# WARNING! Do not edit this file directly, it was generated by the ECS project,
# based on ECS version 1.6.0.
# Please visit https://github.com/elastic/ecs to suggest changes to ECS fields.

- key: ecs
  title: ECS
  description: ECS Fields.
  fields:
  - name: '@timestamp'
    level: core
    required: true
    type: date
    description: 'Date/time when the event originated.

      This is the date/time extracted from the event, typically representing when
      the event was generated by the source.

      If the event source has no original timestamp, this value is typically populated
      by the first time the event was received by the pipeline.

      Required field for all events.'
    example: '2016-05-23T08:05:34.853Z'
  - name: labels
    level: core
    type: object
    object_type: keyword
    description: 'Custom key/value pairs.

      Can be used to add meta information to events. Should not contain nested objects.
      All values are stored as keyword.

      Example: `docker` and `k8s` labels.'
    example: '{"application": "foo-bar", "env": "production"}'
  - name: message
    level: core
    type: text
    description: 'For log events the message field contains the log message, optimized
      for viewing in a log viewer.

      For structured logs without an original message field, other fields can be concatenated
      to form a human-readable summary of the event.

      If multiple messages exist, they can be combined into one message.'
    example: Hello World
  - name: tags
    level: core
    type: keyword
    ignore_above: 1024
    description: List of keywords used to tag each event.
    example: '["production", "env2"]'
  - name: agent
    title: Agent
    group: 2
    description: 'The agent fields contain the data about the software entity, if
      any, that collects, detects, or observes events on a host, or takes measurements
      on a host.

      Examples include Beats. Agents may also run on observers. ECS agent.* fields
      shall be populated with details of the agent running on the host or observer
      where the event happened or the measurement was taken.'
    footnote: 'Examples: In the case of Beats for logs, the agent.name is filebeat.
      For APM, it is the agent running in the app/service. The agent information does
      not change if data is sent through queuing systems like Kafka, Redis, or processing
      systems such as Logstash or APM Server.'
    type: group
    fields:
    - name: build.original
      level: core
      type: keyword
      ignore_above: 1024
      description: 'Extended build information for the agent.

        This field is intended to contain any build information that a data source
        may provide, no specific formatting is required.'
      example: metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c
        built 2020-02-05 23:10:10 +0000 UTC]
      default_field: false
    - name: ephemeral_id
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Ephemeral identifier of this agent (if one exists).

        This id normally changes across restarts, but `agent.id` does not.'
      example: 8a4f500f
    - name: id
      level: core
      type: keyword
      ignore_above: 1024
      description: 'Unique identifier of this agent (if one exists).

        Example: For Beats this would be beat.id.'
      example: 8a4f500d
    - name: name
      level: core
      type: keyword
      ignore_above: 1024
      description: 'Custom name of the agent.

        This is a name that can be given to an agent. This can be helpful if for example
        two Filebeat instances are running on the same host but a human readable separation
        is needed on which Filebeat instance data is coming from.

        If no name is given, the name is often left empty.'
      example: foo
    - name: type
      level: core
      type: keyword
      ignore_above: 1024
      description: 'Type of the agent.

        The agent type always stays the same and should be given by the agent used.
        In case of Filebeat the agent would always be Filebeat also if two Filebeat
        instances are run on the same machine.'
      example: filebeat
    - name: version
      level: core
      type: keyword
      ignore_above: 1024
      description: Version of the agent.
      example: 6.0.0-rc2
  - name: as
    title: Autonomous System
    group: 2
    description: An autonomous system (AS) is a collection of connected Internet Protocol
      (IP) routing prefixes under the control of one or more network operators on
      behalf of a single administrative entity or domain that presents a common, clearly
      defined routing policy to the internet.
    type: group
    fields:
    - name: number
      level: extended
      type: long
      description: Unique number allocated to the autonomous system. The autonomous
        system number (ASN) uniquely identifies each network on the Internet.
      example: 15169
    - name: organization.name
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: text
        norms: false
        default_field: false
      description: Organization name.
      example: Google LLC
  - name: client
    title: Client
    group: 2
    description: 'A client is defined as the initiator of a network connection for
      events regarding sessions, connections, or bidirectional flow records.

      For TCP events, the client is the initiator of the TCP connection that sends
      the SYN packet(s). For other protocols, the client is generally the initiator
      or requestor in the network transaction. Some systems use the term "originator"
      to refer the client in TCP connections. The client fields describe details about
      the system acting as the client in the network event. Client fields are usually
      populated in conjunction with server fields. Client fields are generally not
      populated for packet-level events.

      Client / server representations can add semantic context to an exchange, which
      is helpful to visualize the data in certain situations. If your context falls
      in that category, you should still ensure that source and destination are filled
      appropriately.'
    type: group
    fields:
    - name: address
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Some event client addresses are defined ambiguously. The event
        will sometimes list an IP, a domain or a unix socket.  You should always store
        the raw address in the `.address` field.

        Then it should be duplicated to `.ip` or `.domain`, depending on which one
        it is.'
    - name: as.number
      level: extended
      type: long
      description: Unique number allocated to the autonomous system. The autonomous
        system number (ASN) uniquely identifies each network on the Internet.
      example: 15169
    - name: as.organization.name
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: text
        norms: false
        default_field: false
      description: Organization name.
      example: Google LLC
    - name: bytes
      level: core
      type: long
      format: bytes
      description: Bytes sent from the client to the server.
      example: 184
    - name: domain
      level: core
      type: keyword
      ignore_above: 1024
      description: Client domain.
    - name: geo.city_name
      level: core
      type: keyword
      ignore_above: 1024
      description: City name.
      example: Montreal
    - name: geo.continent_name
      level: core
      type: keyword
      ignore_above: 1024
      description: Name of the continent.
      example: North America
    - name: geo.country_iso_code
      level: core
      type: keyword
      ignore_above: 1024
      description: Country ISO code.
      example: CA
    - name: geo.country_name
      level: core
      type: keyword
      ignore_above: 1024
      description: Country name.
      example: Canada
    - name: geo.location
      level: core
      type: geo_point
      description: Longitude and latitude.
      example: '{ "lon": -73.614830, "lat": 45.505918 }'
    - name: geo.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'User-defined description of a location, at the level of granularity
        they care about.

        Could be the name of their data centers, the floor number, if this describes
        a local physical entity, city names.

        Not typically used in automated geolocation.'
      example: boston-dc
    - name: geo.region_iso_code
      level: core
      type: keyword
      ignore_above: 1024
      description: Region ISO code.
      example: CA-QC
    - name: geo.region_name
      level: core
      type: keyword
      ignore_above: 1024
      description: Region name.
      example: Quebec
    - name: ip
      level: core
      type: ip
      description: IP address of the client (IPv4 or IPv6).
    - name: mac
      level: core
      type: keyword
      ignore_above: 1024
      description: MAC address of the client.
    - name: nat.ip
      level: extended
      type: ip
      description: 'Translated IP of source based NAT sessions (e.g. internal client
        to internet).

        Typically connections traversing load balancers, firewalls, or routers.'
    - name: nat.port
      level: extended
      type: long
      format: string
      description: 'Translated port of source based NAT sessions (e.g. internal client
        to internet).

        Typically connections traversing load balancers, firewalls, or routers.'
    - name: packets
      level: core
      type: long
      description: Packets sent from the client to the server.
      example: 12
    - name: port
      level: core
      type: long
      format: string
      description: Port of the client.
    - name: registered_domain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The highest registered client domain, stripped of the subdomain.

        For example, the registered domain for "foo.example.com" is "example.com".

        This value can be determined precisely with a list like the public suffix
        list (http://publicsuffix.org). Trying to approximate this by simply taking
        the last two labels will not work well for TLDs such as "co.uk".'
      example: example.com
    - name: top_level_domain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The effective top level domain (eTLD), also known as the domain
        suffix, is the last part of the domain name. For example, the top level domain
        for example.com is "com".

        This value can be determined precisely with a list like the public suffix
        list (http://publicsuffix.org). Trying to approximate this by simply taking
        the last label will not work well for effective TLDs such as "co.uk".'
      example: co.uk
    - name: user.domain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Name of the directory the user is a member of.

        For example, an LDAP or Active Directory domain name.'
    - name: user.email
      level: extended
      type: keyword
      ignore_above: 1024
      description: User email address.
    - name: user.full_name
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: text
        norms: false
        default_field: false
      description: User's full name, if available.
      example: Albert Einstein
    - name: user.group.domain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Name of the directory the group is a member of.

        For example, an LDAP or Active Directory domain name.'
    - name: user.group.id
      level: extended
      type: keyword
      ignore_above: 1024
      description: Unique identifier for the group on the system/platform.
    - name: user.group.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Name of the group.
    - name: user.hash
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Unique user hash to correlate information for a user in anonymized
        form.

        Useful if `user.id` or `user.name` contain confidential information and cannot
        be used.'
    - name: user.id
      level: core
      type: keyword
      ignore_above: 1024
      description: Unique identifier of the user.
    - name: user.name
      level: core
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: text
        norms: false
        default_field: false
      description: Short name or login of the user.
      example: albert
    - name: user.roles
      level: extended
      type: keyword
      ignore_above: 1024
      description: Array of user roles at the time of the event.
      example: '["kibana_admin", "reporting_user"]'
      default_field: false
  - name: cloud
    title: Cloud
    group: 2
    description: Fields related to the cloud or infrastructure the events are coming
      from.
    footnote: 'Examples: If Metricbeat is running on an EC2 host and fetches data
      from its host, the cloud info contains the data about this machine. If Metricbeat
      runs on a remote machine outside the cloud and fetches data from a service running
      in the cloud, the field contains cloud data from the machine the service is
      running on.'
    type: group
    fields:
    - name: account.id
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The cloud account or organization id used to identify different
        entities in a multi-tenant environment.

        Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.'
      example: 666777888999
    - name: account.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The cloud account name or alias used to identify different entities
        in a multi-tenant environment.

        Examples: AWS account name, Google Cloud ORG display name.'
      example: elastic-dev
      default_field: false
    - name: availability_zone
      level: extended
      type: keyword
      ignore_above: 1024
      description: Availability zone in which this host is running.
      example: us-east-1c
    - name: instance.id
      level: extended
      type: keyword
      ignore_above: 1024
      description: Instance ID of the host machine.
      example: i-1234567890abcdef0
    - name: instance.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Instance name of the host machine.
    - name: machine.type
      level: extended
      type: keyword
      ignore_above: 1024
      description: Machine type of the host machine.
      example: t2.medium
    - name: project.id
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The cloud project identifier.

        Examples: Google Cloud Project id, Azure Project id.'
      example: my-project
      default_field: false
    - name: project.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The cloud project name.

        Examples: Google Cloud Project name, Azure Project name.'
      example: my project
      default_field: false
    - name: provider
      level: extended
      type: keyword
      ignore_above: 1024
      description: Name of the cloud provider. Example values are aws, azure, gcp,
        or digitalocean.
      example: aws
    - name: region
      level: extended
      type: keyword
      ignore_above: 1024
      description: Region in which this host is running.
      example: us-east-1
  - name: code_signature
    title: Code Signature
    group: 2
    description: These fields contain information about binary code signatures.
    type: group
    fields:
    - name: exists
      level: core
      type: boolean
      description: Boolean to capture if a signature is present.
      example: 'true'
      default_field: false
    - name: status
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Additional information about the certificate status.

        This is useful for logging cryptographic errors with the certificate validity
        or trust status. Leave unpopulated if the validity or trust of the certificate
        was unchecked.'
      example: ERROR_UNTRUSTED_ROOT
      default_field: false
    - name: subject_name
      level: core
      type: keyword
      ignore_above: 1024
      description: Subject name of the code signer
      example: Microsoft Corporation
      default_field: false
    - name: trusted
      level: extended
      type: boolean
      description: 'Stores the trust status of the certificate chain.

        Validating the trust of the certificate chain may be complicated, and this
        field should only be populated by tools that actively check the status.'
      example: 'true'
      default_field: false
    - name: valid
      level: extended
      type: boolean
      description: 'Boolean to capture if the digital signature is verified against
        the binary content.

        Leave unpopulated if a certificate was unchecked.'
      example: 'true'
      default_field: false
  - name: container
    title: Container
    group: 2
    description: 'Container fields are used for meta information about the specific
      container that is the source of information.

      These fields help correlate data based containers from any runtime.'
    type: group
    fields:
    - name: id
      level: core
      type: keyword
      ignore_above: 1024
      description: Unique container id.
    - name: image.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Name of the image the container was built on.
    - name: image.tag
      level: extended
      type: keyword
      ignore_above: 1024
      description: Container image tags.
    - name: labels
      level: extended
      type: object
      object_type: keyword
      description: Image labels.
    - name: name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Container name.
    - name: runtime
      level: extended
      type: keyword
      ignore_above: 1024
      description: Runtime managing this container.
      example: docker
  - name: destination
    title: Destination
    group: 2
    description: 'Destination fields describe details about the destination of a packet/event.

      Destination fields are usually populated in conjunction with source fields.'
    type: group
    fields:
    - name: address
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Some event destination addresses are defined ambiguously. The
        event will sometimes list an IP, a domain or a unix socket.  You should always
        store the raw address in the `.address` field.

        Then it should be duplicated to `.ip` or `.domain`, depending on which one
        it is.'
    - name: as.number
      level: extended
      type: long
      description: Unique number allocated to the autonomous system. The autonomous
        system number (ASN) uniquely identifies each network on the Internet.
      example: 15169
    - name: as.organization.name
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: text
        norms: false
        default_field: false
      description: Organization name.
      example: Google LLC
    - name: bytes
      level: core
      type: long
      format: bytes
      description: Bytes sent from the destination to the source.
      example: 184
    - name: domain
      level: core
      type: keyword
      ignore_above: 1024
      description: Destination domain.
    - name: geo.city_name
      level: core
      type: keyword
      ignore_above: 1024
      description: City name.
      example: Montreal
    - name: geo.continent_name
      level: core
      type: keyword
      ignore_above: 1024
      description: Name of the continent.
      example: North America
    - name: geo.country_iso_code
      level: core
      type: keyword
      ignore_above: 1024
      description: Country ISO code.
      example: CA
    - name: geo.country_name
      level: core
      type: keyword
      ignore_above: 1024
      description: Country name.
      example: Canada
    - name: geo.location
      level: core
      type: geo_point
      description: Longitude and latitude.
      example: '{ "lon": -73.614830, "lat": 45.505918 }'
    - name: geo.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'User-defined description of a location, at the level of granularity
        they care about.

        Could be the name of their data centers, the floor number, if this describes
        a local physical entity, city names.

        Not typically used in automated geolocation.'
      example: boston-dc
    - name: geo.region_iso_code
      level: core
      type: keyword
      ignore_above: 1024
      description: Region ISO code.
      example: CA-QC
    - name: geo.region_name
      level: core
      type: keyword
      ignore_above: 1024
      description: Region name.
      example: Quebec
    - name: ip
      level: core
      type: ip
      description: IP address of the destination (IPv4 or IPv6).
    - name: mac
      level: core
      type: keyword
      ignore_above: 1024
      description: MAC address of the destination.
    - name: nat.ip
      level: extended
      type: ip
      description: 'Translated ip of destination based NAT sessions (e.g. internet
        to private DMZ)

        Typically used with load balancers, firewalls, or routers.'
    - name: nat.port
      level: extended
      type: long
      format: string
      description: 'Port the source session is translated to by NAT Device.

        Typically used with load balancers, firewalls, or routers.'
    - name: packets
      level: core
      type: long
      description: Packets sent from the destination to the source.
      example: 12
    - name: port
      level: core
      type: long
      format: string
      description: Port of the destination.
    - name: registered_domain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The highest registered destination domain, stripped of the subdomain.

        For example, the registered domain for "foo.example.com" is "example.com".

        This value can be determined precisely with a list like the public suffix
        list (http://publicsuffix.org). Trying to approximate this by simply taking
        the last two labels will not work well for TLDs such as "co.uk".'
      example: example.com
    - name: top_level_domain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The effective top level domain (eTLD), also known as the domain
        suffix, is the last part of the domain name. For example, the top level domain
        for example.com is "com".

