
            - name: metadata.*
              type: object
              object_type: keyword
            - name: metrics.*
              type: object
              object_type: keyword
            - name: system.*
              type: object
              object_type: keyword
            - name: resource.*
              type: object
              object_type: keyword
        - name: "metrics.*.*.*.*"
          type: object
          object_type: double
          object_type_mapping_type: "*"
          description: >
            Metrics that returned from Google Cloud API query.
        - name: billing
          description: Google Cloud Billing metrics
          release: ga
          type: group
          fields:
          - name: cost_type
            type: keyword
            description: Cost types include regular, tax, adjustment, and rounding_error.
          - name: invoice_month
            type: keyword
            description: Billing report month.
          - name: project_id
            type: keyword
            description: Project ID of the billing report belongs to.
          - name: total
            type: float
            description: Total billing amount.
        - name: carbon
          description: Google Cloud Carbon Footprint metrics
          release: beta
          type: group
          fields:
          - name: project_id
            type: keyword
            description: Project ID the carbon footprint report belongs to.
          - name: project_name
            type: keyword
            description: Project name the carbon footprint report belongs to.
          - name: service_id
            type: keyword
            description: Service ID for the carbon footprint usage.
          - name: service_description
            type: keyword
            description: Service description for the carbon footprint usage.
          - name: region
            type: keyword
            description: Region for the carbon fooprint usage.
          - name: footprint.scope1
            type: float
            description: Scope 1 carbon footprint.
          - name: footprint.scope2.location
            type: float
            description: Scope 2 carbon footprint using location-based methodology.
          - name: footprint.scope2.market
            type: float
            description: Scope 2 carbon footprint using market-based methodology.
          - name: footprint.scope3
            type: float
            description: Scope 3 carbon footprint.
          - name: footprint.offsets
            type: float
            description: Total carbon offsets.
        - name: compute
          description: Google Cloud Compute metrics
          release: ga
          type: group
          fields:
          - name: firewall.dropped.bytes
            type: long
            description: Incoming bytes dropped by the firewall
          - name: firewall.dropped_packets_count.value
            type: long
            description: Incoming packets dropped by the firewall
          - name: instance.cpu.reserved_cores.value
            type: double
            description: Number of cores reserved on the host of the instance
          - name: instance.cpu.usage_time.sec
            type: double
            description: Usage for all cores in seconds
          - name: instance.cpu.usage.pct
            type: double
            description: The fraction of the allocated CPU that is currently in use on the instance
          - name: instance.disk.read.bytes
            type: long
            description: Count of bytes read from disk
          - name: instance.disk.read_ops_count.value
            type: long
            description: Count of disk read IO operations
          - name: instance.disk.write.bytes
            type: long
            description: Count of bytes written to disk
          - name: instance.disk.write_ops_count.value
            type: long
            description: Count of disk write IO operations
          - name: instance.memory.balloon.ram_size.value
            type: long
            description: The total amount of memory in the VM. This metric is only available for VMs that belong to the e2 family.
          - name: instance.memory.balloon.ram_used.value
            type: long
            description: Memory currently used in the VM. This metric is only available for VMs that belong to the e2 family.
          - name: instance.memory.balloon.swap_in.bytes
            type: long
            description: The amount of memory read into the guest from its own swap space. This metric is only available for VMs that belong to the e2 family.
          - name: instance.memory.balloon.swap_out.bytes
            type: long
            description: The amount of memory written from the guest to its own swap space. This metric is only available for VMs that belong to the e2 family.
          - name: instance.network.ingress.bytes
            type: long
            description: Count of bytes received from the network
          - name: instance.network.ingress.packets.count
            type: long
            description: Count of packets received from the network
          - name: instance.network.egress.bytes
            type: long
            description: Count of bytes sent over the network
          - name: instance.network.egress.packets.count
            type: long
            description: Count of packets sent over the network
          - name: instance.uptime.sec
            type: long
            description: Number of seconds the VM has been running.
          - name: instance.uptime_total.sec
            type: long
            description: Elapsed time since the VM was started, in seconds. Sampled every 60 seconds. After sampling, data is not visible for up to 120 seconds.
        - name: dataproc
          description: Google Cloud Dataproc metrics
          release: ga
          type: group
          fields:
            - name: cluster.hdfs.datanodes.count
              type: long
              description: Indicates the number of HDFS DataNodes that are running inside a cluster.
            - name: cluster.hdfs.storage_capacity.value
              type: double
              description: Indicates capacity of HDFS system running on cluster in GB.
            - name: cluster.hdfs.storage_utilization.value
              type: double
              description: The percentage of HDFS storage currently used.
            - name: cluster.hdfs.unhealthy_blocks.count
              type: long
              description: Indicates the number of unhealthy blocks inside the cluster.
            - name: cluster.job.failed.count
              type: long
              description: Indicates the number of jobs that have failed on a cluster.
            - name: cluster.job.running.count
              type: long
              description: Indicates the number of jobs that are running on a cluster.
            - name: cluster.job.submitted.count
              type: long
              description: Indicates the number of jobs that have been submitted to a cluster.
            - name: cluster.operation.failed.count
              type: long
              description: Indicates the number of operations that have failed on a cluster.
            - name: cluster.operation.running.count
              type: long
              description: Indicates the number of operations that are running on a cluster.
            - name: cluster.operation.submitted.count
              type: long
              description: Indicates the number of operations that have been submitted to a cluster.
            - name: cluster.yarn.allocated_memory_percentage.value
              type: double
              description: The percentage of YARN memory is allocated.
            - name: cluster.yarn.apps.count
              type: long
              description: Indicates the number of active YARN applications.
            - name: cluster.yarn.containers.count
              type: long
              description: Indicates the number of YARN containers.
            - name: cluster.yarn.memory_size.value
              type: double
              description: Indicates the YARN memory size in GB.
            - name: cluster.yarn.nodemanagers.count
              type: long
              description: Indicates the number of YARN NodeManagers running inside cluster.
            - name: cluster.yarn.pending_memory_size.value
              type: double
              description: The current memory request, in GB, that is pending to be fulfilled by the scheduler.
            - name: cluster.yarn.virtual_cores.count
              type: long
              description: Indicates the number of virtual cores in YARN.
            - name: cluster.job.completion_time.value
              type: object
              object_type: histogram
              description: The time jobs took to complete from the time the user submits a job to the time Dataproc reports it is completed.
            - name: cluster.job.duration.value
              type: object
              object_type: histogram
              description: The time jobs have spent in a given state.
            - name: cluster.operation.completion_time.value
              type: object
              object_type: histogram
              description: The time operations took to complete from the time the user submits a operation to the time Dataproc reports it is completed.
            - name: cluster.operation.duration.value
              type: object
              object_type: histogram
              description: The time operations have spent in a given state.
        - name: firestore
          description: Google Cloud Firestore metrics
          release: ga
          type: group
          fields:
            - name: document.delete.count
              type: long
              description: The number of successful document deletes.
            - name: document.read.count
              type: long
              description: The number of successful document reads from queries or lookups.
            - name: document.write.count
              type: long
              description: The number of successful document writes.
        - name: gke
          description: '`gke` contains the metrics that we scraped from GCP Stackdriver API containing monitoring metrics for GCP GKE'
          release: ga
          type: group
          fields:
          - name: container.cpu.core_usage_time.sec
            type: double
            description: Cumulative CPU usage on all cores used by the container in seconds. Sampled every 60 seconds.
          - name: container.cpu.limit_cores.value
            type: double
            description: CPU cores limit of the container. Sampled every 60 seconds.
          - name: container.cpu.limit_utilization.pct
            type: double
            description: The fraction of the CPU limit that is currently in use on the instance. This value cannot exceed 1 as usage cannot exceed the limit. Sampled every 60 seconds. After sampling, data is not visible for up to 240 seconds.
          - name: container.cpu.request_cores.value
            type: double
            description: Number of CPU cores requested by the container. Sampled every 60 seconds. After sampling, data is not visible for up to 120 seconds.
          - name: container.cpu.request_utilization.pct
            type: double
            description: The fraction of the requested CPU that is currently in use on the instance. This value can be greater than 1 as usage can exceed the request. Sampled every 60 seconds. After sampling, data is not visible for up to 240 seconds.
          - name: container.ephemeral_storage.limit.bytes
            type: long
            description: Local ephemeral storage limit in bytes. Sampled every 60 seconds.
          - name: container.ephemeral_storage.request.bytes
            type: long
            description: Local ephemeral storage request in bytes. Sampled every 60 seconds.
          - name: container.ephemeral_storage.used.bytes
            type: long
            description: Local ephemeral storage usage in bytes. Sampled every 60 seconds.
          - name: container.memory.limit.bytes
            type: long
            description: Memory limit of the container in bytes. Sampled every 60 seconds.
          - name: container.memory.limit_utilization.pct
            type: double
            description: The fraction of the memory limit that is currently in use on the instance. This value cannot exceed 1 as usage cannot exceed the limit. Sampled every 60 seconds. After sampling, data is not visible for up to 120 seconds.
          - name: container.memory.page_fault.count
            type: long
            description: Number of page faults, broken down by type, major and minor.
          - name: container.memory.request.bytes
            type: long
            description: Memory request of the container in bytes. Sampled every 60 seconds. After sampling, data is not visible for up to 120 seconds.
          - name: container.memory.request_utilization.pct
            type: double
            description: The fraction of the requested memory that is currently in use on the instance. This value can be greater than 1 as usage can exceed the request. Sampled every 60 seconds. After sampling, data is not visible for up to 240 seconds.
          - name: container.memory.used.bytes
            type: long
            description: Memory usage in bytes. Sampled every 60 seconds.
          - name: container.restart.count
            type: long
            description: Number of times the container has restarted. Sampled every 60 seconds. After sampling, data is not visible for up to 120 seconds.
          - name: container.uptime.sec
            type: double
            description: Time in seconds that the container has been running. Sampled every 60 seconds.
          - name: node.cpu.allocatable_cores.value
            type: double
            description: Number of allocatable CPU cores on the node. Sampled every 60 seconds.
          - name: node.cpu.allocatable_utilization.pct
            type: double
            description: The fraction of the allocatable CPU that is currently in use on the instance. Sampled every 60 seconds. After sampling, data is not visible for up to 240 seconds.
          - name: node.cpu.core_usage_time.sec
            type: double
            description: Cumulative CPU usage on all cores used on the node in seconds. Sampled every 60 seconds.
          - name: node.cpu.total_cores.value
            type: double
            description: Total number of CPU cores on the node. Sampled every 60 seconds.
          - name: node.ephemeral_storage.allocatable.bytes
            type: long
            description: Local ephemeral storage bytes allocatable on the node. Sampled every 60 seconds.
          - name: node.ephemeral_storage.inodes_free.value
            type: long
            description: Free number of inodes on local ephemeral storage. Sampled every 60 seconds.
          - name: node.ephemeral_storage.inodes_total.value
            type: long
            description: Total number of inodes on local ephemeral storage. Sampled every 60 seconds.
          - name: node.ephemeral_storage.total.bytes
            type: long
            description: Total ephemeral storage bytes on the node. Sampled every 60 seconds.
          - name: node.ephemeral_storage.used.bytes
            type: long
            description: Local ephemeral storage bytes used by the node. Sampled every 60 seconds.
          - name: node.memory.allocatable.bytes
            type: long
            description: Cumulative memory bytes used by the node. Sampled every 60 seconds.
          - name: node.memory.allocatable_utilization.pct
            type: double
            description: The fraction of the allocatable memory that is currently in use on the instance. This value cannot exceed 1 as usage cannot exceed allocatable memory bytes. Sampled every 60 seconds. After sampling, data is not visible for up to 120 seconds.
          - name: node.memory.total.bytes
            type: long
            description: Number of bytes of memory allocatable on the node. Sampled every 60 seconds.
          - name: node.memory.used.bytes
            type: long
            description: Cumulative memory bytes used by the node. Sampled every 60 seconds.
          - name: node.network.received_bytes.count
            type: long
            description: Cumulative number of bytes received by the node over the network. Sampled every 60 seconds.
          - name: node.network.sent_bytes.count
            type: long
            description: Cumulative number of bytes transmitted by the node over the network. Sampled every 60 seconds.
          - name: node.pid_limit.value
            type: long
            description: The max PID of OS on the node. Sampled every 60 seconds.
          - name: node.pid_used.value
            type: long
            description: The number of running process in the OS on the node. Sampled every 60 seconds.
          - name: node_daemon.cpu.core_usage_time.sec
            type: double
            description: Cumulative CPU usage on all cores used by the node level system daemon in seconds. Sampled every 60 seconds.
          - name: node_daemon.memory.used.bytes
            type: long
            description: Memory usage by the system daemon in bytes. Sampled every 60 seconds.
          - name: pod.network.received.bytes
            type: long
            description: Cumulative number of bytes received by the pod over the network. Sampled every 60 seconds.
          - name: pod.network.sent.bytes
            type: long
            description: Cumulative number of bytes transmitted by the pod over the network. Sampled every 60 seconds.
          - name: pod.volume.total.bytes
            type: long
            description: Total number of disk bytes available to the pod. Sampled every 60 seconds. After sampling, data is not visible for up to 120 seconds.
          - name: pod.volume.used.bytes
            type: long
            description: Number of disk bytes used by the pod. Sampled every 60 seconds.
          - name: pod.volume.utilization.pct
            type: double
            description: The fraction of the volume that is currently being used by the instance. This value cannot be greater than 1 as usage cannot exceed the total available volume space. Sampled every 60 seconds. After sampling, data is not visible for up to 120 seconds.
        - name: loadbalancing
          description: Google Cloud Load Balancing metrics
          release: ga
          type: group
          fields:
          - name: https.backend_request.bytes
            type: long