        This value can be determined precisely with a list like the public suffix
        list (http://publicsuffix.org). Trying to approximate this by simply taking
        the last label will not work well for effective TLDs such as "co.uk".'
      example: co.uk
    - name: user.domain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Name of the directory the user is a member of.

        For example, an LDAP or Active Directory domain name.'
    - name: user.email
      level: extended
      type: keyword
      ignore_above: 1024
      description: User email address.
    - name: user.full_name
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: text
        norms: false
        default_field: false
      description: User's full name, if available.
      example: Albert Einstein
    - name: user.group.domain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Name of the directory the group is a member of.

        For example, an LDAP or Active Directory domain name.'
    - name: user.group.id
      level: extended
      type: keyword
      ignore_above: 1024
      description: Unique identifier for the group on the system/platform.
    - name: user.group.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Name of the group.
    - name: user.hash
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Unique user hash to correlate information for a user in anonymized
        form.

        Useful if `user.id` or `user.name` contain confidential information and cannot
        be used.'
    - name: user.id
      level: core
      type: keyword
      ignore_above: 1024
      description: Unique identifier of the user.
    - name: user.name
      level: core
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: text
        norms: false
        default_field: false
      description: Short name or login of the user.
      example: albert
    - name: user.roles
      level: extended
      type: keyword
      ignore_above: 1024
      description: Array of user roles at the time of the event.
      example: '["kibana_admin", "reporting_user"]'
      default_field: false
  - name: dll
    title: DLL
    group: 2
    description: 'These fields contain information about code libraries dynamically
      loaded into processes.


      Many operating systems refer to "shared code libraries" with different names,
      but this field set refers to all of the following:

      * Dynamic-link library (`.dll`) commonly used on Windows

      * Shared Object (`.so`) commonly used on Unix-like operating systems

      * Dynamic library (`.dylib`) commonly used on macOS'
    type: group
    fields:
    - name: code_signature.exists
      level: core
      type: boolean
      description: Boolean to capture if a signature is present.
      example: 'true'
      default_field: false
    - name: code_signature.status
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Additional information about the certificate status.

        This is useful for logging cryptographic errors with the certificate validity
        or trust status. Leave unpopulated if the validity or trust of the certificate
        was unchecked.'
      example: ERROR_UNTRUSTED_ROOT
      default_field: false
    - name: code_signature.subject_name
      level: core
      type: keyword
      ignore_above: 1024
      description: Subject name of the code signer
      example: Microsoft Corporation
      default_field: false
    - name: code_signature.trusted
      level: extended
      type: boolean
      description: 'Stores the trust status of the certificate chain.

        Validating the trust of the certificate chain may be complicated, and this
        field should only be populated by tools that actively check the status.'
      example: 'true'
      default_field: false
    - name: code_signature.valid
      level: extended
      type: boolean
      description: 'Boolean to capture if the digital signature is verified against
        the binary content.

        Leave unpopulated if a certificate was unchecked.'
      example: 'true'
      default_field: false
    - name: hash.md5
      level: extended
      type: keyword
      ignore_above: 1024
      description: MD5 hash.
      default_field: false
    - name: hash.sha1
      level: extended
      type: keyword
      ignore_above: 1024
      description: SHA1 hash.
      default_field: false
    - name: hash.sha256
      level: extended
      type: keyword
      ignore_above: 1024
      description: SHA256 hash.
      default_field: false
    - name: hash.sha512
      level: extended
      type: keyword
      ignore_above: 1024
      description: SHA512 hash.
      default_field: false
    - name: name
      level: core
      type: keyword
      ignore_above: 1024
      description: 'Name of the library.

        This generally maps to the name of the file on disk.'
      example: kernel32.dll
      default_field: false
    - name: path
      level: extended
      type: keyword
      ignore_above: 1024
      description: Full file path of the library.
      example: C:\Windows\System32\kernel32.dll
      default_field: false
    - name: pe.architecture
      level: extended
      type: keyword
      ignore_above: 1024
      description: CPU architecture target for the file.
      example: x64
      default_field: false
    - name: pe.company
      level: extended
      type: keyword
      ignore_above: 1024
      description: Internal company name of the file, provided at compile-time.
      example: Microsoft Corporation
      default_field: false
    - name: pe.description
      level: extended
      type: keyword
      ignore_above: 1024
      description: Internal description of the file, provided at compile-time.
      example: Paint
      default_field: false
    - name: pe.file_version
      level: extended
      type: keyword
      ignore_above: 1024
      description: Internal version of the file, provided at compile-time.
      example: 6.3.9600.17415
      default_field: false
    - name: pe.imphash
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'A hash of the imports in a PE file. An imphash -- or import hash
        -- can be used to fingerprint binaries even after recompilation or other code-level
        transformations have occurred, which would change more traditional hash values.

        Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.'
      example: 0c6803c4e922103c4dca5963aad36ddf
      default_field: false
    - name: pe.original_file_name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Internal name of the file, provided at compile-time.
      example: MSPAINT.EXE
      default_field: false
    - name: pe.product
      level: extended
      type: keyword
      ignore_above: 1024
      description: Internal product name of the file, provided at compile-time.
      example: "Microsoft\xAE Windows\xAE Operating System"
      default_field: false
  - name: dns
    title: DNS
    group: 2
    description: 'Fields describing DNS queries and answers.

      DNS events should either represent a single DNS query prior to getting answers
      (`dns.type:query`) or they should represent a full exchange and contain the
      query details as well as all of the answers that were provided for this query
      (`dns.type:answer`).'
    type: group
    fields:
    - name: answers
      level: extended
      type: object
      description: 'An array containing an object for each answer section returned
        by the server.

        The main keys that should be present in these objects are defined by ECS.
        Records that have more information may contain more keys than what ECS defines.

        Not all DNS data sources give all details about DNS answers. At minimum, answer
        objects must contain the `data` key. If more information is available, map
        as much of it to ECS as possible, and add any additional fields to the answer
        objects as custom fields.'
    - name: answers.class
      level: extended
      type: keyword
      ignore_above: 1024
      description: The class of DNS data contained in this resource record.
      example: IN
    - name: answers.data
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The data describing the resource.

        The meaning of this data depends on the type and class of the resource record.'
      example: 10.10.10.10
    - name: answers.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The domain name to which this resource record pertains.

        If a chain of CNAME is being resolved, each answer''s `name` should be the
        one that corresponds with the answer''s `data`. It should not simply be the
        original `question.name` repeated.'
      example: www.example.com
    - name: answers.ttl
      level: extended
      type: long
      description: The time interval in seconds that this resource record may be cached
        before it should be discarded. Zero values mean that the data should not be
        cached.
      example: 180
    - name: answers.type
      level: extended
      type: keyword
      ignore_above: 1024
      description: The type of data contained in this resource record.
      example: CNAME
    - name: header_flags
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Array of 2 letter DNS header flags.

        Expected values are: AA, TC, RD, RA, AD, CD, DO.'
      example:
      - RD
      - RA
    - name: id
      level: extended
      type: keyword
      ignore_above: 1024
      description: The DNS packet identifier assigned by the program that generated
        the query. The identifier is copied to the response.
      example: 62111
    - name: op_code
      level: extended
      type: keyword
      ignore_above: 1024
      description: The DNS operation code that specifies the kind of query in the
        message. This value is set by the originator of a query and copied into the
        response.
      example: QUERY
    - name: question.class
      level: extended
      type: keyword
      ignore_above: 1024
      description: The class of records being queried.
      example: IN
    - name: question.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The name being queried.

        If the name field contains non-printable characters (below 32 or above 126),
        those characters should be represented as escaped base 10 integers (\DDD).
        Back slashes and quotes should be escaped. Tabs, carriage returns, and line
        feeds should be converted to \t, \r, and \n respectively.'
      example: www.example.com
    - name: question.registered_domain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The highest registered domain, stripped of the subdomain.

        For example, the registered domain for "foo.example.com" is "example.com".

        This value can be determined precisely with a list like the public suffix
        list (http://publicsuffix.org). Trying to approximate this by simply taking
        the last two labels will not work well for TLDs such as "co.uk".'
      example: example.com
    - name: question.subdomain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The subdomain is all of the labels under the registered_domain.

        If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com",
        the subdomain field should contain "sub2.sub1", with no trailing period.'
      example: www
    - name: question.top_level_domain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The effective top level domain (eTLD), also known as the domain
        suffix, is the last part of the domain name. For example, the top level domain
        for example.com is "com".

        This value can be determined precisely with a list like the public suffix
        list (http://publicsuffix.org). Trying to approximate this by simply taking
        the last label will not work well for effective TLDs such as "co.uk".'
      example: co.uk
    - name: question.type
      level: extended
      type: keyword
      ignore_above: 1024
      description: The type of record being queried.
      example: AAAA
    - name: resolved_ip
      level: extended
      type: ip
      description: 'Array containing all IPs seen in `answers.data`.

        The `answers` array can be difficult to use, because of the variety of data
        formats it can contain. Extracting all IP addresses seen in there to `dns.resolved_ip`
        makes it possible to index them as IP addresses, and makes them easier to
        visualize and query for.'
      example:
      - 10.10.10.10
      - 10.10.10.11
    - name: response_code
      level: extended
      type: keyword
      ignore_above: 1024
      description: The DNS response code.
      example: NOERROR
    - name: type
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The type of DNS event captured, query or answer.

        If your source of DNS events only gives you DNS queries, you should only create
        dns events of type `dns.type:query`.

        If your source of DNS events gives you answers as well, you should create
        one event per query (optionally as soon as the query is seen). And a second
        event containing all query details as well as an array of answers.'
      example: answer
  - name: ecs
    title: ECS
    group: 2
    description: Meta-information specific to ECS.
    type: group
    fields:
    - name: version
      level: core
      required: true
      type: keyword
      ignore_above: 1024
      description: 'ECS version this event conforms to. `ecs.version` is a required
        field and must exist in all events.

        When querying across multiple indices -- which may conform to slightly different
        ECS versions -- this field lets integrations adjust to the schema version
        of the events.'
      example: 1.0.0
  - name: error
    title: Error
    group: 2
    description: 'These fields can represent errors of any kind.

      Use them for errors that happen while fetching events or in cases where the
      event itself contains an error.'
    type: group
    fields:
    - name: code
      level: core
      type: keyword
      ignore_above: 1024
      description: Error code describing the error.
    - name: id
      level: core
      type: keyword
      ignore_above: 1024
      description: Unique identifier for the error.
    - name: message
      level: core
      type: text
      description: Error message.
    - name: stack_trace
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: text
        norms: false
        default_field: false
      description: The stack trace of this error in plain text.
      index: false
    - name: type
      level: extended
      type: keyword
      ignore_above: 1024
      description: The type of the error, for example the class name of the exception.
      example: java.lang.NullPointerException
  - name: event
    title: Event
    group: 2
    description: 'The event fields are used for context information about the log
      or metric event itself.

      A log is defined as an event containing details of something that happened.
      Log events must include the time at which the thing happened. Examples of log
      events include a process starting on a host, a network packet being sent from
      a source to a destination, or a network connection between a client and a server
      being initiated or closed. A metric is defined as an event containing one or
      more numerical measurements and the time at which the measurement was taken.
      Examples of metric events include memory pressure measured on a host and device
      temperature. See the `event.kind` definition in this section for additional
      details about metric and state events.'
    type: group
    fields:
    - name: action
      level: core
      type: keyword
      ignore_above: 1024
      description: 'The action captured by the event.

        This describes the information in the event. It is more specific than `event.category`.
        Examples are `group-add`, `process-started`, `file-created`. The value is
        normally defined by the implementer.'
      example: user-password-change
    - name: category
      level: core
      type: keyword
      ignore_above: 1024
      description: 'This is one of four ECS Categorization Fields, and indicates the
        second level in the ECS category hierarchy.

        `event.category` represents the "big buckets" of ECS categories. For example,
        filtering on `event.category:process` yields all events relating to process
        activity. This field is closely related to `event.type`, which is used as
        a subcategory.

        This field is an array. This will allow proper categorization of some events
        that fall in multiple categories.'
      example: authentication
    - name: code
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Identification code for this event, if one exists.

        Some event sources use event codes to identify messages unambiguously, regardless
        of message language or wording adjustments over time. An example of this is
        the Windows Event ID.'
      example: 4648
    - name: created
      level: core
      type: date
      description: 'event.created contains the date/time when the event was first
        read by an agent, or by your pipeline.

        This field is distinct from @timestamp in that @timestamp typically contain
        the time extracted from the original event.

        In most situations, these two timestamps will be slightly different. The difference
        can be used to calculate the delay between your source generating an event,
        and the time when your agent first processed it. This can be used to monitor
        your agent''s or pipeline''s ability to keep up with your event source.

        In case the two timestamps are identical, @timestamp should be used.'
      example: '2016-05-23T08:05:34.857Z'
    - name: dataset
      level: core
      type: keyword
      ignore_above: 1024
      description: 'Name of the dataset.

        If an event source publishes more than one type of log or events (e.g. access
        log, error log), the dataset is used to specify which one the event comes
        from.

        It''s recommended but not required to start the dataset name with the module
        name, followed by a dot, then the dataset name.'
      example: apache.access
    - name: duration
      level: core
      type: long
      format: duration
      input_format: nanoseconds
      output_format: asMilliseconds
      output_precision: 1
      description: 'Duration of the event in nanoseconds.

        If event.start and event.end are known this value should be the difference
        between the end and start time.'
    - name: end
      level: extended
      type: date
      description: event.end contains the date when the event ended or when the activity
        was last observed.
    - name: hash
      level: extended
      type: keyword
      ignore_above: 1024
      description: Hash (perhaps logstash fingerprint) of raw field to be able to
        demonstrate log integrity.
      example: 123456789012345678901234567890ABCD
    - name: id
      level: core
      type: keyword
      ignore_above: 1024
      description: Unique ID to describe the event.
      example: 8a4f500d
    - name: ingested
      level: core
      type: date
      description: 'Timestamp when an event arrived in the central data store.

        This is different from `@timestamp`, which is when the event originally occurred.  It''s
        also different from `event.created`, which is meant to capture the first time
        an agent saw the event.

        In normal conditions, assuming no tampering, the timestamps should chronologically
        look like this: `@timestamp` < `event.created` < `event.ingested`.'
      example: '2016-05-23T08:05:35.101Z'
      default_field: false
    - name: kind
      level: core
      type: keyword
      ignore_above: 1024
      description: 'This is one of four ECS Categorization Fields, and indicates the
        highest level in the ECS category hierarchy.

        `event.kind` gives high-level information about what type of information the
        event contains, without being specific to the contents of the event. For example,
        values of this field distinguish alert events from metric events.

        The value of this field can be used to inform how these kinds of events should
        be handled. They may warrant different retention, different access control,
        it may also help understand whether the data coming in at a regular interval
        or not.'
      example: alert
    - name: module
      level: core
      type: keyword
      ignore_above: 1024
      description: 'Name of the module this data is coming from.

        If your monitoring agent supports the concept of modules or plugins to process
        events of a given source (e.g. Apache logs), `event.module` should contain
        the name of this module.'
      example: apache
    - name: original
      level: core
      type: keyword
      ignore_above: 1024
      description: 'Raw text message of entire event. Used to demonstrate log integrity.

        This field is not indexed and doc_values are disabled. It cannot be searched,
        but it can be retrieved from `_source`.'
      example: Sep 19 08:26:10 host CEF:0&#124;Security&#124; threatmanager&#124;1.0&#124;100&#124;
        worm successfully stopped&#124;10&#124;src=10.0.0.1 dst=2.1.2.2spt=1232
      index: false
    - name: outcome
      level: core
      type: keyword
      ignore_above: 1024
      description: 'This is one of four ECS Categorization Fields, and indicates the
        lowest level in the ECS category hierarchy.

        `event.outcome` simply denotes whether the event represents a success or a
        failure from the perspective of the entity that produced the event.