            description: The number of bytes sent as requests from HTTP/S load balancer to backends.
          - name: https.backend_request.count
            type: long
            description: The number of requests served by backends of HTTP/S load balancer.
          - name: https.backend_response.bytes
            type: long
            description: The number of bytes sent as responses from backends (or cache) to external HTTP(S) load balancer.
          - name: https.request.bytes
            type: long
            description: The number of bytes sent as requests from clients to HTTP/S load balancer.
          - name: https.request.count
            type: long
            description: The number of requests served by HTTP/S load balancer.
          - name: https.response.bytes
            type: long
            description: The number of bytes sent as responses from HTTP/S load balancer to clients.
          - name: l3.external.egress.bytes
            type: long
            description: The number of bytes sent from external TCP/UDP network load balancer backend to client of the flow. For TCP flows it's counting bytes on application stream only.
          - name: l3.external.egress_packets.count
            type: long
            description: The number of packets sent from external TCP/UDP network load balancer backend to client of the flow.
          - name: l3.external.ingress.bytes
            type: long
            description: The number of bytes sent from client to external TCP/UDP network load balancer backend. For TCP flows it's counting bytes on application stream only.
          - name: l3.external.ingress_packets.count
            type: long
            description: The number of packets sent from client to external TCP/UDP network load balancer backend.
          - name: l3.internal.egress.bytes
            type: long
            description: The number of bytes sent from ILB backend to client (for TCP flows it's counting bytes on application stream only).
          - name: l3.internal.egress_packets.count
            type: long
            description: The number of packets sent from ILB backend to client of the flow.
          - name: l3.internal.ingress.bytes
            type: long
            description: The number of bytes sent from client to ILB backend (for TCP flows it's counting bytes on application stream only).
          - name: l3.internal.ingress_packets.count
            type: long
            description: The number of packets sent from client to ILB backend.
          - name: tcp_ssl_proxy.closed_connections.value
            type: long
            description: Number of connections that were terminated over TCP/SSL proxy.
          - name: tcp_ssl_proxy.egress.bytes
            type: long
            description: Number of bytes sent from VM to client using proxy.
          - name: tcp_ssl_proxy.ingress.bytes
            type: long
            description: Number of bytes sent from client to VM using proxy.
          - name: tcp_ssl_proxy.new_connections.value
            type: long
            description: Number of connections that were created over TCP/SSL proxy.
          - name: tcp_ssl_proxy.open_connections.value
            type: long
            description: Current number of outstanding connections through the TCP/SSL proxy.
          - name: https.backend_latencies.value
            type: object
            object_type: histogram
            description: A distribution of the latency calculated from when the request was sent by the proxy to the backend until the proxy received from the backend the last byte of response.
          - name: https.external.regional.backend_latencies.value
            type: object
            object_type: histogram
            description: A distribution of the latency calculated from when the request was sent by the proxy to the backend until the proxy received from the backend the last byte of response.
          - name: https.external.regional.total_latencies.value
            type: object
            object_type: histogram
            description: A distribution of the latency calculated from when the request was received by the proxy until the proxy got ACK from client on last response byte.
          - name: https.frontend_tcp_rtt.value
            type: object
            object_type: histogram
            description: A distribution of the RTT measured for each connection between client and proxy.
          - name: https.internal.backend_latencies.value
            type: object
            object_type: histogram
            description: A distribution of the latency calculated from when the request was sent by the internal HTTP/S load balancer proxy to the backend until the proxy received from the backend the last byte of response. 
          - name: https.internal.total_latencies.value
            type: object
            object_type: histogram
            description: A distribution of the latency calculated from when the request was received by the internal HTTP/S load balancer proxy until the proxy got ACK from client on last response byte.
          - name: https.total_latencies.value
            type: object
            object_type: histogram
            description: A distribution of the latency calculated from when the request was received by the external HTTP/S load balancer proxy until the proxy got ACK from client on last response byte.
          - name: l3.external.rtt_latencies.value
            type: object
            object_type: histogram
            description: A distribution of the round trip time latency, measured over TCP connections for the external network load balancer.
          - name: l3.internal.rtt_latencies.value
            type: object
            object_type: histogram
            description: A distribution of RTT measured over TCP connections for internal TCP/UDP load balancer flows.
          - name: tcp_ssl_proxy.frontend_tcp_rtt.value
            type: object
            object_type: histogram
            description: A distribution of the smoothed RTT (in ms) measured by the proxy's TCP stack, each minute application layer bytes pass from proxy to client.
        - release: ga
          key: metrics
          type: group
          description: Google Cloud Compute metrics
          fields:
        - name: pubsub
          description: Google Cloud PubSub metrics
          release: ga
          type: group
          fields:
          - name: snapshot.backlog.bytes
            type: long
            description: Total byte size of the messages retained in a snapshot.
          - name: snapshot.backlog_bytes_by_region.bytes
            type: long
            description: Total byte size of the messages retained in a snapshot, broken down by Cloud region.
          - name: snapshot.config_updates.count
            type: long
            description: Cumulative count of configuration changes, grouped by operation type and result.
          - name: snapshot.num_messages.value
            type: long
            description: Number of messages retained in a snapshot.
          - name: snapshot.num_messages_by_region.value
            type: long
            description: Number of messages retained in a snapshot, broken down by Cloud region.
          - name: snapshot.oldest_message_age.sec
            type: long
            description: Age (in seconds) of the oldest message retained in a snapshot.
          - name: snapshot.oldest_message_age_by_region.sec
            type: long
            description: Age (in seconds) of the oldest message retained in a snapshot, broken down by Cloud region.
          - name: subscription.ack_message.count
            type: long
            description: Cumulative count of messages acknowledged by Acknowledge requests, grouped by delivery type.
          - name: subscription.backlog.bytes
            type: long
            description: Total byte size of the unacknowledged messages (a.k.a. backlog messages) in a subscription.
          - name: subscription.byte_cost.bytes
            type: long
            description: Cumulative cost of operations, measured in bytes. This is used to measure quota utilization.
          - name: subscription.config_updates.count
            type: long
            description: Cumulative count of configuration changes for each subscription, grouped by operation type and result.
          - name: subscription.dead_letter_message.count
            type: long
            description: Cumulative count of messages published to dead letter topic, grouped by result.
          - name: subscription.mod_ack_deadline_message.count
            type: long
            description: Cumulative count of messages whose deadline was updated by ModifyAckDeadline requests, grouped by delivery type.
          - name: subscription.mod_ack_deadline_message_operation.count
            type: long
            description: Cumulative count of ModifyAckDeadline message operations, grouped by result.
          - name: subscription.mod_ack_deadline_request.count
            type: long
            description: Cumulative count of ModifyAckDeadline requests, grouped by result.
          - name: subscription.num_outstanding_messages.value
            type: long
            description: Number of messages delivered to a subscription's push endpoint, but not yet acknowledged.
          - name: subscription.num_undelivered_messages.value
            type: long
            description: Number of unacknowledged messages (a.k.a. backlog messages) in a subscription.
          - name: subscription.oldest_retained_acked_message_age.sec
            type: long
            description: Age (in seconds) of the oldest acknowledged message retained in a subscription.
          - name: subscription.oldest_retained_acked_message_age_by_region.value
            type: long
            description: Age (in seconds) of the oldest acknowledged message retained in a subscription, broken down by Cloud region.
          - name: subscription.oldest_unacked_message_age.sec
            type: long
            description: Age (in seconds) of the oldest unacknowledged message (a.k.a. backlog message) in a subscription.
          - name: subscription.oldest_unacked_message_age_by_region.value
            type: long
            description: Age (in seconds) of the oldest unacknowledged message in a subscription, broken down by Cloud region.
          - name: subscription.pull_ack_message_operation.count
            type: long
            description: Cumulative count of acknowledge message operations, grouped by result. For a definition of message operations, see Cloud Pub/Sub metric subscription/mod_ack_deadline_message_operation_count.
          - name: subscription.pull_ack_request.count
            type: long
            description: Cumulative count of acknowledge requests, grouped by result.
          - name: subscription.pull_message_operation.count
            type: long
            description: Cumulative count of pull message operations, grouped by result. For a definition of message operations, see Cloud Pub/Sub metric subscription/mod_ack_deadline_message_operation_count.
          - name: subscription.pull_request.count
            type: long
            description: Cumulative count of pull requests, grouped by result.
          - name: subscription.push_request.count
            type: long
            description: Cumulative count of push attempts, grouped by result. Unlike pulls, the push server implementation does not batch user messages. So each request only contains one user message. The push server retries on errors, so a given user message can appear multiple times.
          - name: subscription.retained_acked.bytes
            type: long
            description: Total byte size of the acknowledged messages retained in a subscription.
          - name: subscription.retained_acked_bytes_by_region.bytes
            type: long
            description: Total byte size of the acknowledged messages retained in a subscription, broken down by Cloud region.
          - name: subscription.seek_request.count
            type: long
            description: Cumulative count of seek attempts, grouped by result.
          - name: subscription.sent_message.count
            type: long
            description: Cumulative count of messages sent by Cloud Pub/Sub to subscriber clients, grouped by delivery type.
          - name: subscription.streaming_pull_ack_message_operation.count
            type: long
            description: Cumulative count of StreamingPull acknowledge message operations, grouped by result. For a definition of message operations, see Cloud Pub/Sub metric subscription/mod_ack_deadline_message_operation_count.
          - name: subscription.streaming_pull_ack_request.count
            type: long
            description: Cumulative count of streaming pull requests with non-empty acknowledge ids, grouped by result.
          - name: subscription.streaming_pull_message_operation.count
            type: long
            description: Cumulative count of streaming pull message operations, grouped by result. For a definition of message operations, see Cloud Pub/Sub metric <code>subscription/mod_ack_deadline_message_operation_count
          - name: subscription.streaming_pull_mod_ack_deadline_message_operation.count
            type: long
            description: Cumulative count of StreamingPull ModifyAckDeadline operations, grouped by result.
          - name: subscription.streaming_pull_mod_ack_deadline_request.count
            type: long
            description: Cumulative count of streaming pull requests with non-empty ModifyAckDeadline fields, grouped by result.
          - name: subscription.streaming_pull_response.count
            type: long
            description: Cumulative count of streaming pull responses, grouped by result.
          - name: subscription.unacked_bytes_by_region.bytes
            type: long
            description: Total byte size of the unacknowledged messages in a subscription, broken down by Cloud region.
          - name: topic.byte_cost.bytes
            type: long
            description: Cost of operations, measured in bytes. This is used to measure utilization for quotas.
          - name: topic.config_updates.count
            type: long
            description: Cumulative count of configuration changes, grouped by operation type and result.
          - name: topic.message_sizes.bytes
            type: object
            object_type: histogram
            description: Distribution of publish message sizes (in bytes)
          - name: topic.oldest_retained_acked_message_age_by_region.value
            type: long
            description: Age (in seconds) of the oldest acknowledged message retained in a topic, broken down by Cloud region.
          - name: topic.oldest_unacked_message_age_by_region.value
            type: long
            description: Age (in seconds) of the oldest unacknowledged message in a topic, broken down by Cloud region.
          - name: topic.retained_acked_bytes_by_region.bytes
            type: long
            description: Total byte size of the acknowledged messages retained in a topic, broken down by Cloud region.
          - name: topic.send_message_operation.count
            type: long
            description: Cumulative count of publish message operations, grouped by result. For a definition of message operations, see Cloud Pub/Sub metric subscription/mod_ack_deadline_message_operation_count.
          - name: topic.send_request.count
            type: long
            description: Cumulative count of publish requests, grouped by result.
          - name: topic.streaming_pull_response.count
            type: long
            description: Cumulative count of streaming pull responses, grouped by result.
          - name: topic.unacked_bytes_by_region.bytes
            type: long
            description: Total byte size of the unacknowledged messages in a topic, broken down by Cloud region.
          - name: subscription.ack_latencies.value
            type: object
            object_type: histogram
            description: Distribution of ack latencies in milliseconds. The ack latency is the time between when Cloud Pub/Sub sends a message to a subscriber client and when Cloud Pub/Sub receives an Acknowledge request for that message.
          - name: subscription.push_request_latencies.value
            type: object
            object_type: histogram
            description: Distribution of push request latencies (in microseconds), grouped by result.
        - name: storage
          description: Google Cloud Storage metrics
          release: ga
          type: group
          fields:
          - name: api.request.count
            type: long
            description: Delta count of API calls, grouped by the API method name and response code.
          - name: authz.acl_based_object_access.count
            type: long
            description: Delta count of requests that result in an object being granted access solely due to object ACLs.
          - name: authz.acl_operations.count
            type: long
            description: Usage of ACL operations broken down by type.
          - name: authz.object_specific_acl_mutation.count
            type: long
            description: Delta count of changes made to object specific ACLs.
          - name: network.received.bytes
            type: long
            description: Delta count of bytes received over the network, grouped by the API method name and response code.
          - name: network.sent.bytes
            type: long
            description: Delta count of bytes sent over the network, grouped by the API method name and response code.
          - name: storage.object.count
            type: long
            description: Total number of objects per bucket, grouped by storage class. This value is measured once per day, and the value is repeated at each sampling interval throughout the day.
          - name: storage.total_byte_seconds.bytes
            type: long
            description: Delta count of bytes received over the network, grouped by the API method name and response code.
          - name: storage.total.bytes
            type: long
            description: Total size of all objects in the bucket, grouped by storage class. This value is measured once per day, and the value is repeated at each sampling interval throughout the day.
- key: ibmmq
  title: 'IBM MQ'
  release: beta
  description: >
    IBM MQ module
  settings: ["ssl", "http"]
  fields:
    - name: ibmmq
      type: group
      fields:
        - release: beta
- key: iis
  title: "IIS"
  description: >
    iis module
  release: ga