        Note that when a single transaction is described in multiple events, each
        event may populate different values of `event.outcome`, according to their
        perspective.

        Also note that in the case of a compound event (a single event that contains
        multiple logical events), this field should be populated with the value that
        best captures the overall success or failure from the perspective of the event
        producer.

        Further note that not all events will have an associated outcome. For example,
        this field is generally not populated for metric events, events with `event.type:info`,
        or any events for which an outcome does not make logical sense.'
      example: success
    - name: provider
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Source of the event.

        Event transports such as Syslog or the Windows Event Log typically mention
        the source of an event. It can be the name of the software that generated
        the event (e.g. Sysmon, httpd), or of a subsystem of the operating system
        (kernel, Microsoft-Windows-Security-Auditing).'
      example: kernel
    - name: reason
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Reason why this event happened, according to the source.

        This describes the why of a particular action or outcome captured in the event.
        Where `event.action` captures the action from the event, `event.reason` describes
        why that action was taken. For example, a web proxy with an `event.action`
        which denied the request may also populate `event.reason` with the reason
        why (e.g. `blocked site`).'
      example: Terminated an unexpected process
      default_field: false
    - name: reference
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Reference URL linking to additional information about this event.

        This URL links to a static definition of the this event. Alert events, indicated
        by `event.kind:alert`, are a common use case for this field.'
      example: https://system.example.com/event/#0001234
      default_field: false
    - name: risk_score
      level: core
      type: float
      description: Risk score or priority of the event (e.g. security solutions).
        Use your system's original value here.
    - name: risk_score_norm
      level: extended
      type: float
      description: 'Normalized risk score or priority of the event, on a scale of
        0 to 100.

        This is mainly useful if you use more than one system that assigns risk scores,
        and you want to see a normalized value across all systems.'
    - name: sequence
      level: extended
      type: long
      format: string
      description: 'Sequence number of the event.

        The sequence number is a value published by some event sources, to make the
        exact ordering of events unambiguous, regardless of the timestamp precision.'
    - name: severity
      level: core
      type: long
      format: string
      description: 'The numeric severity of the event according to your event source.

        What the different severity values mean can be different between sources and
        use cases. It''s up to the implementer to make sure severities are consistent
        across events from the same source.

        The Syslog severity belongs in `log.syslog.severity.code`. `event.severity`
        is meant to represent the severity according to the event source (e.g. firewall,
        IDS). If the event source does not publish its own severity, you may optionally
        copy the `log.syslog.severity.code` to `event.severity`.'
      example: 7
    - name: start
      level: extended
      type: date
      description: event.start contains the date when the event started or when the
        activity was first observed.
    - name: timezone
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'This field should be populated when the event''s timestamp does
        not include timezone information already (e.g. default Syslog timestamps).
        It''s optional otherwise.

        Acceptable timezone formats are: a canonical ID (e.g. "Europe/Amsterdam"),
        abbreviated (e.g. "EST") or an HH:mm differential (e.g. "-05:00").'
    - name: type
      level: core
      type: keyword
      ignore_above: 1024
      description: 'This is one of four ECS Categorization Fields, and indicates the
        third level in the ECS category hierarchy.

        `event.type` represents a categorization "sub-bucket" that, when used along
        with the `event.category` field values, enables filtering events down to a
        level appropriate for single visualization.

        This field is an array. This will allow proper categorization of some events
        that fall in multiple event types.'
    - name: url
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'URL linking to an external system to continue investigation of
        this event.

        This URL links to another system where in-depth investigation of the specific
        occurrence of this event can take place. Alert events, indicated by `event.kind:alert`,
        are a common use case for this field.'
      example: https://mysystem.example.com/alert/5271dedb-f5b0-4218-87f0-4ac4870a38fe
      default_field: false
  - name: file
    title: File
    group: 2
    description: 'A file is defined as a set of information that has been created
      on, or has existed on a filesystem.

      File objects can be associated with host events, network events, and/or file
      events (e.g., those produced by File Integrity Monitoring [FIM] products or
      services). File fields provide details about the affected file associated with
      the event or metric.'
    type: group
    fields:
    - name: accessed
      level: extended
      type: date
      description: 'Last time the file was accessed.

        Note that not all filesystems keep track of access time.'
    - name: attributes
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Array of file attributes.

        Attributes names will vary by platform. Here''s a non-exhaustive list of values
        that are expected in this field: archive, compressed, directory, encrypted,
        execute, hidden, read, readonly, system, write.'
      example: '["readonly", "system"]'
      default_field: false
    - name: code_signature.exists
      level: core
      type: boolean
      description: Boolean to capture if a signature is present.
      example: 'true'
      default_field: false
    - name: code_signature.status
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Additional information about the certificate status.

        This is useful for logging cryptographic errors with the certificate validity
        or trust status. Leave unpopulated if the validity or trust of the certificate
        was unchecked.'
      example: ERROR_UNTRUSTED_ROOT
      default_field: false
    - name: code_signature.subject_name
      level: core
      type: keyword
      ignore_above: 1024
      description: Subject name of the code signer
      example: Microsoft Corporation
      default_field: false
    - name: code_signature.trusted
      level: extended
      type: boolean
      description: 'Stores the trust status of the certificate chain.

        Validating the trust of the certificate chain may be complicated, and this
        field should only be populated by tools that actively check the status.'
      example: 'true'
      default_field: false
    - name: code_signature.valid
      level: extended
      type: boolean
      description: 'Boolean to capture if the digital signature is verified against
        the binary content.

        Leave unpopulated if a certificate was unchecked.'
      example: 'true'
      default_field: false
    - name: created
      level: extended
      type: date
      description: 'File creation time.

        Note that not all filesystems store the creation time.'
    - name: ctime
      level: extended
      type: date
      description: 'Last time the file attributes or metadata changed.

        Note that changes to the file content will update `mtime`. This implies `ctime`
        will be adjusted at the same time, since `mtime` is an attribute of the file.'
    - name: device
      level: extended
      type: keyword
      ignore_above: 1024
      description: Device that is the source of the file.
      example: sda
    - name: directory
      level: extended
      type: keyword
      ignore_above: 1024
      description: Directory where the file is located. It should include the drive
        letter, when appropriate.
      example: /home/alice
    - name: drive_letter
      level: extended
      type: keyword
      ignore_above: 1
      description: 'Drive letter where the file is located. This field is only relevant
        on Windows.

        The value should be uppercase, and not include the colon.'
      example: C
      default_field: false
    - name: extension
      level: extended
      type: keyword
      ignore_above: 1024
      description: File extension.
      example: png
    - name: gid
      level: extended
      type: keyword
      ignore_above: 1024
      description: Primary group ID (GID) of the file.
      example: '1001'
    - name: group
      level: extended
      type: keyword
      ignore_above: 1024
      description: Primary group name of the file.
      example: alice
    - name: hash.md5
      level: extended
      type: keyword
      ignore_above: 1024
      description: MD5 hash.
    - name: hash.sha1
      level: extended
      type: keyword
      ignore_above: 1024
      description: SHA1 hash.
    - name: hash.sha256
      level: extended
      type: keyword
      ignore_above: 1024
      description: SHA256 hash.
    - name: hash.sha512
      level: extended
      type: keyword
      ignore_above: 1024
      description: SHA512 hash.
    - name: inode
      level: extended
      type: keyword
      ignore_above: 1024
      description: Inode representing the file in the filesystem.
      example: '256383'
    - name: mime_type
      level: extended
      type: keyword
      ignore_above: 1024
      description: MIME type should identify the format of the file or stream of bytes
        using https://www.iana.org/assignments/media-types/media-types.xhtml[IANA
        official types], where possible. When more than one type is applicable, the
        most specific type should be used.
      default_field: false
    - name: mode
      level: extended
      type: keyword
      ignore_above: 1024
      description: Mode of the file in octal representation.
      example: '0640'
    - name: mtime
      level: extended
      type: date
      description: Last time the file content was modified.
    - name: name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Name of the file including the extension, without the directory.
      example: example.png
    - name: owner
      level: extended
      type: keyword
      ignore_above: 1024
      description: File owner's username.
      example: alice
    - name: path
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: text
        norms: false
        default_field: false
      description: Full path to the file, including the file name. It should include
        the drive letter, when appropriate.
      example: /home/alice/example.png
    - name: pe.architecture
      level: extended
      type: keyword
      ignore_above: 1024
      description: CPU architecture target for the file.
      example: x64
      default_field: false
    - name: pe.company
      level: extended
      type: keyword
      ignore_above: 1024
      description: Internal company name of the file, provided at compile-time.
      example: Microsoft Corporation
      default_field: false
    - name: pe.description
      level: extended
      type: keyword
      ignore_above: 1024
      description: Internal description of the file, provided at compile-time.
      example: Paint
      default_field: false
    - name: pe.file_version
      level: extended
      type: keyword
      ignore_above: 1024
      description: Internal version of the file, provided at compile-time.
      example: 6.3.9600.17415
      default_field: false
    - name: pe.imphash
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'A hash of the imports in a PE file. An imphash -- or import hash
        -- can be used to fingerprint binaries even after recompilation or other code-level
        transformations have occurred, which would change more traditional hash values.

        Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.'
      example: 0c6803c4e922103c4dca5963aad36ddf
      default_field: false
    - name: pe.original_file_name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Internal name of the file, provided at compile-time.
      example: MSPAINT.EXE
      default_field: false
    - name: pe.product
      level: extended
      type: keyword
      ignore_above: 1024
      description: Internal product name of the file, provided at compile-time.
      example: "Microsoft\xAE Windows\xAE Operating System"
      default_field: false
    - name: size
      level: extended
      type: long
      description: 'File size in bytes.

        Only relevant when `file.type` is "file".'
      example: 16384
    - name: target_path
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: text
        norms: false
        default_field: false
      description: Target path for symlinks.
    - name: type
      level: extended
      type: keyword
      ignore_above: 1024
      description: File type (file, dir, or symlink).
      example: file
    - name: uid
      level: extended
      type: keyword
      ignore_above: 1024
      description: The user ID (UID) or security identifier (SID) of the file owner.
      example: '1001'
    - name: x509.alternative_names
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of subject alternative names (SAN). Name types vary by certificate
        authority and certificate type but commonly contain IP addresses, DNS names
        (and wildcards), and email addresses.
      example: '*.elastic.co'
      default_field: false
    - name: x509.issuer.common_name
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of common name (CN) of issuing certificate authority.
      example: Example SHA2 High Assurance Server CA
      default_field: false
    - name: x509.issuer.country
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of country (C) codes
      example: US
      default_field: false
    - name: x509.issuer.distinguished_name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Distinguished name (DN) of issuing certificate authority.
      example: C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance
        Server CA
      default_field: false
    - name: x509.issuer.locality
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of locality names (L)
      example: Mountain View
      default_field: false
    - name: x509.issuer.organization
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of organizations (O) of issuing certificate authority.
      example: Example Inc
      default_field: false
    - name: x509.issuer.organizational_unit
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of organizational units (OU) of issuing certificate authority.
      example: www.example.com
      default_field: false
    - name: x509.issuer.state_or_province
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of state or province names (ST, S, or P)
      example: California
      default_field: false
    - name: x509.not_after
      level: extended
      type: date
      description: Time at which the certificate is no longer considered valid.
      example: 2020-07-16 03:15:39+00:00
      default_field: false
    - name: x509.not_before
      level: extended
      type: date
      description: Time at which the certificate is first considered valid.
      example: 2019-08-16 01:40:25+00:00
      default_field: false
    - name: x509.public_key_algorithm
      level: extended
      type: keyword
      ignore_above: 1024
      description: Algorithm used to generate the public key.
      example: RSA
      default_field: false
    - name: x509.public_key_curve
      level: extended
      type: keyword
      ignore_above: 1024
      description: The curve used by the elliptic curve public key algorithm. This
        is algorithm specific.
      example: nistp521
      default_field: false
    - name: x509.public_key_exponent
      level: extended
      type: long
      description: Exponent used to derive the public key. This is algorithm specific.
      example: 65537
      index: false
      default_field: false
    - name: x509.public_key_size
      level: extended
      type: long
      description: The size of the public key space in bits.
      example: 2048
      default_field: false
    - name: x509.serial_number
      level: extended
      type: keyword
      ignore_above: 1024
      description: Unique serial number issued by the certificate authority. For consistency,
        if this value is alphanumeric, it should be formatted without colons and uppercase
        characters.
      example: 55FBB9C7DEBF09809D12CCAA
      default_field: false
    - name: x509.signature_algorithm
      level: extended
      type: keyword
      ignore_above: 1024
      description: Identifier for certificate signature algorithm. We recommend using
        names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353.
      example: SHA256-RSA
      default_field: false
    - name: x509.subject.common_name
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of common names (CN) of subject.
      example: shared.global.example.net
      default_field: false
    - name: x509.subject.country
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of country (C) code
      example: US
      default_field: false
    - name: x509.subject.distinguished_name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Distinguished name (DN) of the certificate subject entity.
      example: C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net
      default_field: false
    - name: x509.subject.locality
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of locality names (L)
      example: San Francisco
      default_field: false
    - name: x509.subject.organization
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of organizations (O) of subject.
      example: Example, Inc.
      default_field: false
    - name: x509.subject.organizational_unit
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of organizational units (OU) of subject.
      default_field: false
    - name: x509.subject.state_or_province
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of state or province names (ST, S, or P)
      example: California
      default_field: false
    - name: x509.version_number
      level: extended
      type: keyword
      ignore_above: 1024
      description: Version of x509 format.
      example: 3
      default_field: false
  - name: geo
    title: Geo
    group: 2
    description: 'Geo fields can carry data about a specific location related to an
      event.

      This geolocation information can be derived from techniques such as Geo IP,
      or be user-supplied.'
    type: group
    fields:
    - name: city_name
      level: core
      type: keyword
      ignore_above: 1024
      description: City name.
      example: Montreal
    - name: continent_name
      level: core
      type: keyword
      ignore_above: 1024
      description: Name of the continent.
      example: North America
    - name: country_iso_code
      level: core
      type: keyword
      ignore_above: 1024
      description: Country ISO code.
      example: CA
    - name: country_name
      level: core
      type: keyword
      ignore_above: 1024
      description: Country name.
      example: Canada
    - name: location
      level: core
      type: geo_point
      description: Longitude and latitude.
      example: '{ "lon": -73.614830, "lat": 45.505918 }'
    - name: name
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'User-defined description of a location, at the level of granularity
        they care about.

        Could be the name of their data centers, the floor number, if this describes
        a local physical entity, city names.

        Not typically used in automated geolocation.'
      example: boston-dc
    - name: region_iso_code
      level: core
      type: keyword
      ignore_above: 1024
      description: Region ISO code.
      example: CA-QC
    - name: region_name
      level: core
      type: keyword
      ignore_above: 1024
      description: Region name.
      example: Quebec
  - name: group
    title: Group
    group: 2
    description: The group fields are meant to represent groups that are relevant
      to the event.
    type: group
    fields:
    - name: domain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Name of the directory the group is a member of.

        For example, an LDAP or Active Directory domain name.'
    - name: id
      level: extended
      type: keyword
      ignore_above: 1024
      description: Unique identifier for the group on the system/platform.
    - name: name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Name of the group.
  - name: hash
    title: Hash
    group: 2
    description: 'The hash fields represent different hash algorithms and their values.

      Field names for common hashes (e.g. MD5, SHA1) are predefined. Add fields for
      other hashes by lowercasing the hash algorithm name and using underscore separators
      as appropriate (snake case, e.g. sha3_512).'
    type: group
    fields:
    - name: md5
      level: extended
      type: keyword
      ignore_above: 1024
      description: MD5 hash.
    - name: sha1
      level: extended
      type: keyword
      ignore_above: 1024
      description: SHA1 hash.
    - name: sha256
      level: extended
      type: keyword
      ignore_above: 1024
      description: SHA256 hash.
    - name: sha512
      level: extended
      type: keyword
      ignore_above: 1024
      description: SHA512 hash.
  - name: host
    title: Host
    group: 2
    description: 'A host is defined as a general computing instance.