  fields:
    - name: iis
      type: group
      description: >
      fields:
        - name: application_pool
          type: group
          release: ga
          description: >
            Application pool process stats.
          fields:
            - name: name
              type: keyword
              description: >
                application pool name
            - name: process
              type: group
              description: >
                Worker process overview.
              fields:
                - name: handle_count
                  type: long
                  description: >
                    The number of handles.
                - name: io_read_operations_per_sec
                  type: float
                  description: >
                    IO read operations per sec.
                - name: io_write_operations_per_sec
                  type: float
                  description: >
                    IO write operations per sec.
                - name: virtual_bytes
                  type: float
                  description: >
                    Memory virtual bytes.
                - name: cpu_usage_perc
                  type: float
                  description: >
                   The CPU usage percentage.
                - name: thread_count
                  type: long
                  description: >
                    The number of threats.
                - name: working_set
                  type: float
                  description: >
                    Memory working set.
                - name: private_bytes
                  type: float
                  description: >
                    Memory private bytes.
                - name: page_faults_per_sec
                  type: float
                  description: >
                    Memory page faults.
            - name: net_clr
              type: group
              description: >
                Common Language Runtime overview.
              fields:
                - name: finallys_per_sec
                  type: float
                  description: >
                    The number of finallys per sec.
                - name: throw_to_catch_depth_per_sec
                  type: float
                  description: >
                    Throw to catch depth count per sec.
                - name: total_exceptions_thrown
                  type: long
                  description: >
                    Total number of exceptions thrown.
                - name: filters_per_sec
                  type: float
                  description: >
                    Number of filters per sec.
        - name: webserver
          type: group
          release: ga
          description: >
            Webserver related metrics.
          fields:
            - name: process
              type: group
              description: >
                The process related stats.
              fields:
                - name: cpu_usage_perc
                  type: float
                  description: >
                    The CPU usage percentage.
                - name: handle_count
                  type: float
                  description: >
                    The number of handles.
                - name: virtual_bytes
                  type: float
                  description: >
                    Memory virtual bytes.
                - name: thread_count
                  type: long
                  description: >
                    The number of threads.
                - name: working_set
                  type: float
                  description: >
                    Memory working set.
                - name: private_bytes
                  type: float
                  description: >
                    Memory private bytes.
                - name: worker_process_count
                  type: float
                  description: >
                    Number of worker processes running.
                - name: page_faults_per_sec
                  type: float
                  description: >
                    Memory page faults.
                - name: io_read_operations_per_sec
                  type: float
                  description: >
                    IO read operations per sec.
                - name: io_write_operations_per_sec
                  type: float
                  description: >
                    IO write operations per sec.
            - name: asp_net
              type: group
              description: >
                Common Language Runtime overview.
              fields:
                - name: application_restarts
                  type: float
                  description: >
                    Number of applications restarts.
                - name: request_wait_time
                  type: long
                  description: >
                    Request wait time.
            - name: asp_net_application
              type: group
              description: >
               ASP.NET application overview.
              fields:
                - name: errors_total_per_sec
                  type: float
                  description: >
                    Total number of errors per sec.
                - name: pipeline_instance_count
                  type: float
                  description: >
                   The pipeline instance count.
                - name: requests_per_sec
                  type: float
                  description: >
                    Number of requests per sec.
                - name: requests_executing
                  type: float
                  description: >
                    Number of requests executing.
                - name: requests_in_application_queue
                  type: float
                  description: >
                    Number of requests in the application queue.
            - name: cache
              type: group
              description: >
                The cache overview.
              fields:
                - name: current_file_cache_memory_usage
                  type: float
                  description: >
                    The current file cache memory usage size.
                - name: current_files_cached
                  type: float
                  description: >
                    The number of current files cached.
                - name: current_uris_cached
                  type: float
                  description: >
                    The number of current uris cached.
                - name: file_cache_hits
                  type: float
                  description: >
                    The number of file cache hits.
                - name: file_cache_misses
                  type: float
                  description: >
                    The number of file cache misses.
                - name: maximum_file_cache_memory_usage
                  type: float
                  description: >
                    The max file cache size.
                - name: output_cache_current_items
                  type: float
                  description: >
                    The number of output cache current items.
                - name: output_cache_current_memory_usage
                  type: float
                  description: >
                    The output cache memory usage size.
                - name: output_cache_total_hits
                  type: float
                  description: >
                    The output cache total hits count.
                - name: output_cache_total_misses
                  type: float
                  description: >
                    The output cache total misses count.
                - name: total_files_cached
                  type: float
                  description: >
                    the total number of files cached.
                - name: total_uris_cached
                  type: float
                  description: >
                    The total number of URIs cached.
                - name: uri_cache_hits
                  type: float
                  description: >
                    The number of URIs cached hits.
                - name: uri_cache_misses
                  type: float
                  description: >
                    The number of URIs cache misses.
            - name: network
              type: group
              description: >
                The network related stats.
              fields:
                - name: anonymous_users_per_sec
                  type: float
                  description: >
                    The number of anonymous users per sec.
                - name: bytes_received_per_sec
                  type: float
                  description: >
                    The size of bytes received per sec.
                - name: bytes_sent_per_sec
                  type: float
                  description: >
                    The size of bytes sent per sec.
                - name: current_anonymous_users
                  type: float
                  description: >
                    The number of current anonymous users.
                - name: current_connections
                  type: float
                  description: >
                    The number of current connections.
                - name: current_non_anonymous_users
                  type: float
                  description: >
                    The number of current non anonymous users.
                - name: delete_requests_per_sec
                  type: float
                  description: >
                    Number of DELETE requests per sec.
                - name: get_requests_per_sec
                  type: float
                  description: >
                    Number of GET requests per sec.
                - name: maximum_connections
                  type: float
                  description: >
                    Number of maximum connections.
                - name: post_requests_per_sec
                  type: float
                  description: >
                    Number of POST requests per sec.
                - name: service_uptime
                  type: float
                  description: >
                    Service uptime.
                - name: total_anonymous_users
                  type: float
                  description: >
                    Total number of anonymous users.
                - name: total_bytes_received
                  type: float
                  description: >
                    Total size of bytes received.
                - name: total_bytes_sent
                  type: float
                  description: >
                    Total size of bytes sent.
                - name: total_connection_attempts
                  type: float
                  description: >
                    The total number of connection attempts.
                - name: total_delete_requests
                  type: float
                  description: >
                    The total number of DELETE requests.
                - name: total_get_requests
                  type: float
                  description: >
                    The total number of GET requests.
                - name: total_non_anonymous_users
                  type: float
                  description: >
                    The total number of non anonymous users.
                - name: total_post_requests
                  type: float
                  description: >
                    The total number of POST requests.
        - name: website
          type: group
          release: ga
          description: >
            Website related metrics.
          fields:
            - name: name
              type: keyword
              description: >
                website name
            - name: network
              type: group
              description: >
                The network overview.
              fields:
                - name: bytes_received_per_sec
                  type: float
                  description: >
                    The bytes received per sec size.
                - name: bytes_sent_per_sec
                  type: float
                  description: >
                    The bytes sent per sec size.
                - name: current_connections
                  type: float
                  description: >
                    The number of current connections.
                - name: delete_requests_per_sec
                  type: float
                  description: >
                    The number of DELETE requests per sec.
                - name: get_requests_per_sec
                  type: float
                  description: >
                    The number of GET requests per sec.
                - name: maximum_connections
                  type: float
                  description: >
                    The number of maximum connections.
                - name: post_requests_per_sec
                  type: float
                  description: >
                    The number of POST requests per sec.
                - name: put_requests_per_sec
                  type: float
                  description: >
                    The number of PUT requests per sec.
                - name: service_uptime
                  type: float
                  description: >
                    The service uptime.
                - name: total_bytes_received
                  type: float
                  description: >
                    The total number of bytes received.
                - name: total_bytes_sent
                  type: float
                  description: >
                    The  total number of bytes sent.
                - name: total_connection_attempts
                  type: float
                  description: >
                    The total number of connection attempts.
                - name: total_delete_requests
                  type: float
                  description: >
                    The total number of DELETE requests.
                - name: total_get_requests
                  type: float
                  description: >
                    The total number of GET requests.
                - name: total_post_requests
                  type: float
                  description: >
                    The total number of POST requests.
                - name: total_put_requests
                  type: float
                  description: >
                    The total number of PUT requests.
- key: istio
  title: "Istio"
  description: >
    istio Module
  release: beta
  settings: ["ssl", "http"]
  fields:
    - name: istio
      type: group
      description: >
        `istio` contains statistics that were read from Istio
      fields:
        - name: citadel
          type: group
          description: >
            Contains statistics related to the Istio Citadel service
          release: beta
          fields:
            - name: grpc.method
              type: keyword
              description: >
                The grpc method
            - name: grpc.service
              type: keyword
              description: >
                The grpc service
            - name: grpc.type
              type: keyword
              description: >
                The type of the respective grpc service
        