      ECS host.* fields should be populated with details about the host on which the
      event happened, or from which the measurement was taken. Host types include
      hardware, virtual machines, Docker containers, and Kubernetes nodes.'
    type: group
    fields:
    - name: architecture
      level: core
      type: keyword
      ignore_above: 1024
      description: Operating system architecture.
      example: x86_64
    - name: domain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Name of the domain of which the host is a member.

        For example, on Windows this could be the host''s Active Directory domain
        or NetBIOS domain name. For Linux this could be the domain of the host''s
        LDAP provider.'
      example: CONTOSO
      default_field: false
    - name: geo.city_name
      level: core
      type: keyword
      ignore_above: 1024
      description: City name.
      example: Montreal
    - name: geo.continent_name
      level: core
      type: keyword
      ignore_above: 1024
      description: Name of the continent.
      example: North America
    - name: geo.country_iso_code
      level: core
      type: keyword
      ignore_above: 1024
      description: Country ISO code.
      example: CA
    - name: geo.country_name
      level: core
      type: keyword
      ignore_above: 1024
      description: Country name.
      example: Canada
    - name: geo.location
      level: core
      type: geo_point
      description: Longitude and latitude.
      example: '{ "lon": -73.614830, "lat": 45.505918 }'
    - name: geo.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'User-defined description of a location, at the level of granularity
        they care about.

        Could be the name of their data centers, the floor number, if this describes
        a local physical entity, city names.

        Not typically used in automated geolocation.'
      example: boston-dc
    - name: geo.region_iso_code
      level: core
      type: keyword
      ignore_above: 1024
      description: Region ISO code.
      example: CA-QC
    - name: geo.region_name
      level: core
      type: keyword
      ignore_above: 1024
      description: Region name.
      example: Quebec
    - name: hostname
      level: core
      type: keyword
      ignore_above: 1024
      description: 'Hostname of the host.

        It normally contains what the `hostname` command returns on the host machine.'
    - name: id
      level: core
      type: keyword
      ignore_above: 1024
      description: 'Unique host id.

        As hostname is not always unique, use values that are meaningful in your environment.

        Example: The current usage of `beat.name`.'
    - name: ip
      level: core
      type: ip
      description: Host ip addresses.
    - name: mac
      level: core
      type: keyword
      ignore_above: 1024
      description: Host mac addresses.
    - name: name
      level: core
      type: keyword
      ignore_above: 1024
      description: 'Name of the host.

        It can contain what `hostname` returns on Unix systems, the fully qualified
        domain name, or a name specified by the user. The sender decides which value
        to use.'
    - name: os.family
      level: extended
      type: keyword
      ignore_above: 1024
      description: OS family (such as redhat, debian, freebsd, windows).
      example: debian
    - name: os.full
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: text
        norms: false
        default_field: false
      description: Operating system name, including the version or code name.
      example: Mac OS Mojave
    - name: os.kernel
      level: extended
      type: keyword
      ignore_above: 1024
      description: Operating system kernel version as a raw string.
      example: 4.4.0-112-generic
    - name: os.name
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: text
        norms: false
        default_field: false
      description: Operating system name, without the version.
      example: Mac OS X
    - name: os.platform
      level: extended
      type: keyword
      ignore_above: 1024
      description: Operating system platform (such centos, ubuntu, windows).
      example: darwin
    - name: os.version
      level: extended
      type: keyword
      ignore_above: 1024
      description: Operating system version as a raw string.
      example: 10.14.1
    - name: type
      level: core
      type: keyword
      ignore_above: 1024
      description: 'Type of host.

        For Cloud providers this can be the machine type like `t2.medium`. If vm,
        this could be the container, for example, or other information meaningful
        in your environment.'
    - name: uptime
      level: extended
      type: long
      description: Seconds the host has been up.
      example: 1325
    - name: user.domain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Name of the directory the user is a member of.

        For example, an LDAP or Active Directory domain name.'
    - name: user.email
      level: extended
      type: keyword
      ignore_above: 1024
      description: User email address.
    - name: user.full_name
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: text
        norms: false
        default_field: false
      description: User's full name, if available.
      example: Albert Einstein
    - name: user.group.domain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Name of the directory the group is a member of.

        For example, an LDAP or Active Directory domain name.'
    - name: user.group.id
      level: extended
      type: keyword
      ignore_above: 1024
      description: Unique identifier for the group on the system/platform.
    - name: user.group.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Name of the group.
    - name: user.hash
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Unique user hash to correlate information for a user in anonymized
        form.

        Useful if `user.id` or `user.name` contain confidential information and cannot
        be used.'
    - name: user.id
      level: core
      type: keyword
      ignore_above: 1024
      description: Unique identifier of the user.
    - name: user.name
      level: core
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: text
        norms: false
        default_field: false
      description: Short name or login of the user.
      example: albert
    - name: user.roles
      level: extended
      type: keyword
      ignore_above: 1024
      description: Array of user roles at the time of the event.
      example: '["kibana_admin", "reporting_user"]'
      default_field: false
  - name: http
    title: HTTP
    group: 2
    description: Fields related to HTTP activity. Use the `url` field set to store
      the url of the request.
    type: group
    fields:
    - name: request.body.bytes
      level: extended
      type: long
      format: bytes
      description: Size in bytes of the request body.
      example: 887
    - name: request.body.content
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: text
        norms: false
        default_field: false
      description: The full HTTP request body.
      example: Hello world
    - name: request.bytes
      level: extended
      type: long
      format: bytes
      description: Total size in bytes of the request (body and headers).
      example: 1437
    - name: request.method
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'HTTP request method.

        Prior to ECS 1.6.0 the following guidance was provided:

        "The field value must be normalized to lowercase for querying."

        As of ECS 1.6.0, the guidance is deprecated because the original case of the
        method may be useful in anomaly detection.  Original case will be mandated
        in ECS 2.0.0'
      example: GET, POST, PUT, PoST
    - name: request.referrer
      level: extended
      type: keyword
      ignore_above: 1024
      description: Referrer for this HTTP request.
      example: https://blog.example.com/
    - name: response.body.bytes
      level: extended
      type: long
      format: bytes
      description: Size in bytes of the response body.
      example: 887
    - name: response.body.content
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: text
        norms: false
        default_field: false
      description: The full HTTP response body.
      example: Hello world
    - name: response.bytes
      level: extended
      type: long
      format: bytes
      description: Total size in bytes of the response (body and headers).
      example: 1437
    - name: response.status_code
      level: extended
      type: long
      format: string
      description: HTTP response status code.
      example: 404
    - name: version
      level: extended
      type: keyword
      ignore_above: 1024
      description: HTTP version.
      example: 1.1
  - name: interface
    title: Interface
    group: 2
    description: The interface fields are used to record ingress and egress interface
      information when reported by an observer (e.g. firewall, router, load balancer)
      in the context of the observer handling a network connection.  In the case of
      a single observer interface (e.g. network sensor on a span port) only the observer.ingress
      information should be populated.
    type: group
    fields:
    - name: alias
      level: extended
      type: keyword
      ignore_above: 1024
      description: Interface alias as reported by the system, typically used in firewall
        implementations for e.g. inside, outside, or dmz logical interface naming.
      example: outside
      default_field: false
    - name: id
      level: extended
      type: keyword
      ignore_above: 1024
      description: Interface ID as reported by an observer (typically SNMP interface
        ID).
      example: 10
      default_field: false
    - name: name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Interface name as reported by the system.
      example: eth0
      default_field: false
  - name: log
    title: Log
    group: 2
    description: 'Details about the event''s logging mechanism or logging transport.

      The log.* fields are typically populated with details about the logging mechanism
      used to create and/or transport the event. For example, syslog details belong
      under `log.syslog.*`.

      The details specific to your event source are typically not logged under `log.*`,
      but rather in `event.*` or in other ECS fields.'
    type: group
    fields:
    - name: file.path
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Full path to the log file this event came from, including the
        file name. It should include the drive letter, when appropriate.

        If the event wasn''t read from a log file, do not populate this field.'
      example: /var/log/fun-times.log
      default_field: false
    - name: level
      level: core
      type: keyword
      ignore_above: 1024
      description: 'Original log level of the log event.

        If the source of the event provides a log level or textual severity, this
        is the one that goes in `log.level`. If your source doesn''t specify one,
        you may put your event transport''s severity here (e.g. Syslog severity).

        Some examples are `warn`, `err`, `i`, `informational`.'
      example: error
    - name: logger
      level: core
      type: keyword
      ignore_above: 1024
      description: The name of the logger inside an application. This is usually the
        name of the class which initialized the logger, or can be a custom name.
      example: org.elasticsearch.bootstrap.Bootstrap
    - name: origin.file.line
      level: extended
      type: integer
      description: The line number of the file containing the source code which originated
        the log event.
      example: 42
    - name: origin.file.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The name of the file containing the source code which originated
        the log event.

        Note that this field is not meant to capture the log file. The correct field
        to capture the log file is `log.file.path`.'
      example: Bootstrap.java
    - name: origin.function
      level: extended
      type: keyword
      ignore_above: 1024
      description: The name of the function or method which originated the log event.
      example: init
    - name: original
      level: core
      type: keyword
      ignore_above: 1024
      description: 'This is the original log message and contains the full log message
        before splitting it up in multiple parts.

        In contrast to the `message` field which can contain an extracted part of
        the log message, this field contains the original, full log message. It can
        have already some modifications applied like encoding or new lines removed
        to clean up the log message.

        This field is not indexed and doc_values are disabled so it can''t be queried
        but the value can be retrieved from `_source`.'
      example: Sep 19 08:26:10 localhost My log
      index: false
    - name: syslog
      level: extended
      type: object
      description: The Syslog metadata of the event, if the event was transmitted
        via Syslog. Please see RFCs 5424 or 3164.
    - name: syslog.facility.code
      level: extended
      type: long
      format: string
      description: 'The Syslog numeric facility of the log event, if available.

        According to RFCs 5424 and 3164, this value should be an integer between 0
        and 23.'
      example: 23
    - name: syslog.facility.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: The Syslog text-based facility of the log event, if available.
      example: local7
    - name: syslog.priority
      level: extended
      type: long
      format: string
      description: 'Syslog numeric priority of the event, if available.

        According to RFCs 5424 and 3164, the priority is 8 * facility + severity.
        This number is therefore expected to contain a value between 0 and 191.'
      example: 135
    - name: syslog.severity.code
      level: extended
      type: long
      description: 'The Syslog numeric severity of the log event, if available.

        If the event source publishing via Syslog provides a different numeric severity
        value (e.g. firewall, IDS), your source''s numeric severity should go to `event.severity`.
        If the event source does not specify a distinct severity, you can optionally
        copy the Syslog severity to `event.severity`.'
      example: 3
    - name: syslog.severity.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The Syslog numeric severity of the log event, if available.

        If the event source publishing via Syslog provides a different severity value
        (e.g. firewall, IDS), your source''s text severity should go to `log.level`.
        If the event source does not specify a distinct severity, you can optionally
        copy the Syslog severity to `log.level`.'
      example: Error
  - name: network
    title: Network
    group: 2
    description: 'The network is defined as the communication path over which a host
      or network event happens.

      The network.* fields should be populated with details about the network activity
      associated with an event.'
    type: group
    fields:
    - name: application
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'A name given to an application level protocol. This can be arbitrarily
        assigned for things like microservices, but also apply to things like skype,
        icq, facebook, twitter. This would be used in situations where the vendor
        or service can be decoded such as from the source/dest IP owners, ports, or
        wire format.

        The field value must be normalized to lowercase for querying. See the documentation
        section "Implementing ECS".'
      example: aim
    - name: bytes
      level: core
      type: long
      format: bytes
      description: 'Total bytes transferred in both directions.

        If `source.bytes` and `destination.bytes` are known, `network.bytes` is their
        sum.'
      example: 368
    - name: community_id
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'A hash of source and destination IPs and ports, as well as the
        protocol used in a communication. This is a tool-agnostic standard to identify
        flows.

        Learn more at https://github.com/corelight/community-id-spec.'
      example: 1:hO+sN4H+MG5MY/8hIrXPqc4ZQz0=
    - name: direction
      level: core
      type: keyword
      ignore_above: 1024
      description: "Direction of the network traffic.\nRecommended values are:\n \
        \ * inbound\n  * outbound\n  * internal\n  * external\n  * unknown\n\nWhen\
        \ mapping events from a host-based monitoring context, populate this field\
        \ from the host's point of view.\nWhen mapping events from a network or perimeter-based\
        \ monitoring context, populate this field from the point of view of your network\
        \ perimeter."
      example: inbound
    - name: forwarded_ip
      level: core
      type: ip
      description: Host IP address when the source IP address is the proxy.
      example: 192.1.1.2
    - name: iana_number
      level: extended
      type: keyword
      ignore_above: 1024
      description: IANA Protocol Number (https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml).
        Standardized list of protocols. This aligns well with NetFlow and sFlow related
        logs which use the IANA Protocol Number.
      example: 6
    - name: inner
      level: extended
      type: object
      description: Network.inner fields are added in addition to network.vlan fields
        to describe  the innermost VLAN when q-in-q VLAN tagging is present. Allowed
        fields include  vlan.id and vlan.name. Inner vlan fields are typically used
        when sending traffic with multiple 802.1q encapsulations to a network sensor
        (e.g. Zeek, Wireshark.)
      default_field: false
    - name: inner.vlan.id
      level: extended
      type: keyword
      ignore_above: 1024
      description: VLAN ID as reported by the observer.
      example: 10
      default_field: false
    - name: inner.vlan.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Optional VLAN name as reported by the observer.
      example: outside
      default_field: false
    - name: name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Name given by operators to sections of their network.
      example: Guest Wifi
    - name: packets
      level: core
      type: long
      description: 'Total packets transferred in both directions.

        If `source.packets` and `destination.packets` are known, `network.packets`
        is their sum.'
      example: 24
    - name: protocol
      level: core
      type: keyword
      ignore_above: 1024
      description: 'L7 Network protocol name. ex. http, lumberjack, transport protocol.

        The field value must be normalized to lowercase for querying. See the documentation
        section "Implementing ECS".'
      example: http
    - name: transport
      level: core
      type: keyword
      ignore_above: 1024
      description: 'Same as network.iana_number, but instead using the Keyword name
        of the transport layer (udp, tcp, ipv6-icmp, etc.)

        The field value must be normalized to lowercase for querying. See the documentation
        section "Implementing ECS".'
      example: tcp
    - name: type
      level: core
      type: keyword
      ignore_above: 1024
      description: 'In the OSI Model this would be the Network Layer. ipv4, ipv6,
        ipsec, pim, etc

        The field value must be normalized to lowercase for querying. See the documentation
        section "Implementing ECS".'
      example: ipv4
    - name: vlan.id
      level: extended
      type: keyword
      ignore_above: 1024
      description: VLAN ID as reported by the observer.
      example: 10
      default_field: false
    - name: vlan.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Optional VLAN name as reported by the observer.
      example: outside
      default_field: false
  - name: observer
    title: Observer
    group: 2
    description: 'An observer is defined as a special network, security, or application
      device used to detect, observe, or create network, security, or application-related
      events and metrics.