            - name: secret_controller_svc_acc_created_cert.count
              type: long
              description: >
                The number of certificates created due to service account creation.
            - name: server_root_cert_expiry_seconds
              type: float
              description: >
                The unix timestamp, in seconds, when Citadel root cert will expire. We set it to negative in case of internal error.
            - name: grpc.server.handled
              type: long
              description: >
                Total number of RPCs completed on the server, regardless of success or failure.
            - name: grpc.server.msg.received
              type: long
              description: >
                Total number of RPC stream messages received on the server.
            - name: grpc.server.msg.sent
              type: long
              description: >
                Total number of gRPC stream messages sent by the server.
            - name: grpc.server.started
              type: long
              description: >
                Total number of RPCs started on the server.
        
            - name: grpc.server.handling.latency.ms.bucket.*
              type: object
              object_type: long
              description: >
                The response latency (milliseconds) of gRPC that had been application-level handled by the server.
            - name: grpc.server.handling.latency.ms.sum
              type: long
              format: duration
              description: >
                The response latency of gRPC, sum of latencies in milliseconds
            - name: grpc.server.handling.latency.ms.count
              type: long
              description: >
                The response latency of gRPC, number of metrics
        
        - name: galley
          type: group
          description: >
            Contains statistics related to the Istio galley service
          release: beta
          fields:
            - name: name
              type: keyword
              description: >
                The name of the resource the metric is related to
            - name: namespace
              type: keyword
              description: >
                The Kubernetes namespace of the resource
            - name: version
              type: keyword
              description: >
                The version of the object
            - name: collection
              type: keyword
              description: >
                The collection of the instance
        
            - name: istio.authentication.meshpolicies
              type: long
              description: >
                The number of valid istio/authentication/meshpolicies known to galley at a point in time
            - name: istio.authentication.policies
              type: long
              description: >
                The number of valid istio/authentication/policies known to galley at a point in time
            - name: istio.mesh.MeshConfig
              type: long
              description: >
                The number of valid istio/mesh/MeshConfig known to galley at a point in time
            - name: istio.networking.destinationrules
              type: long
              description: >
                The number of valid istio/networking/destinationrules known to galley at a point in time
            - name: istio.networking.envoyfilters
              type: long
              description: >
                The number of valid istio/networking/envoyfilters known to galley at a point in time
            - name: istio.networking.gateways
              type: long
              description: >
                The number of valid istio/networking/gateways known to galley at a point in time
            - name: istio.networking.sidecars
              type: long
              description: >
                The number of valid istio/networking/sidecars known to galley at a point in time
            - name: istio.networking.virtualservices
              type: long
              description: >
                The number of valid istio/networking/virtualservices known to galley at a point in time
            - name: istio.policy.attributemanifests
              type: long
              description: >
                The number of valid istio/policy/attributemanifests known to galley at a point in time
            - name: istio.policy.handlers
              type: long
              description: >
                The number of valid istio/policy/handlers known to galley at a point in time
            - name: istio.policy.instances
              type: long
              description: >
                The number of valid istio/policy/instances known to galley at a point in time
            - name: istio.policy.rules
              type: long
              description: >
                The number of valid istio/policy/rules known to galley at a point in time
        
        
            - name: runtime.processor.event_span.duration.ms.bucket.*
              type: object
              object_type: long
              description: >
                The duration between each incoming event as histogram buckets in milliseconds
            - name: runtime.processor.event_span.duration.ms.sum
              type: long
              format: duration
              description: >
                The duration between each incoming event, sum of durations in milliseconds
            - name: runtime.processor.event_span.duration.ms.count
              type: long
              description: >
                The duration between each incoming event, number of metrics
        
            - name: runtime.processor.snapshot_events.bucket.*
              type: object
              object_type: long
              description: >
                The number of events that have been processed as histogram buckets
            - name: runtime.processor.snapshot_events.sum
              type: long
              description: >
                The number of events that have been processed, sum of events
            - name: runtime.processor.snapshot_events.count
              type: long
              description: >
                The duration between each incoming event, number of metrics
        
            - name: runtime.processor.snapshot_lifetime.duration.ms.bucket.*
              type: object
              object_type: long
              description: >
                The duration of each snapshot as histogram buckets in milliseconds
            - name: runtime.processor.snapshot_lifetime.duration.ms.sum
              type: long
              format: duration
              description: >
                The duration of each snapshot, sum of durations in milliseconds
            - name: runtime.processor.snapshot_lifetime.duration.ms.count
              type: long
              description: >
                The duration of each snapshot, number of metrics
        
            - name: runtime.state_type_instances
              type: long
              description: >
                The number of type instances per type URL
            - name: runtime.strategy.on_change
              type: long
              description: >
                The number of times the strategy's onChange has been called
            - name: runtime.strategy.timer_quiesce_reached
              type: long
              description: >
                The number of times a quiesce has been reached
            - name: source_kube_event_success_total
              type: long
              description: >
                The number of times a kubernetes source successfully handled an event
            - name: validation.cert_key.updates
              type: long
              description: >
                Galley validation webhook certificate updates
            - name: validation.config.load
              type: long
              description: >
                k8s webhook configuration (re)loads
            - name: validation.config.updates
              type: long
              description: >
                k8s webhook configuration updates
        - name: istiod
          type: group
          release: beta
          fields:
        - name: mesh
          type: group
          description: >
            Contains statistics related to the Istio mesh service
          release: beta
          fields:
            - name: instance
              type: text
              description: >
                The prometheus instance
            - name: job
              type: keyword
              description: >
                The prometheus job
            - name: requests
              type: long
              description: >
                Total requests handled by an Istio proxy
            - name: request.duration.ms.bucket.*
              type: object
              object_type: long
              description: >
                Request duration histogram buckets in milliseconds
            - name: request.duration.ms.sum
              type: long
              format: duration
              description: >
                Requests duration, sum of durations in milliseconds
            - name: request.duration.ms.count
              type: long
              description: >
                Requests duration, number of requests
            - name: request.size.bytes.bucket.*
              type: object
              object_type: long
              description: >
                Request Size histogram buckets
            - name: request.size.bytes.sum
              type: long
              description: >
                Request Size histogram sum
            - name: request.size.bytes.count
              type: long
              description: >
                Request Size histogram count
        
            - name: response.size.bytes.bucket.*
              type: object
              object_type: long
              description: >
                Request Size histogram buckets
            - name: response.size.bytes.sum
              type: long
              description: >
                Request Size histogram sum
            - name: response.size.bytes.count
              type: long
              description: >
                Request Size histogram count
        
            - name: reporter
              type: keyword
              description: >
                Reporter identifies the reporter of the request. It is set to destination if report is from a server Istio proxy and source if report is from a client Istio proxy.
            - name: source.workload.name
              type: keyword
              description: >
                This identifies the name of source workload which controls the source.
            - name: source.workload.namespace
              type: keyword
              description: >
                This identifies the namespace of the source workload.
            - name: source.principal
              type: keyword
              description: >
                This identifies the peer principal of the traffic source. It is set when peer authentication is used.
            - name: source.app
              type: keyword
              description: >
                This identifies the source app based on app label of the source workload.
            - name: source.version
              type: keyword
              description: >
                This identifies the version of the source workload.
        
            - name: destination.workload.name
              type: keyword
              description: >
                This identifies the name of destination workload.
            - name: destination.workload.namespace
              type: keyword
              description: >
                This identifies the namespace of the destination workload.
            - name: destination.principal
              type: keyword
              description: >
                This identifies the peer principal of the traffic destination. It is set when peer authentication is used.
            - name: destination.app
              type: keyword
              description: >
                This identifies the destination app based on app label of the destination workload..
            - name: destination.version
              type: keyword
              description: >
                This identifies the version of the destination workload.
        
            - name: destination.service.host
              type: keyword
              description: >
                This identifies destination service host responsible for an incoming request.
            - name: destination.service.name
              type: keyword
              description: >
                This identifies the destination service name.
            - name: destination.service.namespace
              type: keyword
              description: >
                This identifies the namespace of destination service.
        
            - name: request.protocol
              type: keyword
              description: >
                This identifies the protocol of the request. It is set to API protocol if provided, otherwise request or connection protocol.
            - name: response.code
              type: long
              description: >
                This identifies the response code of the request. This label is present only on HTTP metrics.
            - name: connection.security.policy
              type: keyword
              description: >
                This identifies the service authentication policy of the request. It is set to mutual_tls when Istio is used to make communication secure and report is from destination. It is set to unknown when report is from source since security policy cannot be properly populated.
        - name: mixer
          type: group
          description: >
            Contains statistics related to the Istio mixer service
          release: beta
          fields:
            - name: istio.mcp.request.acks
              type: long
              description: >
                The number of request acks received by the source.
            - name: config.adapter.info.errors.config
              type: long
              description: >
                The number of errors encountered during processing of the adapter info configuration.
            - name: config.adapter.info.configs
              type: long
              description: >
                The number of known adapters in the current config.
            - name: config.attributes
              type: long
              description: >
                The number of known attributes in the current config.
            - name: config.handler.configs
              type: long
              description: >
                The number of known handlers in the current config.
            - name: config.handler.errors.validation
              type: long
              description: >
                The number of errors encountered because handler validation returned error.
            - name: config.instance.errors.config
              type: long
              description: >
                The number of errors encountered during processing of the instance configuration.
            - name: config.instance.configs
              type: long
              description: >
                The number of known instances in the current config.
            - name: config.rule.errors.config
              type: long
              description: >
                The number of errors encountered during processing of the rule configuration.
            - name: config.rule.errors.match
              type: long
              description: >
                The number of rule conditions that was not parseable.
            - name: config.rule.configs
              type: long
              description: >
                The number of known rules in the current config.
            - name: config.template.errors.config
              type: long
              description: >
                The number of errors encountered during processing of the template configuration.
            - name: config.template.configs
              type: long
              description: >
                The number of known templates in the current config.
            - name: config.unsatisfied.action_handler
              type: long
              description: >
                The number of actions that failed due to handlers being unavailable.
            - name: dispatcher_destinations_per_variety_total
              type: long
              description: >
                The number of Mixer adapter destinations by template variety type.
            - name: handler.handlers.closed
              type: long
              description: >
                The number of handlers that were closed during config transition.
            - name: handler.daemons
              type: long
              description: >
                The current number of active daemon routines in a given adapter environment.
            - name: handler.failures.build
              type: long
              description: >
                The number of handlers that failed creation during config transition.
            - name: handler.failures.close
              type: long
              description: >
                The number of errors encountered while closing handlers during config transition.
            - name: handler.handlers.new
              type: long
              description: >
                The number of handlers that were newly created during config transition.
            - name: handler.handlers.reused
              type: long
              description: >
                The number of handlers that were re-used during config transition.
            - name: handler.name
              type: keyword
              description: >
                The name of the daemon  handler
            - name: variety
              type: keyword
              description: >
                The name of the variety
        - name: pilot
          type: group
          description: >
            Contains statistics related to the Istio pilot service
          release: beta
          fields:
            - name: xds.count
              type: long
              description: >
                Count of concurrent xDS client connections for Pilot.
            - name: xds.pushes
              type: long
              description: >
                Count of xDS messages sent, as well as errors building or sending xDS messages
                for lds, rds, cds and eds.
            - name: xds.push.time.ms.bucket.*
              type: object
              object_type: long
              description: >
                Total time Pilot takes to push lds, rds, cds and eds, histogram buckets in milliseconds.
            - name: xds.push.time.ms.sum
              type: long
              description: >
                Total time Pilot takes to push lds, rds, cds and eds, histogram sum of times in milliseconds.
            - name: xds.push.time.ms.count
              type: long
              description: >
                Total time Pilot takes to push lds, rds, cds and eds, histogram count of times.
            - name: xds.eds.instances
              type: long
              description: >
                Instances for each cluster, as of last push. Zero instances is an error.
            - name: xds.push.context.errors
              type: long
              description: >
                Number of errors (timeouts) initiating push context.
            - name: xds.internal.errors
              type: long
              description: >
                Total number of internal XDS errors in pilot.
            - name: conflict.listener.inbound
              type: long
              description: >
                Number of conflicting inbound listeners.
            - name: conflict.listener.outbound.http.over.current.tcp
              type: long
              description: >
                Number of conflicting wildcard http listeners with current wildcard tcp listener.
            - name: conflict.listener.outbound.http.over.https
              type: long
              description: >
                Number of conflicting HTTP listeners with well known HTTPS ports.
            - name: conflict.listener.outbound.tcp.over.current.http
              type: long
              description: >
                Number of conflicting wildcard tcp listeners with current wildcard http listener.
            - name: conflict.listener.outbound.tcp.over.current.tcp
              type: long
              description: >
                Number of conflicting tcp listeners with current tcp listener.
            - name: proxy.conv.ms.bucket.*
              type: object
              object_type: long
              description: >
                Time needed by Pilot to push Envoy configurations, histogram buckets in milliseconds.
            - name: proxy.conv.ms.sum
              type: long
              description: >
                Time needed by Pilot to push Envoy configurations, histogram sum of times in milliseconds.
            - name: proxy.conv.ms.count
              type: long
              description: >
                Time needed by Pilot to push Envoy configurations, histogram count of times.
            - name: services
              type: integer
              description: >
                Total services known to pilot.
            - name: virt.services
              type: long
              description: >
                Total virtual services known to pilot.
            - name: no.ip
              type: long
              description: >
                Pods not found in the endpoint table, possibly invalid.
            - name: cluster
              type: text
              description: >
                The instance FQDN.
            - name: type
              type: text
              description: >
                The Envoy proxy configuration type.
        - name: proxy
          type: group
          release: beta
          fields:
- key: mssql
  title: "MSSQL"
  description: MS SQL module
  release: ga
  fields:
    - name: mssql
      type: group
      description: The root field containing all MSSQL fields
      fields:
        - name: database
          type: group
          description: The database that the metrics is being referred to
          fields:
            - name: id
              type: long
              description: Unique ID of the database inside MSSQL
            - name: name
              type: keyword
              description: Name of the database
        - name: performance
          type: group
          description: performance metricset fetches information about the Performance Counters
          release: ga
          fields:
            - name: page_splits_per_sec
              type: long
              description: Number of page splits per second that occur as the result of overflowing index pages.
        