      This could be a custom hardware appliance or a server that has been configured
      to run special network, security, or application software. Examples include
      firewalls, web proxies, intrusion detection/prevention systems, network monitoring
      sensors, web application firewalls, data loss prevention systems, and APM servers.
      The observer.* fields shall be populated with details of the system, if any,
      that detects, observes and/or creates a network, security, or application event
      or metric. Message queues and ETL components used in processing events or metrics
      are not considered observers in ECS.'
    type: group
    fields:
    - name: egress
      level: extended
      type: object
      description: Observer.egress holds information like interface number and name,
        vlan, and zone information to  classify egress traffic.  Single armed monitoring
        such as a network sensor on a span port should  only use observer.ingress
        to categorize traffic.
      default_field: false
    - name: egress.interface.alias
      level: extended
      type: keyword
      ignore_above: 1024
      description: Interface alias as reported by the system, typically used in firewall
        implementations for e.g. inside, outside, or dmz logical interface naming.
      example: outside
      default_field: false
    - name: egress.interface.id
      level: extended
      type: keyword
      ignore_above: 1024
      description: Interface ID as reported by an observer (typically SNMP interface
        ID).
      example: 10
      default_field: false
    - name: egress.interface.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Interface name as reported by the system.
      example: eth0
      default_field: false
    - name: egress.vlan.id
      level: extended
      type: keyword
      ignore_above: 1024
      description: VLAN ID as reported by the observer.
      example: 10
      default_field: false
    - name: egress.vlan.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Optional VLAN name as reported by the observer.
      example: outside
      default_field: false
    - name: egress.zone
      level: extended
      type: keyword
      ignore_above: 1024
      description: Network zone of outbound traffic as reported by the observer to
        categorize the destination area of egress  traffic, e.g. Internal, External,
        DMZ, HR, Legal, etc.
      example: Public_Internet
      default_field: false
    - name: geo.city_name
      level: core
      type: keyword
      ignore_above: 1024
      description: City name.
      example: Montreal
    - name: geo.continent_name
      level: core
      type: keyword
      ignore_above: 1024
      description: Name of the continent.
      example: North America
    - name: geo.country_iso_code
      level: core
      type: keyword
      ignore_above: 1024
      description: Country ISO code.
      example: CA
    - name: geo.country_name
      level: core
      type: keyword
      ignore_above: 1024
      description: Country name.
      example: Canada
    - name: geo.location
      level: core
      type: geo_point
      description: Longitude and latitude.
      example: '{ "lon": -73.614830, "lat": 45.505918 }'
    - name: geo.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'User-defined description of a location, at the level of granularity
        they care about.

        Could be the name of their data centers, the floor number, if this describes
        a local physical entity, city names.

        Not typically used in automated geolocation.'
      example: boston-dc
    - name: geo.region_iso_code
      level: core
      type: keyword
      ignore_above: 1024
      description: Region ISO code.
      example: CA-QC
    - name: geo.region_name
      level: core
      type: keyword
      ignore_above: 1024
      description: Region name.
      example: Quebec
    - name: hostname
      level: core
      type: keyword
      ignore_above: 1024
      description: Hostname of the observer.
    - name: ingress
      level: extended
      type: object
      description: Observer.ingress holds information like interface number and name,
        vlan, and zone information to  classify ingress traffic.  Single armed monitoring
        such as a network sensor on a span port should  only use observer.ingress
        to categorize traffic.
      default_field: false
    - name: ingress.interface.alias
      level: extended
      type: keyword
      ignore_above: 1024
      description: Interface alias as reported by the system, typically used in firewall
        implementations for e.g. inside, outside, or dmz logical interface naming.
      example: outside
      default_field: false
    - name: ingress.interface.id
      level: extended
      type: keyword
      ignore_above: 1024
      description: Interface ID as reported by an observer (typically SNMP interface
        ID).
      example: 10
      default_field: false
    - name: ingress.interface.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Interface name as reported by the system.
      example: eth0
      default_field: false
    - name: ingress.vlan.id
      level: extended
      type: keyword
      ignore_above: 1024
      description: VLAN ID as reported by the observer.
      example: 10
      default_field: false
    - name: ingress.vlan.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Optional VLAN name as reported by the observer.
      example: outside
      default_field: false
    - name: ingress.zone
      level: extended
      type: keyword
      ignore_above: 1024
      description: Network zone of incoming traffic as reported by the observer to
        categorize the source area of ingress  traffic. e.g. internal, External, DMZ,
        HR, Legal, etc.
      example: DMZ
      default_field: false
    - name: ip
      level: core
      type: ip
      description: IP addresses of the observer.
    - name: mac
      level: core
      type: keyword
      ignore_above: 1024
      description: MAC addresses of the observer
    - name: name
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Custom name of the observer.

        This is a name that can be given to an observer. This can be helpful for example
        if multiple firewalls of the same model are used in an organization.

        If no custom name is needed, the field can be left empty.'
      example: 1_proxySG
    - name: os.family
      level: extended
      type: keyword
      ignore_above: 1024
      description: OS family (such as redhat, debian, freebsd, windows).
      example: debian
    - name: os.full
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: text
        norms: false
        default_field: false
      description: Operating system name, including the version or code name.
      example: Mac OS Mojave
    - name: os.kernel
      level: extended
      type: keyword
      ignore_above: 1024
      description: Operating system kernel version as a raw string.
      example: 4.4.0-112-generic
    - name: os.name
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: text
        norms: false
        default_field: false
      description: Operating system name, without the version.
      example: Mac OS X
    - name: os.platform
      level: extended
      type: keyword
      ignore_above: 1024
      description: Operating system platform (such centos, ubuntu, windows).
      example: darwin
    - name: os.version
      level: extended
      type: keyword
      ignore_above: 1024
      description: Operating system version as a raw string.
      example: 10.14.1
    - name: product
      level: extended
      type: keyword
      ignore_above: 1024
      description: The product name of the observer.
      example: s200
    - name: serial_number
      level: extended
      type: keyword
      ignore_above: 1024
      description: Observer serial number.
    - name: type
      level: core
      type: keyword
      ignore_above: 1024
      description: 'The type of the observer the data is coming from.

        There is no predefined list of observer types. Some examples are `forwarder`,
        `firewall`, `ids`, `ips`, `proxy`, `poller`, `sensor`, `APM server`.'
      example: firewall
    - name: vendor
      level: core
      type: keyword
      ignore_above: 1024
      description: Vendor name of the observer.
      example: Symantec
    - name: version
      level: core
      type: keyword
      ignore_above: 1024
      description: Observer version.
  - name: organization
    title: Organization
    group: 2
    description: 'The organization fields enrich data with information about the company
      or entity the data is associated with.

      These fields help you arrange or filter data stored in an index by one or multiple
      organizations.'
    type: group
    fields:
    - name: id
      level: extended
      type: keyword
      ignore_above: 1024
      description: Unique identifier for the organization.
    - name: name
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: text
        norms: false
        default_field: false
      description: Organization name.
  - name: os
    title: Operating System
    group: 2
    description: The OS fields contain information about the operating system.
    type: group
    fields:
    - name: family
      level: extended
      type: keyword
      ignore_above: 1024
      description: OS family (such as redhat, debian, freebsd, windows).
      example: debian
    - name: full
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: text
        norms: false
        default_field: false
      description: Operating system name, including the version or code name.
      example: Mac OS Mojave
    - name: kernel
      level: extended
      type: keyword
      ignore_above: 1024
      description: Operating system kernel version as a raw string.
      example: 4.4.0-112-generic
    - name: name
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: text
        norms: false
        default_field: false
      description: Operating system name, without the version.
      example: Mac OS X
    - name: platform
      level: extended
      type: keyword
      ignore_above: 1024
      description: Operating system platform (such centos, ubuntu, windows).
      example: darwin
    - name: version
      level: extended
      type: keyword
      ignore_above: 1024
      description: Operating system version as a raw string.
      example: 10.14.1
  - name: package
    title: Package
    group: 2
    description: These fields contain information about an installed software package.
      It contains general information about a package, such as name, version or size.
      It also contains installation details, such as time or location.
    type: group
    fields:
    - name: architecture
      level: extended
      type: keyword
      ignore_above: 1024
      description: Package architecture.
      example: x86_64
    - name: build_version
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Additional information about the build version of the installed
        package.

        For example use the commit SHA of a non-released package.'
      example: 36f4f7e89dd61b0988b12ee000b98966867710cd
      default_field: false
    - name: checksum
      level: extended
      type: keyword
      ignore_above: 1024
      description: Checksum of the installed package for verification.
      example: 68b329da9893e34099c7d8ad5cb9c940
    - name: description
      level: extended
      type: keyword
      ignore_above: 1024
      description: Description of the package.
      example: Open source programming language to build simple/reliable/efficient
        software.
    - name: install_scope
      level: extended
      type: keyword
      ignore_above: 1024
      description: Indicating how the package was installed, e.g. user-local, global.
      example: global
    - name: installed
      level: extended
      type: date
      description: Time when package was installed.
    - name: license
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'License under which the package was released.

        Use a short name, e.g. the license identifier from SPDX License List where
        possible (https://spdx.org/licenses/).'
      example: Apache License 2.0
    - name: name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Package name
      example: go
    - name: path
      level: extended
      type: keyword
      ignore_above: 1024
      description: Path where the package is installed.
      example: /usr/local/Cellar/go/1.12.9/
    - name: reference
      level: extended
      type: keyword
      ignore_above: 1024
      description: Home page or reference URL of the software in this package, if
        available.
      example: https://golang.org
      default_field: false
    - name: size
      level: extended
      type: long
      format: string
      description: Package size in bytes.
      example: 62231
    - name: type
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Type of package.

        This should contain the package file type, rather than the package manager
        name. Examples: rpm, dpkg, brew, npm, gem, nupkg, jar.'
      example: rpm
      default_field: false
    - name: version
      level: extended
      type: keyword
      ignore_above: 1024
      description: Package version
      example: 1.12.9
  - name: pe
    title: PE Header
    group: 2
    description: These fields contain Windows Portable Executable (PE) metadata.
    type: group
    fields:
    - name: architecture
      level: extended
      type: keyword
      ignore_above: 1024
      description: CPU architecture target for the file.
      example: x64
      default_field: false
    - name: company
      level: extended
      type: keyword
      ignore_above: 1024
      description: Internal company name of the file, provided at compile-time.
      example: Microsoft Corporation
      default_field: false
    - name: description
      level: extended
      type: keyword
      ignore_above: 1024
      description: Internal description of the file, provided at compile-time.
      example: Paint
      default_field: false
    - name: file_version
      level: extended
      type: keyword
      ignore_above: 1024
      description: Internal version of the file, provided at compile-time.
      example: 6.3.9600.17415
      default_field: false
    - name: imphash
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'A hash of the imports in a PE file. An imphash -- or import hash
        -- can be used to fingerprint binaries even after recompilation or other code-level
        transformations have occurred, which would change more traditional hash values.

        Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.'
      example: 0c6803c4e922103c4dca5963aad36ddf
      default_field: false
    - name: original_file_name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Internal name of the file, provided at compile-time.
      example: MSPAINT.EXE
      default_field: false
    - name: product
      level: extended
      type: keyword
      ignore_above: 1024
      description: Internal product name of the file, provided at compile-time.
      example: "Microsoft\xAE Windows\xAE Operating System"
      default_field: false
  - name: process
    title: Process
    group: 2
    description: 'These fields contain information about a process.

      These fields can help you correlate metrics information with a process id/name
      from a log message.  The `process.pid` often stays in the metric itself and
      is copied to the global field for correlation.'
    type: group
    fields:
    - name: args
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Array of process arguments, starting with the absolute path to
        the executable.

        May be filtered to protect sensitive information.'
      example:
      - /usr/bin/ssh
      - -l
      - user
      - 10.0.0.16
    - name: args_count
      level: extended
      type: long
      description: 'Length of the process.args array.

        This field can be useful for querying or performing bucket analysis on how
        many arguments were provided to start a process. More arguments may be an
        indication of suspicious activity.'
      example: 4
      default_field: false
    - name: code_signature.exists
      level: core
      type: boolean
      description: Boolean to capture if a signature is present.
      example: 'true'
      default_field: false
    - name: code_signature.status
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Additional information about the certificate status.

        This is useful for logging cryptographic errors with the certificate validity
        or trust status. Leave unpopulated if the validity or trust of the certificate
        was unchecked.'
      example: ERROR_UNTRUSTED_ROOT
      default_field: false
    - name: code_signature.subject_name
      level: core
      type: keyword
      ignore_above: 1024
      description: Subject name of the code signer
      example: Microsoft Corporation
      default_field: false
    - name: code_signature.trusted
      level: extended
      type: boolean
      description: 'Stores the trust status of the certificate chain.

        Validating the trust of the certificate chain may be complicated, and this
        field should only be populated by tools that actively check the status.'
      example: 'true'
      default_field: false
    - name: code_signature.valid
      level: extended
      type: boolean
      description: 'Boolean to capture if the digital signature is verified against
        the binary content.

        Leave unpopulated if a certificate was unchecked.'
      example: 'true'
      default_field: false
    - name: command_line
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: text
        norms: false
      description: 'Full command line that started the process, including the absolute
        path to the executable, and all arguments.

        Some arguments may be filtered to protect sensitive information.'
      example: /usr/bin/ssh -l user 10.0.0.16
      default_field: false
    - name: entity_id
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Unique identifier for the process.

        The implementation of this is specified by the data source, but some examples
        of what could be used here are a process-generated UUID, Sysmon Process GUIDs,
        or a hash of some uniquely identifying components of a process.

        Constructing a globally unique identifier is a common practice to mitigate
        PID reuse as well as to identify a specific process over time, across multiple
        monitored hosts.'
      example: c2c455d9f99375d
      default_field: false
    - name: executable
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: text
        norms: false
        default_field: false
      description: Absolute path to the process executable.
      example: /usr/bin/ssh
    - name: exit_code
      level: extended
      type: long
      description: 'The exit code of the process, if this is a termination event.

        The field should be absent if there is no exit code for the event (e.g. process
        start).'
      example: 137
      default_field: false
    - name: hash.md5
      level: extended
      type: keyword
      ignore_above: 1024
      description: MD5 hash.
    - name: hash.sha1
      level: extended
      type: keyword
      ignore_above: 1024
      description: SHA1 hash.
    - name: hash.sha256
      level: extended
      type: keyword
      ignore_above: 1024
      description: SHA256 hash.
    - name: hash.sha512
      level: extended
      type: keyword
      ignore_above: 1024
      description: SHA512 hash.
    - name: name
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: text
        norms: false
        default_field: false
      description: 'Process name.

        Sometimes called program name or similar.'
      example: ssh
    - name: parent.args
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Array of process arguments, starting with the absolute path to
        the executable.

        May be filtered to protect sensitive information.'
      example:
      - /usr/bin/ssh
      - -l
      - user
      - 10.0.0.16
      default_field: false
    - name: parent.args_count
      level: extended
      type: long
      description: 'Length of the process.args array.

        This field can be useful for querying or performing bucket analysis on how
        many arguments were provided to start a process. More arguments may be an
        indication of suspicious activity.'
      example: 4
      default_field: false
    - name: parent.code_signature.exists
      level: core
      type: boolean
      description: Boolean to capture if a signature is present.
      example: 'true'
      default_field: false
    - name: parent.code_signature.status
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Additional information about the certificate status.

        This is useful for logging cryptographic errors with the certificate validity
        or trust status. Leave unpopulated if the validity or trust of the certificate
        was unchecked.'
      example: ERROR_UNTRUSTED_ROOT
      default_field: false
    - name: parent.code_signature.subject_name
      level: core
      type: keyword
      ignore_above: 1024
      description: Subject name of the code signer
      example: Microsoft Corporation
      default_field: false
    - name: parent.code_signature.trusted
      level: extended
      type: boolean
      description: 'Stores the trust status of the certificate chain.

        Validating the trust of the certificate chain may be complicated, and this
        field should only be populated by tools that actively check the status.'
      example: 'true'
      default_field: false
    - name: parent.code_signature.valid
      level: extended
      type: boolean
      description: 'Boolean to capture if the digital signature is verified against
        the binary content.

        Leave unpopulated if a certificate was unchecked.'
      example: 'true'
      default_field: false
    - name: parent.command_line
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: text
        norms: false
      description: 'Full command line that started the process, including the absolute
        path to the executable, and all arguments.

        Some arguments may be filtered to protect sensitive information.'
      example: /usr/bin/ssh -l user 10.0.0.16
      default_field: false
    - name: parent.entity_id
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Unique identifier for the process.

        The implementation of this is specified by the data source, but some examples
        of what could be used here are a process-generated UUID, Sysmon Process GUIDs,
        or a hash of some uniquely identifying components of a process.