            - name: lock_waits_per_sec
              type: long
              description: Number of lock requests per second that required the caller to wait.
        
            - name: user_connections
              type: long
              description: Total number of user connections
        
            - name: transactions
              description: Total number of transactions
              type: long
        
            - name: active_temp_tables
              description: Number of temporary tables/table variables in use.
              type: long
        
            - name: connections_reset_per_sec
              type: long
              description: Total number of logins started from the connection pool.
        
            - name: logins_per_sec
              description: Total number of logins started per second. This does not include pooled connections.
              type: long
        
            - name: logouts_per_sec
              description: Total number of logout operations started per second.
              type: long
        
            - name: recompilations_per_sec
              type: long
              description: Number of statement recompiles per second. Counts the number of times statement recompiles are triggered. Generally, you want the recompiles to be low.
        
            - name: compilations_per_sec
              description: Number of SQL compilations per second. Indicates the number of times the compile code path is entered. Includes compiles caused by statement-level recompilations in SQL Server. After SQL Server user activity is stable, this value reaches a steady state.
              type: long
        
            - name: batch_requests_per_sec
              description: Number of Transact-SQL command batches received per second. This statistic is affected by all constraints (such as I/O, number of users, cache size, complexity of requests, and so on). High batch requests mean good throughput.
              type: long
        
            - name: buffer
              type: group
              fields:
                - name: cache_hit
                  type: group
                  description: Indicates the percentage of pages found in the buffer cache without having to read from disk.
                  fields:
                    - name: pct
                      description: The ratio is the total number of cache hits divided by the total number of cache lookups over the last few thousand page accesses. After a long period of time, the ratio moves very little. Because reading from the cache is much less expensive than reading from disk, you want this ratio to be high
                      type: double
        
                - name: page_life_expectancy
                  type: group
                  description: Indicates the number of seconds a page will stay in the buffer pool without references.
                  fields:
                    - name: sec
                      description: Indicates the number of seconds a page will stay in the buffer pool without references (in seconds).
                      type: long
        
                - name: checkpoint_pages_per_sec
                  description: Indicates the number of pages flushed to disk per second by a checkpoint or other operation that require all dirty pages to be flushed.
                  type: long
        
                - name: database_pages
                  description: Indicates the number of pages in the buffer pool with database content.
                  fields:
                  type: long
        
                - name: target_pages
                  description: Ideal number of pages in the buffer pool.
                  fields:
                  type: long
        - name: transaction_log
          type: group
          description: transaction_log metricset will fetch information about the operation and transaction log of each database from a MSSQL instance
          release: ga
          fields:
            - name: space_usage
              type: group
              description: Space usage information for the transaction log
              fields:
                - name: since_last_backup
                  description: The amount of space used since the last log backup
                  type: group
                  fields:
                    - name: bytes
                      description: The amount of space used since the last log backup in bytes
                      type: long
                - name: total
                  type: group
                  description: The size of the log
                  fields:
                    - name: bytes
                      description: The size of the log in bytes
                      type: long
                - name: used
                  type: group
                  description: The occupied size of the log
                  fields:
                    - name: bytes
                      description: The occupied size of the log in bytes
                      type: long
                    - name: pct
                      description: A percentage of the occupied size of the log as a percent of the total log size
                      type: float
            - name: stats
              type: group
              description: Returns summary level attributes and information on transaction log files of databases. Use this information for monitoring and diagnostics of transaction log health.
              fields:
                - name: active_size
                  description: Total active transaction log size.
                  type: group
                  fields:
                    - name: bytes
                      description: Total active transaction log size in bytes
                      type: long
                - name: backup_time
                  type: date
                  description: Last transaction log backup time.
                - name: recovery_size
                  type: group
                  description: Log size since log recovery log sequence number (LSN).
                  fields:
                    - name: bytes
                      description: Log size in bytes since log recovery log sequence number (LSN).
                      type: long
                - name: since_last_checkpoint
                  type: group
                  description: Log size since last checkpoint log sequence number (LSN).
                  fields:
                    - name: bytes
                      description: Log size in bytes since last checkpoint log sequence number (LSN).
                      type: long
                - name: total_size
                  type: group
                  description: Total transaction log size.
                  fields:
                    - name: bytes
                      description: Total transaction log size in bytes.
                      type: long
- key: oracle
  title: "Oracle"
  description: Oracle database module
  short_config: false
  release: ga
  fields:
    - name: oracle
      type: group
      description: Oracle module
      fields:
        - name: performance
          type: group
          description: Performance related metrics on a single database instance
          release: ga
          fields:
            - name: machine
              type: keyword
              description: Operating system machine name
            - name: buffer_pool
              type: keyword
              description: Name of the buffer pool in the instance
            - name: username
              type: keyword
              description: Oracle username
            - name: io_reloads
              type: double
              description: Reloads / Pins ratio. A Reload is any PIN of an object that is not the first PIN performed since the object handle was created, and which requires loading the object from disk. Pins are the number of times a PIN was requested for objects of this namespace
            - name: lock_requests
              type: long
              description: Average of the ratio between 'gethits' and 'gets' being 'Gethits' the number of times an object's handle was found in memory and 'gets' the number of times a lock was requested for objects of this namespace.
            - name: pin_requests
              type: double
              description: Average of all pinhits/pins ratios being 'PinHits' the number of times all of the metadata pieces of the library object were found in memory and 'pins' the number of times a PIN was requested for objects of this namespace
            - name: cache
              type: group
              description: Statistics about all buffer pools available for the instance
              fields:
                - name: buffer.hit.pct
                  type: double
                  description: The cache hit ratio of the specified buffer pool.
                - name: physical_reads
                  type: long
                  description: Physical reads
                - name: get
                  type: group
                  description: Buffer pool 'get' statistics
                  fields:
                    - name: consistent
                      type: long
                      description: Consistent gets statistic
                    - name: db_blocks
                      type: long
                      description: Database blocks gotten
            - name: cursors
              type: group
              description: Cursors information
              fields:
                - name: avg
                  type: double
                  description: Average cursors opened by username and machine
                - name: max
                  type: double
                  description: Max cursors opened by username and machine
                - name: total
                  type: double
                  description: Total opened cursors by username and machine
                - name: opened
                  type: group
                  description: Opened cursors statistic
                  fields:
                    - name: current
                      type: long
                      description: Total number of current open cursors
                    - name: total
                      type: long
                      description: Total number of cursors opened since the instance started
                - name: parse
                  type: group
                  description: Parses statistic information that occured in the current session
                  fields:
                    - name: real
                      type: long
                      description: "Real number of parses that occurred: session cursor cache hits - parse count (total)"
                    - name: total
                      type: long
                      description: Total number of parse calls (hard and soft). A soft parse is a check on an object already in the shared pool, to verify that the permissions on the underlying object have not changed.
                - name: session.cache_hits
                  type: long
                  description: Number of hits in the session cursor cache. A hit means that the SQL statement did not have to be reparsed.
                - name: cache_hit.pct
                  type: double
                  description: Ratio of session cursor cache hits from total number of cursors
        - name: sysmetric
          type: group
          release: beta
          description: >
            Sysmetric related metrics.
          fields:
            - name: session_count
              type: long
              description: >
                Session Count.
            - name: average_active_sessions
              type: double
              description: >
                Average Active Sessions.
            - name: current_os_load
              type: double
              description: >
                Current OS Load.
            - name: physical_reads_per_sec
              type: double
              description: >
                Physical Reads Per Second.
            - name: user_transaction_per_sec
              type: double
              description: >
                User Transaction Per Second.
            - name: total_table_scans_per_txn
              type: double
              description: >
                Total Table Scans Per Transaction.
            - name: physical_writes_per_sec
              type: double
              description: >
                Physical Writes Per Second.
            - name: total_index_scans_per_txn
              type: double
              description: >
                Total Index Scans Per Transaction.
            - name: host_cpu_utilization_pct
              type: double
              description: >
                Host CPU Utilization (%).
            - name: network_traffic_volume_per_sec
              type: double
              description: >
                Network Traffic Volume Per Second.
            - name: user_rollbacks_per_sec
              type: long
              description: >
                User Rollbacks Per Second.
            - name: cpu_usage_per_sec
              type: double
              description: >
                CPU Usage Per Second.
            - name: db_block_changes_per_sec
              type: double
              description: >
                DB Block Changes Per Second.
            - name: physical_read_total_bytes_per_sec
              type: double
              description: >
                Physical Read Total Bytes Per Second.
            - name: response_time_per_txn
              type: double
              description: >
                Response Time Per Transaction.
        - name: tablespace
          type: group
          description: tablespace
          release: ga
          fields:
            - name: name
              type: keyword
              description: Tablespace name
        
            - name: data_file
              type: group
              description: Database files information
              fields:
                - name: id
                  type: long
                  description: Tablespace unique identifier
                - name: name
                  type: keyword
                  description: Filename of the data file
                - name: size
                  type: group
                  description: Size information about the file
                  fields:
                    - name: max.bytes
                      format: bytes
                      type: long
                      description: Maximum file size in bytes
                    - name: bytes
                      format: bytes
                      type: long
                      description: Size of the file in bytes
                    - name: free.bytes
                      format: bytes
                      type: long
                      description: >
                        The size of the file available for user data. The actual size of the file minus this value is used to store file related metadata.
                - name: status
                  type: keyword
                  description: >
                    'File status: AVAILABLE or INVALID (INVALID means that the file number is not in use, for example, a file in
                    a tablespace that was dropped)'
                - name: online_status
                  type: keyword
                  description: Last known online status of the data file. One of SYSOFF, SYSTEM, OFFLINE, ONLINE or RECOVER.
        