        Constructing a globally unique identifier is a common practice to mitigate
        PID reuse as well as to identify a specific process over time, across multiple
        monitored hosts.'
      example: c2c455d9f99375d
      default_field: false
    - name: parent.executable
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: text
        norms: false
      description: Absolute path to the process executable.
      example: /usr/bin/ssh
      default_field: false
    - name: parent.exit_code
      level: extended
      type: long
      description: 'The exit code of the process, if this is a termination event.

        The field should be absent if there is no exit code for the event (e.g. process
        start).'
      example: 137
      default_field: false
    - name: parent.hash.md5
      level: extended
      type: keyword
      ignore_above: 1024
      description: MD5 hash.
      default_field: false
    - name: parent.hash.sha1
      level: extended
      type: keyword
      ignore_above: 1024
      description: SHA1 hash.
      default_field: false
    - name: parent.hash.sha256
      level: extended
      type: keyword
      ignore_above: 1024
      description: SHA256 hash.
      default_field: false
    - name: parent.hash.sha512
      level: extended
      type: keyword
      ignore_above: 1024
      description: SHA512 hash.
      default_field: false
    - name: parent.name
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: text
        norms: false
      description: 'Process name.

        Sometimes called program name or similar.'
      example: ssh
      default_field: false
    - name: parent.pe.architecture
      level: extended
      type: keyword
      ignore_above: 1024
      description: CPU architecture target for the file.
      example: x64
      default_field: false
    - name: parent.pe.company
      level: extended
      type: keyword
      ignore_above: 1024
      description: Internal company name of the file, provided at compile-time.
      example: Microsoft Corporation
      default_field: false
    - name: parent.pe.description
      level: extended
      type: keyword
      ignore_above: 1024
      description: Internal description of the file, provided at compile-time.
      example: Paint
      default_field: false
    - name: parent.pe.file_version
      level: extended
      type: keyword
      ignore_above: 1024
      description: Internal version of the file, provided at compile-time.
      example: 6.3.9600.17415
      default_field: false
    - name: parent.pe.imphash
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'A hash of the imports in a PE file. An imphash -- or import hash
        -- can be used to fingerprint binaries even after recompilation or other code-level
        transformations have occurred, which would change more traditional hash values.

        Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.'
      example: 0c6803c4e922103c4dca5963aad36ddf
      default_field: false
    - name: parent.pe.original_file_name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Internal name of the file, provided at compile-time.
      example: MSPAINT.EXE
      default_field: false
    - name: parent.pe.product
      level: extended
      type: keyword
      ignore_above: 1024
      description: Internal product name of the file, provided at compile-time.
      example: "Microsoft\xAE Windows\xAE Operating System"
      default_field: false
    - name: parent.pgid
      level: extended
      type: long
      format: string
      description: Identifier of the group of processes the process belongs to.
      default_field: false
    - name: parent.pid
      level: core
      type: long
      format: string
      description: Process id.
      example: 4242
      default_field: false
    - name: parent.ppid
      level: extended
      type: long
      format: string
      description: Parent process' pid.
      example: 4241
      default_field: false
    - name: parent.start
      level: extended
      type: date
      description: The time the process started.
      example: '2016-05-23T08:05:34.853Z'
      default_field: false
    - name: parent.thread.id
      level: extended
      type: long
      format: string
      description: Thread ID.
      example: 4242
      default_field: false
    - name: parent.thread.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Thread name.
      example: thread-0
      default_field: false
    - name: parent.title
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: text
        norms: false
      description: 'Process title.

        The proctitle, some times the same as process name. Can also be different:
        for example a browser setting its title to the web page currently opened.'
      default_field: false
    - name: parent.uptime
      level: extended
      type: long
      description: Seconds the process has been up.
      example: 1325
      default_field: false
    - name: parent.working_directory
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: text
        norms: false
      description: The working directory of the process.
      example: /home/alice
      default_field: false
    - name: pe.architecture
      level: extended
      type: keyword
      ignore_above: 1024
      description: CPU architecture target for the file.
      example: x64
      default_field: false
    - name: pe.company
      level: extended
      type: keyword
      ignore_above: 1024
      description: Internal company name of the file, provided at compile-time.
      example: Microsoft Corporation
      default_field: false
    - name: pe.description
      level: extended
      type: keyword
      ignore_above: 1024
      description: Internal description of the file, provided at compile-time.
      example: Paint
      default_field: false
    - name: pe.file_version
      level: extended
      type: keyword
      ignore_above: 1024
      description: Internal version of the file, provided at compile-time.
      example: 6.3.9600.17415
      default_field: false
    - name: pe.imphash
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'A hash of the imports in a PE file. An imphash -- or import hash
        -- can be used to fingerprint binaries even after recompilation or other code-level
        transformations have occurred, which would change more traditional hash values.

        Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.'
      example: 0c6803c4e922103c4dca5963aad36ddf
      default_field: false
    - name: pe.original_file_name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Internal name of the file, provided at compile-time.
      example: MSPAINT.EXE
      default_field: false
    - name: pe.product
      level: extended
      type: keyword
      ignore_above: 1024
      description: Internal product name of the file, provided at compile-time.
      example: "Microsoft\xAE Windows\xAE Operating System"
      default_field: false
    - name: pgid
      level: extended
      type: long
      format: string
      description: Identifier of the group of processes the process belongs to.
    - name: pid
      level: core
      type: long
      format: string
      description: Process id.
      example: 4242
    - name: ppid
      level: extended
      type: long
      format: string
      description: Parent process' pid.
      example: 4241
    - name: start
      level: extended
      type: date
      description: The time the process started.
      example: '2016-05-23T08:05:34.853Z'
    - name: thread.id
      level: extended
      type: long
      format: string
      description: Thread ID.
      example: 4242
    - name: thread.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Thread name.
      example: thread-0
    - name: title
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: text
        norms: false
        default_field: false
      description: 'Process title.

        The proctitle, some times the same as process name. Can also be different:
        for example a browser setting its title to the web page currently opened.'
    - name: uptime
      level: extended
      type: long
      description: Seconds the process has been up.
      example: 1325
    - name: working_directory
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: text
        norms: false
        default_field: false
      description: The working directory of the process.
      example: /home/alice
  - name: registry
    title: Registry
    group: 2
    description: Fields related to Windows Registry operations.
    type: group
    fields:
    - name: data.bytes
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Original bytes written with base64 encoding.

        For Windows registry operations, such as SetValueEx and RegQueryValueEx, this
        corresponds to the data pointed by `lp_data`. This is optional but provides
        better recoverability and should be populated for REG_BINARY encoded values.'
      example: ZQBuAC0AVQBTAAAAZQBuAAAAAAA=
      default_field: false
    - name: data.strings
      level: core
      type: keyword
      ignore_above: 1024
      description: 'Content when writing string types.

        Populated as an array when writing string data to the registry. For single
        string registry types (REG_SZ, REG_EXPAND_SZ), this should be an array with
        one string. For sequences of string with REG_MULTI_SZ, this array will be
        variable length. For numeric data, such as REG_DWORD and REG_QWORD, this should
        be populated with the decimal representation (e.g `"1"`).'
      example: '["C:\rta\red_ttp\bin\myapp.exe"]'
      default_field: false
    - name: data.type
      level: core
      type: keyword
      ignore_above: 1024
      description: Standard registry type for encoding contents
      example: REG_SZ
      default_field: false
    - name: hive
      level: core
      type: keyword
      ignore_above: 1024
      description: Abbreviated name for the hive.
      example: HKLM
      default_field: false
    - name: key
      level: core
      type: keyword
      ignore_above: 1024
      description: Hive-relative path of keys.
      example: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe
      default_field: false
    - name: path
      level: core
      type: keyword
      ignore_above: 1024
      description: Full path, including hive, key and value
      example: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution
        Options\winword.exe\Debugger
      default_field: false
    - name: value
      level: core
      type: keyword
      ignore_above: 1024
      description: Name of the value written.
      example: Debugger
      default_field: false
  - name: related
    title: Related
    group: 2
    description: 'This field set is meant to facilitate pivoting around a piece of
      data.

      Some pieces of information can be seen in many places in an ECS event. To facilitate
      searching for them, store an array of all seen values to their corresponding
      field in `related.`.

      A concrete example is IP addresses, which can be under host, observer, source,
      destination, client, server, and network.forwarded_ip. If you append all IPs
      to `related.ip`, you can then search for a given IP trivially, no matter where
      it appeared, by querying `related.ip:192.0.2.15`.'
    type: group
    fields:
    - name: hash
      level: extended
      type: keyword
      ignore_above: 1024
      description: All the hashes seen on your event. Populating this field, then
        using it to search for hashes can help in situations where you're unsure what
        the hash algorithm is (and therefore which key name to search).
      default_field: false
    - name: hosts
      level: extended
      type: keyword
      ignore_above: 1024
      description: All hostnames or other host identifiers seen on your event. Example
        identifiers include FQDNs, domain names, workstation names, or aliases.
      default_field: false
    - name: ip
      level: extended
      type: ip
      description: All of the IPs seen on your event.
    - name: user
      level: extended
      type: keyword
      ignore_above: 1024
      description: All the user names seen on your event.
      default_field: false
  - name: rule
    title: Rule
    group: 2
    description: 'Rule fields are used to capture the specifics of any observer or
      agent rules that generate alerts or other notable events.

      Examples of data sources that would populate the rule fields include: network
      admission control platforms, network or host IDS/IPS, network firewalls, web
      application firewalls, url filters, endpoint detection and response (EDR) systems,
      etc.'
    type: group
    fields:
    - name: author
      level: extended
      type: keyword
      ignore_above: 1024
      description: Name, organization, or pseudonym of the author or authors who created
        the rule used to generate this event.
      example:
      - Star-Lord
      default_field: false
    - name: category
      level: extended
      type: keyword
      ignore_above: 1024
      description: A categorization value keyword used by the entity using the rule
        for detection of this event.
      example: Attempted Information Leak
      default_field: false
    - name: description
      level: extended
      type: keyword
      ignore_above: 1024
      description: The description of the rule generating the event.
      example: Block requests to public DNS over HTTPS / TLS protocols
      default_field: false
    - name: id
      level: extended
      type: keyword
      ignore_above: 1024
      description: A rule ID that is unique within the scope of an agent, observer,
        or other entity using the rule for detection of this event.
      example: 101
      default_field: false
    - name: license
      level: extended
      type: keyword
      ignore_above: 1024
      description: Name of the license under which the rule used to generate this
        event is made available.
      example: Apache 2.0
      default_field: false
    - name: name
      level: extended
      type: keyword
      ignore_above: 1024
      description: The name of the rule or signature generating the event.
      example: BLOCK_DNS_over_TLS
      default_field: false
    - name: reference
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Reference URL to additional information about the rule used to
        generate this event.

        The URL can point to the vendor''s documentation about the rule. If that''s
        not available, it can also be a link to a more general page describing this
        type of alert.'
      example: https://en.wikipedia.org/wiki/DNS_over_TLS
      default_field: false
    - name: ruleset
      level: extended
      type: keyword
      ignore_above: 1024
      description: Name of the ruleset, policy, group, or parent category in which
        the rule used to generate this event is a member.
      example: Standard_Protocol_Filters
      default_field: false
    - name: uuid
      level: extended
      type: keyword
      ignore_above: 1024
      description: A rule ID that is unique within the scope of a set or group of
        agents, observers, or other entities using the rule for detection of this
        event.
      example: 1100110011
      default_field: false
    - name: version
      level: extended
      type: keyword
      ignore_above: 1024
      description: The version / revision of the rule being used for analysis.
      example: 1.1
      default_field: false
  - name: server
    title: Server
    group: 2
    description: 'A Server is defined as the responder in a network connection for
      events regarding sessions, connections, or bidirectional flow records.

      For TCP events, the server is the receiver of the initial SYN packet(s) of the
      TCP connection. For other protocols, the server is generally the responder in
      the network transaction. Some systems actually use the term "responder" to refer
      the server in TCP connections. The server fields describe details about the
      system acting as the server in the network event. Server fields are usually
      populated in conjunction with client fields. Server fields are generally not
      populated for packet-level events.

      Client / server representations can add semantic context to an exchange, which
      is helpful to visualize the data in certain situations. If your context falls
      in that category, you should still ensure that source and destination are filled
      appropriately.'
    type: group
    fields:
    - name: address
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Some event server addresses are defined ambiguously. The event
        will sometimes list an IP, a domain or a unix socket.  You should always store
        the raw address in the `.address` field.

        Then it should be duplicated to `.ip` or `.domain`, depending on which one
        it is.'
    - name: as.number
      level: extended
      type: long
      description: Unique number allocated to the autonomous system. The autonomous
        system number (ASN) uniquely identifies each network on the Internet.
      example: 15169
    - name: as.organization.name
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: text
        norms: false
        default_field: false
      description: Organization name.
      example: Google LLC
    - name: bytes
      level: core
      type: long
      format: bytes
      description: Bytes sent from the server to the client.
      example: 184
    - name: domain
      level: core
      type: keyword
      ignore_above: 1024
      description: Server domain.
    - name: geo.city_name
      level: core
      type: keyword
      ignore_above: 1024
      description: City name.
      example: Montreal
    - name: geo.continent_name
      level: core
      type: keyword
      ignore_above: 1024
      description: Name of the continent.
      example: North America
    - name: geo.country_iso_code
      level: core
      type: keyword
      ignore_above: 1024
      description: Country ISO code.
      example: CA
    - name: geo.country_name
      level: core
      type: keyword
      ignore_above: 1024
      description: Country name.
      example: Canada
    - name: geo.location
      level: core
      type: geo_point
      description: Longitude and latitude.
      example: '{ "lon": -73.614830, "lat": 45.505918 }'
    - name: geo.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'User-defined description of a location, at the level of granularity
        they care about.

        Could be the name of their data centers, the floor number, if this describes
        a local physical entity, city names.

        Not typically used in automated geolocation.'
      example: boston-dc
    - name: geo.region_iso_code
      level: core
      type: keyword
      ignore_above: 1024
      description: Region ISO code.
      example: CA-QC
    - name: geo.region_name
      level: core
      type: keyword
      ignore_above: 1024
      description: Region name.
      example: Quebec
    - name: ip
      level: core
      type: ip
      description: IP address of the server (IPv4 or IPv6).
    - name: mac
      level: core
      type: keyword
      ignore_above: 1024
      description: MAC address of the server.
    - name: nat.ip
      level: extended
      type: ip
      description: 'Translated ip of destination based NAT sessions (e.g. internet
        to private DMZ)

        Typically used with load balancers, firewalls, or routers.'
    - name: nat.port
      level: extended
      type: long
      format: string
      description: 'Translated port of destination based NAT sessions (e.g. internet
        to private DMZ)

        Typically used with load balancers, firewalls, or routers.'
    - name: packets
      level: core
      type: long
      description: Packets sent from the server to the client.
      example: 12
    - name: port
      level: core
      type: long
      format: string
      description: Port of the server.
    - name: registered_domain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The highest registered server domain, stripped of the subdomain.

        For example, the registered domain for "foo.example.com" is "example.com".

        This value can be determined precisely with a list like the public suffix
        list (http://publicsuffix.org). Trying to approximate this by simply taking
        the last two labels will not work well for TLDs such as "co.uk".'
      example: example.com
    - name: top_level_domain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The effective top level domain (eTLD), also known as the domain
        suffix, is the last part of the domain name. For example, the top level domain
        for example.com is "com".

        This value can be determined precisely with a list like the public suffix
        list (http://publicsuffix.org). Trying to approximate this by simply taking
        the last label will not work well for effective TLDs such as "co.uk".'
      example: co.uk
    - name: user.domain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Name of the directory the user is a member of.

        For example, an LDAP or Active Directory domain name.'
    - name: user.email
      level: extended
      type: keyword
      ignore_above: 1024
      description: User email address.
    - name: user.full_name
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: text
        norms: false
        default_field: false
      description: User's full name, if available.
      example: Albert Einstein
    - name: user.group.domain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Name of the directory the group is a member of.

        For example, an LDAP or Active Directory domain name.'
    - name: user.group.id
      level: extended
      type: keyword
      ignore_above: 1024
      description: Unique identifier for the group on the system/platform.
    - name: user.group.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Name of the group.
    - name: user.hash
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Unique user hash to correlate information for a user in anonymized
        form.

        Useful if `user.id` or `user.name` contain confidential information and cannot
        be used.'
    - name: user.id
      level: core
      type: keyword
      ignore_above: 1024
      description: Unique identifier of the user.
    - name: user.name
      level: core
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: text
        norms: false
        default_field: false
      description: Short name or login of the user.
      example: albert
    - name: user.roles
      level: extended
      type: keyword
      ignore_above: 1024
      description: Array of user roles at the time of the event.
      example: '["kibana_admin", "reporting_user"]'
      default_field: false
  - name: service
    title: Service
    group: 2
    description: 'The service fields describe the service for or from which the data
      was collected.

      These fields help you find and correlate logs for a specific service and version.'
    type: group
    fields:
    - name: ephemeral_id
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Ephemeral identifier of this service (if one exists).

        This id normally changes across restarts, but `service.id` does not.'
      example: 8a4f500f
    - name: id
      level: core
      type: keyword
      ignore_above: 1024
      description: 'Unique identifier of the running service. If the service is comprised
        of many nodes, the `service.id` should be the same for all nodes.

        This id should uniquely identify the service. This makes it possible to correlate
        logs and metrics for one specific service, no matter which particular node
        emitted the event.

        Note that if you need to see the events from one specific host of the service,
        you should filter on that `host.name` or `host.id` instead.'
      example: d37e5ebfe0ae6c4972dbe9f0174a1637bb8247f6
    - name: name
      level: core
      type: keyword
      ignore_above: 1024
      description: 'Name of the service data is collected from.

        The name of the service is normally user given. This allows for distributed
        services that run on multiple hosts to correlate the related instances based
        on the name.

        In the case of Elasticsearch the `service.name` could contain the cluster
        name. For Beats the `service.name` is by default a copy of the `service.type`
        field if no name is specified.'
      example: elasticsearch-metrics
    - name: node.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Name of a service node.

        This allows for two nodes of the same service running on the same host to
        be differentiated. Therefore, `service.node.name` should typically be unique
        across nodes of a given service.

        In the case of Elasticsearch, the `service.node.name` could contain the unique
        node name within the Elasticsearch cluster. In cases where the service doesn''t
        have the concept of a node name, the host name or container name can be used
        to distinguish running instances that make up this service. If those do not
        provide uniqueness (e.g. multiple instances of the service running on the
        same host) - the node name can be manually set.'
      example: instance-0000000016
    - name: state
      level: core
      type: keyword
      ignore_above: 1024
      description: Current state of the service.
    - name: type
      level: core
      type: keyword
      ignore_above: 1024
      description: 'The type of the service data is collected from.

        The type can be used to group and correlate logs and metrics from one service
        type.

        Example: If logs or metrics are collected from Elasticsearch, `service.type`
        would be `elasticsearch`.'
      example: elasticsearch
    - name: version
      level: core
      type: keyword
      ignore_above: 1024
      description: 'Version of the service the data was collected from.

        This allows to look at a data set only for a specific version of a service.'
      example: 3.2.4
  - name: source
    title: Source
    group: 2
    description: 'Source fields describe details about the source of a packet/event.

      Source fields are usually populated in conjunction with destination fields.'
    type: group
    fields:
    - name: address
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Some event source addresses are defined ambiguously. The event
        will sometimes list an IP, a domain or a unix socket.  You should always store
        the raw address in the `.address` field.

        Then it should be duplicated to `.ip` or `.domain`, depending on which one
        it is.'
    - name: as.number
      level: extended
      type: long
      description: Unique number allocated to the autonomous system. The autonomous
        system number (ASN) uniquely identifies each network on the Internet.
      example: 15169
    - name: as.organization.name
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: text
        norms: false
        default_field: false
      description: Organization name.
      example: Google LLC
    - name: bytes
      level: core
      type: long
      format: bytes
      description: Bytes sent from the source to the destination.
      example: 184
    - name: domain
      level: core
      type: keyword
      ignore_above: 1024
      description: Source domain.
    - name: geo.city_name
      level: core
      type: keyword
      ignore_above: 1024
      description: City name.
      example: Montreal
    - name: geo.continent_name
      level: core
      type: keyword
      ignore_above: 1024
      description: Name of the continent.
      example: North America
    - name: geo.country_iso_code
      level: core
      type: keyword
      ignore_above: 1024
      description: Country ISO code.
      example: CA
    - name: geo.country_name
      level: core
      type: keyword
      ignore_above: 1024
      description: Country name.
      example: Canada
    - name: geo.location
      level: core
      type: geo_point
      description: Longitude and latitude.
      example: '{ "lon": -73.614830, "lat": 45.505918 }'
    - name: geo.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'User-defined description of a location, at the level of granularity
        they care about.

        Could be the name of their data centers, the floor number, if this describes
        a local physical entity, city names.

        Not typically used in automated geolocation.'
      example: boston-dc
    - name: geo.region_iso_code
      level: core
      type: keyword
      ignore_above: 1024
      description: Region ISO code.
      example: CA-QC
    - name: geo.region_name
      level: core
      type: keyword
      ignore_above: 1024
      description: Region name.
      example: Quebec
    - name: ip
      level: core
      type: ip
      description: IP address of the source (IPv4 or IPv6).
    - name: mac
      level: core
      type: keyword
      ignore_above: 1024
      description: MAC address of the source.
    - name: nat.ip
      level: extended
      type: ip
      description: 'Translated ip of source based NAT sessions (e.g. internal client
        to internet)

        Typically connections traversing load balancers, firewalls, or routers.'
    - name: nat.port
      level: extended
      type: long
      format: string
      description: 'Translated port of source based NAT sessions. (e.g. internal client
        to internet)

        Typically used with load balancers, firewalls, or routers.'
    - name: packets
      level: core
      type: long
      description: Packets sent from the source to the destination.
      example: 12
    - name: port
      level: core
      type: long
      format: string
      description: Port of the source.
    - name: registered_domain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The highest registered source domain, stripped of the subdomain.

        For example, the registered domain for "foo.example.com" is "example.com".

        This value can be determined precisely with a list like the public suffix
        list (http://publicsuffix.org). Trying to approximate this by simply taking
        the last two labels will not work well for TLDs such as "co.uk".'
      example: example.com
    - name: top_level_domain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The effective top level domain (eTLD), also known as the domain
        suffix, is the last part of the domain name. For example, the top level domain
        for example.com is "com".

        This value can be determined precisely with a list like the public suffix
        list (http://publicsuffix.org). Trying to approximate this by simply taking
        the last label will not work well for effective TLDs such as "co.uk".'
      example: co.uk
    - name: user.domain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Name of the directory the user is a member of.

        For example, an LDAP or Active Directory domain name.'
    - name: user.email
      level: extended
      type: keyword
      ignore_above: 1024
      description: User email address.
    - name: user.full_name
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: text
        norms: false
        default_field: false
      description: User's full name, if available.
      example: Albert Einstein
    - name: user.group.domain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Name of the directory the group is a member of.

        For example, an LDAP or Active Directory domain name.'
    - name: user.group.id
      level: extended
      type: keyword
      ignore_above: 1024
      description: Unique identifier for the group on the system/platform.
    - name: user.group.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Name of the group.
    - name: user.hash
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Unique user hash to correlate information for a user in anonymized
        form.