            - name: space
              type: group
              description: Tablespace space usage information
              fields:
                - name: free.bytes
                  format: bytes
                  type: long
                  description: Tablespace total free space available, in bytes.
                - name: used.bytes
                  format: bytes
                  type: long
                  description: Tablespace used space, in bytes.
                - name: total.bytes
                  format: bytes
                  type: long
                  description: Tablespace total size, in bytes.
- key: prometheus-xpack
  title: "Prometheus typed metrics"
  description: >
    Stats scraped from a Prometheus endpoint.
  release: ga
  settings: ["ssl", "http"]
  fields:
    - name: prometheus.*.value
      type: object
      object_type: double
      object_type_mapping_type: "*"
      description: >
        Prometheus gauge metric
    - name: prometheus.*.counter
      type: object
      object_type: double
      object_type_mapping_type: "*"
      description: >
        Prometheus counter metric
    - name: prometheus.*.rate
      type: object
      object_type: double
      object_type_mapping_type: "*"
      description: >
        Prometheus rated counter metric
    - name: prometheus.*.histogram
      type: object
      object_type: histogram
      object_type_mapping_type: "*"
      description: >
        Prometheus histogram metric
        - release: ga
- key: redisenterprise
  title: "Redis Enterprise"
  description: >
    Redis metrics collected from Redis Enterprise Server.
  release: beta
  fields:
    - name: redisenterprise
      type: group
      description: >
        `redisenterprise` contains the information and statistics from Redis Enterprise Server.
      fields:
        - name: node
          type: group
          release: beta
          fields:
        - name: proxy
          type: group
          release: beta
          fields:
- key: sql
  title: "SQL"
  release: ga
  description: >
    SQL module fetches metrics from a SQL database
  fields:
    - name: sql
      type: group
      fields:
        - name: driver
          type: keyword
          description: >
            Driver used to execute the query.
        - name: query
          type: keyword
          description: >
            Query executed to collect metrics.
        - name: metrics.numeric.*
          type: object
          object_type: double
          description: >
            Numeric metrics collected.
        - name: metrics.string.*
          type: object
          object_type: keyword
          description: >
            Non-numeric values collected.
        - name: metrics.boolean.*
          type: object
          object_type: keyword
          description: >
            Boolean values collected.
        - release: ga
- key: stan
  title: "Stan"
  description: >
    stan Module
  release: ga
  settings: ["ssl", "http"]
  fields:
    - name: stan
      type: group
      description: >
        `stan` contains statistics that were read from Nats Streaming server (STAN)
      fields:
        - name: server.id
          type: keyword
          description: >
            The server ID
        - name: cluster.id
          type: keyword
          description: >
            The cluster ID
        - name: channels
          type: group
          description: >
            Contains stan / nats streaming/serverz endpoint metrics
          release: ga
          fields:
            - name: name
              type: keyword
              description: >
                The name of the STAN streaming channel
            - name: messages
              type: long
              description: >
                The number of STAN streaming messages
            - name: bytes
              type: long
              description: >
                The number of STAN bytes in the channel
            - name: first_seq
              type: long
              description: >
                First sequence number stored in the channel. If first_seq > min([seq in subscriptions]) data loss has possibly occurred
            - name: last_seq
              type: long
              description: >
                Last sequence number stored in the channel
            - name: depth
              type: long
              description: >
                Queue depth based upon current sequence number and highest reported subscriber sequence number
        - name: stats
          type: group
          description: >
            Contains only high-level stan / nats streaming server related metrics
          release: ga
          fields:
            - name: state
              type: keyword
              description: >
                The cluster / streaming configuration state (STANDALONE, CLUSTERED)
            - name: role
              type: keyword
              description: >
                If clustered, role of this node in the cluster (Leader, Follower, Candidate)
            - name: clients
              type: integer
              description: >
                The number of STAN clients
            - name: subscriptions
              type: integer
              description: >
                The number of STAN streaming subscriptions
            - name: channels
              type: integer
              description: >
                The number of STAN channels
            - name: messages
              type: long
              description: >
                Number of messages across all STAN queues
            - name: bytes
              type: long
              description: >
                Number of bytes consumed across all STAN queues
        
        - name: subscriptions
          type: group
          description: >
            Contains stan / nats streaming/serverz endpoint subscription metrics
          release: ga
          fields:
            - name: id
              type: keyword
              description: >
                The name of the STAN channel subscription (client_id)
            - name: channel
              type: keyword
              description: >
                The name of the STAN channel the subscription is associated with
            - name: queue
              type: keyword
              description: >
                The name of the NATS queue that the STAN channel subscription is associated with, if any
        # If first_seq > min([seq in subscriptions]) data loss has possibly occurred
            - name: last_sent
              type: long
              description: >
                Last known sequence number of the subscription that was acked
            - name: pending
              type: long
              description: >
                Number of pending messages from / to the subscriber
            - name: offline
              type: boolean
              description: >
                Is the subscriber marked as offline?
            - name: stalled
              type: boolean
              description: >
                Is the subscriber known to be stalled?
        
- key: statsd
  title: "Statsd"
  description: >
    Statsd module
  release: ga
  fields:
    - name: statsd
      type: group
      fields:
        - name: '*.count'
          type: object
          object_type: long
          object_type_mapping_type: "long"
          description: >
            Statsd counters
        - name: '*.*'
          type: object
          object_type: float
          object_type_mapping_type: "*"
          description: >
            Statsd metrics
        - release: ga
- key: syncgateway
  title: "SyncGateway"
  description: SyncGateway metrics
  release: beta
  fields:
    - name: syncgateway
      type: group
      description: >
        `syncgateway` contains the information and statistics from SyncGateway.
      fields:
        - name: syncgateway
          type: group
          description: >
            Couchbase Sync Gateway metrics.
          release: beta
          fields:
            - name: name
              type: keyword
              description: >
                Name of the database on when field `couchbase.syncgateway.type` is `db_stats`.
            - name: metrics
              type: group
              description: Metrics of all databases contained in the config file of the SyncGateway instance.
              fields:
                - name: docs
                  type: group
                  fields:
                    - name: writes
                      type: group
                      fields:
                        - name: conflict.count
                          type: long
                        - name: count
                          type: long
                        - name: bytes
                          type: long
                - name: replications
                  type: group
                  fields:
                    - name: active
                      type: long
                      description: Number of active replications
                    - name: total
                      type: long
                      description: Total number of replications (active or not)
            - name: gsi
              type: group
              fields:
                - name: views
                  type: group
                  fields:
                    - name: tombstones
                      type: group
                      fields:
                        - name: query
                          type: group
                          fields:
                            - name: count
                              type: double
                            - name: time
                              type: double
                            - name: error.count
                              type: double
                    - name: access
                      type: group
                      fields:
                        - name: query
                          type: group
                          fields:
                            - name: count
                              type: double
                            - name: error
                              type: group
                              fields:
                                - name: count
                                  type: double
                            - name: time
                              type: double
                    - name: channels
                      type: group
                      fields:
                        - name: query
                          type: group
                          fields:
                            - name: count
                              type: double
                            - name: error
                              type: group
                              fields:
                                - name: count
                                  type: double
                            - name: time
                              type: double
                        - name: star
                          type: group
                          fields:
                            - name: query
                              type: group
                              fields:
                                - name: time
                                  type: double
                                - name: count
                                  type: double
                                - name: error
                                  type: group
                                  fields:
                                    - name: count
                                      type: double
                    - name: role_access
                      type: group
                      fields:
                        - name: query
                          type: group
                          fields:
                            - name: count
                              type: double
                            - name: error
                              type: group
                              fields:
                                - name: count
                                  type: double
                            - name: time
                              type: double
                    - name: sequences
                      type: group
                      fields:
                        - name: query
                          type: group
                          fields:
                            - name: count
                              type: double
                            - name: error
                              type: group
                              fields:
                                - name: count
                                  type: double
                            - name: time
                              type: double
                    - name: all_docs
                      type: group
                      fields:
                        - name: query
                          type: group
                          fields:
                            - name: count
                              type: double
                            - name: error
                              type: group
                              fields:
                                - name: count
                                  type: double
                            - name: time
                              type: double
                    - name: principals
                      type: group
                      fields:
                        - name: query
                          type: group
                          fields:
                            - name: count
                              type: double
                            - name: error
                              type: group
                              fields:
                                - name: count
                                  type: double
                            - name: time
                              type: double
                    - name: resync
                      type: group
                      fields:
                        - name: query
                          type: group
                          fields:
                            - name: count
                              type: double
                            - name: error
                              type: group
                              fields:
                                - name: count
                                  type: double
                            - name: time
                              type: double
                    - name: sessions
                      type: group
                      fields:
                        - name: query
                          type: group
                          fields:
                            - name: count
                              type: double
                            - name: error
                              type: group
                              fields:
                                - name: count
                                  type: double
                            - name: time
                              type: double
            - name: security
              type: group
              fields:
                - name: access_errors
                  type: group
                  fields:
                    - name: count
                      type: double
                - name: auth
                  type: group
                  fields:
                    - name: failed
                      type: group
                      fields:
                        - name: count
                          type: double
                - name: docs_rejected
                  type: group
                  fields:
                    - name: count
                      type: double
            - name: cache
              type: group
              fields:
                - name: channel
                  type: group
                  fields:
                    - name: revs
                      type: group
                      fields:
                        - name: active
                          type: double
                        - name: removal
                          type: double
                        - name: tombstone
                          type: double
                    - name: hits
                      type: double
                    - name: misses
                      type: double
                - name: revs
                  type: group
                  fields:
                    - name: hits
                      type: double
                    - name: misses
                      type: double
            - name: cbl
              type: group
              fields:
                - name: replication
                  type: group
                  fields:
                    - name: pull
                      type: group
                      fields:
                        - name: caught_up
                          type: double
                        - name: since_zero
                          type: double
                        - name: total
                          type: group
                          fields:
                            - name: continuous
                              type: double
                            - name: one_shot
                              type: double
                        - name: active
                          type: group
                          fields:
                            - name: continuous
                              type: double
                            - name: count
                              type: double
                            - name: one_shot
                              type: double
                        - name: attachment
                          type: group
                          fields:
                            - name: bytes
                              type: long
                            - name: count
                              type: long
                        - name: request_changes
                          type: group
                          fields:
                            - name: count
                              type: double
                            - name: time
                              type: double
                        - name: rev
                          type: group
                          fields:
                            - name: processing_time
                              type: double
                            - name: send
                              type: group
                              fields:
                                - name: count
                                  type: double
                                - name: latency
                                  type: double
                    - name: push
                      type: group
                      fields:
                        - name: attachment
                          type: group
                          fields:
                            - name: bytes
                              type: double
                            - name: count
                              type: double
                        - name: doc_push_count
                          type: double
                        - name: propose_change
                          type: group
                          fields:
                            - name: count
                              type: double
                            - name: time
                              type: double
                        - name: sync_function
                          type: group
                          fields:
                            - name: count
                              type: double
                            - name: time
                              type: double
                        - name: write_processing_time
                          type: double
            - name: memstats
              type: group
              description: Dumps a large amount of information about the memory heap and garbage collector
              fields:
                - name: BuckHashSys
                  type: double
                - name: Mallocs
                  type: double
                - name: PauseTotalNs
                  type: double
                - name: TotalAlloc
                  type: double
                - name: Alloc
                  type: double
                - name: GCSys
                  type: double
                - name: LastGC
                  type: double
                - name: MSpanSys
                  type: double
                - name: GCCPUFraction
                  type: double
                - name: HeapReleased
                  type: double
                - name: HeapSys
                  type: double
                - name: DebugGC
                  type: long
                - name: HeapIdle
                  type: double
                - name: Lookups
                  type: double
                - name: HeapObjects
                  type: double
                - name: MSpanInuse
                  type: double
                - name: NumForcedGC
                  type: double
                - name: OtherSys
                  type: double
                - name: Frees
                  type: double
                - name: NextGC
                  type: double
                - name: StackInuse
                  type: double
                - name: Sys
                  type: double
                - name: NumGC
                  type: double
                - name: EnableGC
                  type: long
                - name: HeapAlloc
                  type: double
                - name: MCacheInuse
                  type: double
                - name: MCacheSys
                  type: double
                - name: HeapInuse
                  type: double
                - name: StackSys
                  type: double
        - name: memory
          type: group
          description: >
            SyncGateway memory metrics. It dumps a large amount of information about the memory heap and garbage collector
          release: beta
          fields:
            - name: BuckHashSys
              type: double
            - name: Mallocs
              type: double
            - name: PauseTotalNs
              type: double
            - name: TotalAlloc
              type: double
            - name: Alloc
              type: double
            - name: GCSys
              type: double
            - name: LastGC
              type: double
            - name: MSpanSys
              type: double
            - name: GCCPUFraction
              type: double
            - name: HeapReleased
              type: double
            - name: HeapSys
              type: double
            - name: DebugGC
              type: long
            - name: HeapIdle
              type: double
            - name: Lookups
              type: double
            - name: HeapObjects
              type: double
            - name: MSpanInuse
              type: double
            - name: NumForcedGC
              type: double
            - name: OtherSys
              type: double
            - name: Frees
              type: double
            - name: NextGC
              type: double
            - name: StackInuse
              type: double
            - name: Sys
              type: double
            - name: NumGC
              type: double
            - name: EnableGC
              type: long
            - name: HeapAlloc
              type: double
            - name: MCacheInuse
              type: double
            - name: MCacheSys
              type: double
            - name: HeapInuse
              type: double
            - name: StackSys
              type: double
        - name: replication
          type: group
          description: >
            SyncGateway per replication metrics.
          release: beta
          fields:
            - name: metrics
              type: group
              description: Metrics related with data replication.
              fields:
                - name: attachment
                  type: group
                  fields:
                    - name: transferred
                      type: group
                      fields:
                        - name: bytes
                          type: long
                          description: Number of attachment bytes transferred for this replica.
                        - name: count
                          type: long
                          description: The total number of attachments transferred since replication started.
                - name: docs
                  type: group
                  fields:
                    - name: checked_sent
                      type: double
                      description: The total number of documents checked for changes since replication started.
                    - name: pushed
                      type: group
                      fields:
                        - name: count
                          type: long
                          description: The total number of documents checked for changes since replication started.
                        - name: failed
                          type: long
                          description: The total number of documents that failed to be pushed since replication started.
            - name: id
              type: keyword
              description: ID of the replica.
        - name: resources
          type: group
          description: >
            SyncGateway global resource utilization
          release: beta
          fields:
            - name: error_count
              type: long
            - name: goroutines_high_watermark
              type: long
            - name: num_goroutines
              type: long
            - name: process
              type: group
              fields:
                - name: cpu_percent_utilization
                  type: long
                - name: memory_resident
                  type: long
            - name: pub_net
              type: group
              fields:
                - name: recv
                  type: group
                  fields:
                    - name: bytes
                      type: long
                - name: sent
                  type: group
                  fields:
                    - name: bytes
                      type: long
            - name: admin_net_bytes
              type: group
              fields:
                - name: recv
                  type: long
                - name: sent
                  type: long
            - name: go_memstats
              type: group
              fields:
                - name: heap
                  type: group
                  fields:
                    - name: alloc
                      type: long
                    - name: idle
                      type: long
                    - name: inuse
                      type: long
                    - name: released
                      type: long
                - name: pause
                  type: group
                  fields:
                    - name: ns
                      type: long
                - name: stack
                  type: group
                  fields:
                    - name: inuse
                      type: long
                    - name: sys
                      type: long
                - name: sys
                  type: long
            - name: system_memory_total
              type: long
            - name: warn_count
              type: long
- key: tomcat
  title: 'Tomcat'
  release: beta
  description: >
    Tomcat module
  fields:
    - name: tomcat
      type: group
      fields:
        - name: cache
          type: group
          description: Catalina Cache metrics from the WebResourceRoot
          release: beta
          fields:
            - name: mbean
              description: Mbean that this event is related to
              type: keyword
            - name: hit.total
              description: The number of requests for resources that were served from the cache
              type: long
            - name: size.total.kb
              description: The current estimate of the cache size in kilobytes
              type: long
            - name: size.max.kb
              description: The maximum permitted size of the cache in kilobytes
              type: long
            - name: lookup.total
              description: The number of requests for resources
              type: long
            - name: ttl.ms
              description: The time-to-live for cache entries in milliseconds
              type: long
        - name: memory
          type: group
          description: Memory metrics from java.lang JMX
          release: beta
          fields:
            - name: mbean
              description: Mbean that this event is related to
              type: keyword
            - name: heap.usage.committed
              description: Committed heap memory usage
              type: long
            - name: heap.usage.max
              description: Max heap memory usage
              type: long
            - name: heap.usage.used
              description: Used heap memory usage
              type: long
            - name: heap.usage.init
              description: Initial heap memory usage
              type: long
            - name: other.usage.committed
              description: Committed non-heap memory usage
              type: long
            - name: other.usage.max
              description: Max non-heap memory usage
              type: long
            - name: other.usage.used
              description: Used non-heap memory usage
              type: long
            - name: other.usage.init
              description: Initial non-heap memory usage
              type: long
        - name: requests
          type: group
          description: Requests processor metrics from GlobalRequestProcessor JMX
          release: beta
          fields:
            - name: mbean
              description: Mbean that this event is related to
              type: keyword
            - name: total
              description: Number of requests processed
              type: long
            - name: bytes.received
              description: Amount of data received, in bytes
              type: long
            - name: bytes.sent
              description: Amount of data sent, in bytes
              type: long
            - name: processing.ms
              description: Total time to process the requests
              type: long
            - name: errors.total
              description: Number of errors
              type: long
        - name: threading
          type: group
          description: Threading metrics from the Catalina's ThreadPool JMX
          release: beta
          fields:
            - name: busy
              description: Current busy threads from the ThreadPool
              type: long
            - name: max
              description: Max threads from the ThreadPool
              type: long
            - name: current
              description: Current number of threads, taken from the ThreadPool
              type: long
            - name: keep_alive.total
              description: Total keep alive on the ThreadPool
              type: long
            - name: keep_alive.timeout.ms
              description: Keep alive timeout on the ThreadPool
              type: long
            - name: started.total
              description: Current started threads at JVM level (from java.lang:type=Threading)
              type: long
            - name: user.time.ms
              description: User time in milliseconds (from java.lang:type=Threading)
              type: long
            - name: cpu.time.ms
              description: CPU time in milliseconds (from java.lang:type=Threading)
              type: long
            - name: total
              description: Total threads at the JVM level (from java.lang:type=Threading)
              type: long
            - name: peak
              description: Peak number of threads at JVM level (from java.lang:type=Threading)
              type: long