        Useful if `user.id` or `user.name` contain confidential information and cannot
        be used.'
    - name: user.id
      level: core
      type: keyword
      ignore_above: 1024
      description: Unique identifier of the user.
    - name: user.name
      level: core
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: text
        norms: false
        default_field: false
      description: Short name or login of the user.
      example: albert
    - name: user.roles
      level: extended
      type: keyword
      ignore_above: 1024
      description: Array of user roles at the time of the event.
      example: '["kibana_admin", "reporting_user"]'
      default_field: false
  - name: threat
    title: Threat
    group: 2
    description: "Fields to classify events and alerts according to a threat taxonomy\
      \ such as the MITRE ATT&CK\xAE framework.\nThese fields are for users to classify\
      \ alerts from all of their sources (e.g. IDS, NGFW, etc.) within a common taxonomy.\
      \ The threat.tactic.* are meant to capture the high level category of the threat\
      \ (e.g. \"impact\"). The threat.technique.* fields are meant to capture which\
      \ kind of approach is used by this detected threat, to accomplish the goal (e.g.\
      \ \"endpoint denial of service\")."
    type: group
    fields:
    - name: framework
      level: extended
      type: keyword
      ignore_above: 1024
      description: Name of the threat framework used to further categorize and classify
        the tactic and technique of the reported threat. Framework classification
        can be provided by detecting systems, evaluated at ingest time, or retrospectively
        tagged to events.
      example: MITRE ATT&CK
    - name: tactic.id
      level: extended
      type: keyword
      ignore_above: 1024
      description: "The id of tactic used by this threat. You can use a MITRE ATT&CK\xAE\
        \ tactic, for example. (ex. https://attack.mitre.org/tactics/TA0040/ )"
      example: TA0040
    - name: tactic.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: "Name of the type of tactic used by this threat. You can use a\
        \ MITRE ATT&CK\xAE tactic, for example. (ex. https://attack.mitre.org/tactics/TA0040/)"
      example: impact
    - name: tactic.reference
      level: extended
      type: keyword
      ignore_above: 1024
      description: "The reference url of tactic used by this threat. You can use a\
        \ MITRE ATT&CK\xAE tactic, for example. (ex. https://attack.mitre.org/tactics/TA0040/\
        \ )"
      example: https://attack.mitre.org/tactics/TA0040/
    - name: technique.id
      level: extended
      type: keyword
      ignore_above: 1024
      description: "The id of technique used by this threat. You can use a MITRE ATT&CK\xAE\
        \ technique, for example. (ex. https://attack.mitre.org/techniques/T1499/)"
      example: T1499
    - name: technique.name
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: text
        norms: false
        default_field: false
      description: "The name of technique used by this threat. You can use a MITRE\
        \ ATT&CK\xAE technique, for example. (ex. https://attack.mitre.org/techniques/T1499/)"
      example: Endpoint Denial of Service
    - name: technique.reference
      level: extended
      type: keyword
      ignore_above: 1024
      description: "The reference url of technique used by this threat. You can use\
        \ a MITRE ATT&CK\xAE technique, for example. (ex. https://attack.mitre.org/techniques/T1499/\
        \ )"
      example: https://attack.mitre.org/techniques/T1499/
  - name: tls
    title: TLS
    group: 2
    description: Fields related to a TLS connection. These fields focus on the TLS
      protocol itself and intentionally avoids in-depth analysis of the related x.509
      certificate files.
    type: group
    fields:
    - name: cipher
      level: extended
      type: keyword
      ignore_above: 1024
      description: String indicating the cipher used during the current connection.
      example: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
      default_field: false
    - name: client.certificate
      level: extended
      type: keyword
      ignore_above: 1024
      description: PEM-encoded stand-alone certificate offered by the client. This
        is usually mutually-exclusive of `client.certificate_chain` since this value
        also exists in that list.
      example: MII...
      default_field: false
    - name: client.certificate_chain
      level: extended
      type: keyword
      ignore_above: 1024
      description: Array of PEM-encoded certificates that make up the certificate
        chain offered by the client. This is usually mutually-exclusive of `client.certificate`
        since that value should be the first certificate in the chain.
      example:
      - MII...
      - MII...
      default_field: false
    - name: client.hash.md5
      level: extended
      type: keyword
      ignore_above: 1024
      description: Certificate fingerprint using the MD5 digest of DER-encoded version
        of certificate offered by the client. For consistency with other hash values,
        this value should be formatted as an uppercase hash.
      example: 0F76C7F2C55BFD7D8E8B8F4BFBF0C9EC
      default_field: false
    - name: client.hash.sha1
      level: extended
      type: keyword
      ignore_above: 1024
      description: Certificate fingerprint using the SHA1 digest of DER-encoded version
        of certificate offered by the client. For consistency with other hash values,
        this value should be formatted as an uppercase hash.
      example: 9E393D93138888D288266C2D915214D1D1CCEB2A
      default_field: false
    - name: client.hash.sha256
      level: extended
      type: keyword
      ignore_above: 1024
      description: Certificate fingerprint using the SHA256 digest of DER-encoded
        version of certificate offered by the client. For consistency with other hash
        values, this value should be formatted as an uppercase hash.
      example: 0687F666A054EF17A08E2F2162EAB4CBC0D265E1D7875BE74BF3C712CA92DAF0
      default_field: false
    - name: client.issuer
      level: extended
      type: keyword
      ignore_above: 1024
      description: Distinguished name of subject of the issuer of the x.509 certificate
        presented by the client.
      example: CN=Example Root CA, OU=Infrastructure Team, DC=example, DC=com
      default_field: false
    - name: client.ja3
      level: extended
      type: keyword
      ignore_above: 1024
      description: A hash that identifies clients based on how they perform an SSL/TLS
        handshake.
      example: d4e5b18d6b55c71272893221c96ba240
      default_field: false
    - name: client.not_after
      level: extended
      type: date
      description: Date/Time indicating when client certificate is no longer considered
        valid.
      example: '2021-01-01T00:00:00.000Z'
      default_field: false
    - name: client.not_before
      level: extended
      type: date
      description: Date/Time indicating when client certificate is first considered
        valid.
      example: '1970-01-01T00:00:00.000Z'
      default_field: false
    - name: client.server_name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Also called an SNI, this tells the server which hostname to which
        the client is attempting to connect to. When this value is available, it should
        get copied to `destination.domain`.
      example: www.elastic.co
      default_field: false
    - name: client.subject
      level: extended
      type: keyword
      ignore_above: 1024
      description: Distinguished name of subject of the x.509 certificate presented
        by the client.
      example: CN=myclient, OU=Documentation Team, DC=example, DC=com
      default_field: false
    - name: client.supported_ciphers
      level: extended
      type: keyword
      ignore_above: 1024
      description: Array of ciphers offered by the client during the client hello.
      example:
      - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
      - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
      - '...'
      default_field: false
    - name: client.x509.alternative_names
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of subject alternative names (SAN). Name types vary by certificate
        authority and certificate type but commonly contain IP addresses, DNS names
        (and wildcards), and email addresses.
      example: '*.elastic.co'
      default_field: false
    - name: client.x509.issuer.common_name
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of common name (CN) of issuing certificate authority.
      example: Example SHA2 High Assurance Server CA
      default_field: false
    - name: client.x509.issuer.country
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of country (C) codes
      example: US
      default_field: false
    - name: client.x509.issuer.distinguished_name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Distinguished name (DN) of issuing certificate authority.
      example: C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance
        Server CA
      default_field: false
    - name: client.x509.issuer.locality
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of locality names (L)
      example: Mountain View
      default_field: false
    - name: client.x509.issuer.organization
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of organizations (O) of issuing certificate authority.
      example: Example Inc
      default_field: false
    - name: client.x509.issuer.organizational_unit
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of organizational units (OU) of issuing certificate authority.
      example: www.example.com
      default_field: false
    - name: client.x509.issuer.state_or_province
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of state or province names (ST, S, or P)
      example: California
      default_field: false
    - name: client.x509.not_after
      level: extended
      type: date
      description: Time at which the certificate is no longer considered valid.
      example: 2020-07-16 03:15:39+00:00
      default_field: false
    - name: client.x509.not_before
      level: extended
      type: date
      description: Time at which the certificate is first considered valid.
      example: 2019-08-16 01:40:25+00:00
      default_field: false
    - name: client.x509.public_key_algorithm
      level: extended
      type: keyword
      ignore_above: 1024
      description: Algorithm used to generate the public key.
      example: RSA
      default_field: false
    - name: client.x509.public_key_curve
      level: extended
      type: keyword
      ignore_above: 1024
      description: The curve used by the elliptic curve public key algorithm. This
        is algorithm specific.
      example: nistp521
      default_field: false
    - name: client.x509.public_key_exponent
      level: extended
      type: long
      description: Exponent used to derive the public key. This is algorithm specific.
      example: 65537
      index: false
      default_field: false
    - name: client.x509.public_key_size
      level: extended
      type: long
      description: The size of the public key space in bits.
      example: 2048
      default_field: false
    - name: client.x509.serial_number
      level: extended
      type: keyword
      ignore_above: 1024
      description: Unique serial number issued by the certificate authority. For consistency,
        if this value is alphanumeric, it should be formatted without colons and uppercase
        characters.
      example: 55FBB9C7DEBF09809D12CCAA
      default_field: false
    - name: client.x509.signature_algorithm
      level: extended
      type: keyword
      ignore_above: 1024
      description: Identifier for certificate signature algorithm. We recommend using
        names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353.
      example: SHA256-RSA
      default_field: false
    - name: client.x509.subject.common_name
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of common names (CN) of subject.
      example: shared.global.example.net
      default_field: false
    - name: client.x509.subject.country
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of country (C) code
      example: US
      default_field: false
    - name: client.x509.subject.distinguished_name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Distinguished name (DN) of the certificate subject entity.
      example: C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net
      default_field: false
    - name: client.x509.subject.locality
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of locality names (L)
      example: San Francisco
      default_field: false
    - name: client.x509.subject.organization
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of organizations (O) of subject.
      example: Example, Inc.
      default_field: false
    - name: client.x509.subject.organizational_unit
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of organizational units (OU) of subject.
      default_field: false
    - name: client.x509.subject.state_or_province
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of state or province names (ST, S, or P)
      example: California
      default_field: false
    - name: client.x509.version_number
      level: extended
      type: keyword
      ignore_above: 1024
      description: Version of x509 format.
      example: 3
      default_field: false
    - name: curve
      level: extended
      type: keyword
      ignore_above: 1024
      description: String indicating the curve used for the given cipher, when applicable.
      example: secp256r1
      default_field: false
    - name: established
      level: extended
      type: boolean
      description: Boolean flag indicating if the TLS negotiation was successful and
        transitioned to an encrypted tunnel.
      default_field: false
    - name: next_protocol
      level: extended
      type: keyword
      ignore_above: 1024
      description: String indicating the protocol being tunneled. Per the values in
        the IANA registry (https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml#alpn-protocol-ids),
        this string should be lower case.
      example: http/1.1
      default_field: false
    - name: resumed
      level: extended
      type: boolean
      description: Boolean flag indicating if this TLS connection was resumed from
        an existing TLS negotiation.
      default_field: false
    - name: server.certificate
      level: extended
      type: keyword
      ignore_above: 1024
      description: PEM-encoded stand-alone certificate offered by the server. This
        is usually mutually-exclusive of `server.certificate_chain` since this value
        also exists in that list.
      example: MII...
      default_field: false
    - name: server.certificate_chain
      level: extended
      type: keyword
      ignore_above: 1024
      description: Array of PEM-encoded certificates that make up the certificate
        chain offered by the server. This is usually mutually-exclusive of `server.certificate`
        since that value should be the first certificate in the chain.
      example:
      - MII...
      - MII...
      default_field: false
    - name: server.hash.md5
      level: extended
      type: keyword
      ignore_above: 1024
      description: Certificate fingerprint using the MD5 digest of DER-encoded version
        of certificate offered by the server. For consistency with other hash values,
        this value should be formatted as an uppercase hash.
      example: 0F76C7F2C55BFD7D8E8B8F4BFBF0C9EC
      default_field: false
    - name: server.hash.sha1
      level: extended
      type: keyword
      ignore_above: 1024
      description: Certificate fingerprint using the SHA1 digest of DER-encoded version
        of certificate offered by the server. For consistency with other hash values,
        this value should be formatted as an uppercase hash.
      example: 9E393D93138888D288266C2D915214D1D1CCEB2A
      default_field: false
    - name: server.hash.sha256
      level: extended
      type: keyword
      ignore_above: 1024
      description: Certificate fingerprint using the SHA256 digest of DER-encoded
        version of certificate offered by the server. For consistency with other hash
        values, this value should be formatted as an uppercase hash.
      example: 0687F666A054EF17A08E2F2162EAB4CBC0D265E1D7875BE74BF3C712CA92DAF0
      default_field: false
    - name: server.issuer
      level: extended
      type: keyword
      ignore_above: 1024
      description: Subject of the issuer of the x.509 certificate presented by the
        server.
      example: CN=Example Root CA, OU=Infrastructure Team, DC=example, DC=com
      default_field: false
    - name: server.ja3s
      level: extended
      type: keyword
      ignore_above: 1024
      description: A hash that identifies servers based on how they perform an SSL/TLS
        handshake.
      example: 394441ab65754e2207b1e1b457b3641d
      default_field: false
    - name: server.not_after
      level: extended
      type: date
      description: Timestamp indicating when server certificate is no longer considered
        valid.
      example: '2021-01-01T00:00:00.000Z'
      default_field: false
    - name: server.not_before
      level: extended
      type: date
      description: Timestamp indicating when server certificate is first considered
        valid.
      example: '1970-01-01T00:00:00.000Z'
      default_field: false
    - name: server.subject
      level: extended
      type: keyword
      ignore_above: 1024
      description: Subject of the x.509 certificate presented by the server.
      example: CN=www.example.com, OU=Infrastructure Team, DC=example, DC=com
      default_field: false
    - name: server.x509.alternative_names
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of subject alternative names (SAN). Name types vary by certificate
        authority and certificate type but commonly contain IP addresses, DNS names
        (and wildcards), and email addresses.
      example: '*.elastic.co'
      default_field: false
    - name: server.x509.issuer.common_name
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of common name (CN) of issuing certificate authority.
      example: Example SHA2 High Assurance Server CA
      default_field: false
    - name: server.x509.issuer.country
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of country (C) codes
      example: US
      default_field: false
    - name: server.x509.issuer.distinguished_name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Distinguished name (DN) of issuing certificate authority.
      example: C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance
        Server CA
      default_field: false
    - name: server.x509.issuer.locality
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of locality names (L)
      example: Mountain View
      default_field: false
    - name: server.x509.issuer.organization
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of organizations (O) of issuing certificate authority.
      example: Example Inc
      default_field: false
    - name: server.x509.issuer.organizational_unit
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of organizational units (OU) of issuing certificate authority.
      example: www.example.com
      default_field: false
    - name: server.x509.issuer.state_or_province
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of state or province names (ST, S, or P)
      example: California
      default_field: false
    - name: server.x509.not_after
      level: extended
      type: date
      description: Time at which the certificate is no longer considered valid.
      example: 2020-07-16 03:15:39+00:00
      default_field: false
    - name: server.x509.not_before
      level: extended
      type: date
      description: Time at which the certificate is first considered valid.
      example: 2019-08-16 01:40:25+00:00
      default_field: false
    - name: server.x509.public_key_algorithm
      level: extended
      type: keyword
      ignore_above: 1024
      description: Algorithm used to generate the public key.
      example: RSA
      default_field: false
    - name: server.x509.public_key_curve
      level: extended
      type: keyword
      ignore_above: 1024
      description: The curve used by the elliptic curve public key algorithm. This
        is algorithm specific.
      example: nistp521
      default_field: false
    - name: server.x509.public_key_exponent
      level: extended
      type: long
      description: Exponent used to derive the public key. This is algorithm specific.
      example: 65537
      index: false
      default_field: false
    - name: server.x509.public_key_size
      level: extended
      type: long
      description: The size of the public key space in bits.
      example: 2048
      default_field: false
    - name: server.x509.serial_number
      level: extended
      type: keyword
      ignore_above: 1024
      description: Unique serial number issued by the certificate authority. For consistency,
        if this value is alphanumeric, it should be formatted without colons and uppercase
        characters.
      example: 55FBB9C7DEBF09809D12CCAA
      default_field: false
    - name: server.x509.signature_algorithm
      level: extended
      type: keyword
      ignore_above: 1024
      description: Identifier for certificate signature algorithm. We recommend using
        names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353.
      example: SHA256-RSA
      default_field: false
    - name: server.x509.subject.common_name
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of common names (CN) of subject.
      example: shared.global.example.net
      default_field: false
    - name: server.x509.subject.country
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of country (C) code
      example: US
      default_field: false
    - name: server.x509.subject.distinguished_name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Distinguished name (DN) of the certificate subject entity.
      example: C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net
      default_field: false
    - name: server.x509.subject.locality
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of locality names (L)
      example: San Francisco
      default_field: false
    - name: server.x509.subject.organization
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of organizations (O) of subject.
      example: Example, Inc.
      default_field: false
    - name: server.x509.subject.organizational_unit
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of organizational units (OU) of subject.
      default_field: false
    - name: server.x509.subject.state_or_province
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of state or province names (ST, S, or P)
      example: California
      default_field: false
    - name: server.x509.version_number
      level: extended
      type: keyword
      ignore_above: 1024
      description: Version of x509 format.
      example: 3
      default_field: false
    - name: version
      level: extended
      type: keyword
      ignore_above: 1024
      description: Numeric part of the version parsed from the original string.
      example: '1.2'
      default_field: false
    - name: version_protocol
      level: extended
      type: keyword
      ignore_above: 1024
      description: Normalized lowercase protocol name parsed from original string.
      example: tls
      default_field: false
  - name: tracing
    title: Tracing
    group: 2
    description: Distributed tracing makes it possible to analyze performance throughout
      a microservice architecture all in one view. This is accomplished by tracing
      all of the requests - from the initial web request in the front-end service
      - to queries made through multiple back-end services.
    type: group
    fields:
    - name: span.id
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Unique identifier of the span within the scope of its trace.

        A span represents an operation within a transaction, such as a request to
        another service, or a database query.'
      example: 3ff9a8981b7ccd5a
      default_field: false
    - name: trace.id
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Unique identifier of the trace.

        A trace groups multiple events like transactions that belong together. For
        example, a user request handled by multiple inter-connected services.'
      example: 4bf92f3577b34da6a3ce929d0e0e4736
    - name: transaction.id
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Unique identifier of the transaction within the scope of its trace.

        A transaction is the highest level of work measured within a service, such
        as a request to a server.'
      example: 00f067aa0ba902b7
  - name: url
    title: URL
    group: 2
    description: URL fields provide support for complete or partial URLs, and supports
      the breaking down into scheme, domain, path, and so on.
    type: group
    fields:
    - name: domain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Domain of the url, such as "www.elastic.co".

        In some cases a URL may refer to an IP and/or port directly, without a domain
        name. In this case, the IP address would go to the `domain` field.'
      example: www.elastic.co
    - name: extension
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The field contains the file extension from the original request
        url.

        The file extension is only set if it exists, as not every url has a file extension.

        The leading period must not be included. For example, the value must be "png",
        not ".png".'
      example: png
    - name: fragment
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Portion of the url after the `#`, such as "top".

        The `#` is not part of the fragment.'
    - name: full
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: text
        norms: false
        default_field: false
      description: If full URLs are important to your use case, they should be stored
        in `url.full`, whether this field is reconstructed or present in the event
        source.
      example: https://www.elastic.co:443/search?q=elasticsearch#top
    - name: original
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: text
        norms: false
        default_field: false
      description: 'Unmodified original url as seen in the event source.

        Note that in network monitoring, the observed URL may be a full URL, whereas
        in access logs, the URL is often just represented as a path.

        This field is meant to represent the URL as it was observed, complete or not.'
      example: https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch
    - name: password
      level: extended
      type: keyword
      ignore_above: 1024
      description: Password of the request.
    - name: path
      level: extended
      type: keyword
      ignore_above: 1024
      description: Path of the request, such as "/search".
    - name: port
      level: extended
      type: long
      format: string
      description: Port of the request, such as 443.
      example: 443
    - name: query
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The query field describes the query string of the request, such
        as "q=elasticsearch".

        The `?` is excluded from the query string. If a URL contains no `?`, there
        is no query field. If there is a `?` but no query, the query field exists
        with an empty string. The `exists` query can be used to differentiate between
        the two cases.'
    - name: registered_domain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The highest registered url domain, stripped of the subdomain.

        For example, the registered domain for "foo.example.com" is "example.com".

        This value can be determined precisely with a list like the public suffix
        list (http://publicsuffix.org). Trying to approximate this by simply taking
        the last two labels will not work well for TLDs such as "co.uk".'
      example: example.com
    - name: scheme
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Scheme of the request, such as "https".

        Note: The `:` is not part of the scheme.'
      example: https
    - name: top_level_domain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The effective top level domain (eTLD), also known as the domain
        suffix, is the last part of the domain name. For example, the top level domain
        for example.com is "com".

        This value can be determined precisely with a list like the public suffix
        list (http://publicsuffix.org). Trying to approximate this by simply taking
        the last label will not work well for effective TLDs such as "co.uk".'
      example: co.uk
    - name: username
      level: extended
      type: keyword
      ignore_above: 1024
      description: Username of the request.
  - name: user
    title: User
    group: 2
    description: 'The user fields describe information about the user that is relevant
      to the event.

      Fields can have one entry or multiple entries. If a user has more than one id,
      provide an array that includes all of them.'
    type: group
    fields:
    - name: domain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Name of the directory the user is a member of.

        For example, an LDAP or Active Directory domain name.'
    - name: email
      level: extended
      type: keyword
      ignore_above: 1024
      description: User email address.
    - name: full_name
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: text
        norms: false
        default_field: false
      description: User's full name, if available.
      example: Albert Einstein
    - name: group.domain
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Name of the directory the group is a member of.

        For example, an LDAP or Active Directory domain name.'
    - name: group.id
      level: extended
      type: keyword
      ignore_above: 1024
      description: Unique identifier for the group on the system/platform.
    - name: group.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Name of the group.
    - name: hash
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'Unique user hash to correlate information for a user in anonymized
        form.

        Useful if `user.id` or `user.name` contain confidential information and cannot
        be used.'
    - name: id
      level: core
      type: keyword
      ignore_above: 1024
      description: Unique identifier of the user.
    - name: name
      level: core
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: text
        norms: false
        default_field: false
      description: Short name or login of the user.
      example: albert
    - name: roles
      level: extended
      type: keyword
      ignore_above: 1024
      description: Array of user roles at the time of the event.
      example: '["kibana_admin", "reporting_user"]'
      default_field: false
  - name: user_agent
    title: User agent
    group: 2
    description: 'The user_agent fields normally come from a browser request.

      They often show up in web service logs coming from the parsed user agent string.'
    type: group
    fields:
    - name: device.name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Name of the device.
      example: iPhone
    - name: name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Name of the user agent.
      example: Safari
    - name: original
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: text
        norms: false
      description: Unparsed user_agent string.
      example: Mozilla/5.0 (iPhone; CPU iPhone OS 12_1 like Mac OS X) AppleWebKit/605.1.15
        (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1
    - name: os.family
      level: extended
      type: keyword
      ignore_above: 1024
      description: OS family (such as redhat, debian, freebsd, windows).
      example: debian
    - name: os.full
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: text
        norms: false
        default_field: false
      description: Operating system name, including the version or code name.
      example: Mac OS Mojave
    - name: os.kernel
      level: extended
      type: keyword
      ignore_above: 1024
      description: Operating system kernel version as a raw string.
      example: 4.4.0-112-generic
    - name: os.name
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: text
        norms: false
        default_field: false
      description: Operating system name, without the version.
      example: Mac OS X
    - name: os.platform
      level: extended
      type: keyword
      ignore_above: 1024
      description: Operating system platform (such centos, ubuntu, windows).
      example: darwin
    - name: os.version
      level: extended
      type: keyword
      ignore_above: 1024
      description: Operating system version as a raw string.
      example: 10.14.1
    - name: version
      level: extended
      type: keyword
      ignore_above: 1024
      description: Version of the user agent.
      example: 12.0
  - name: vlan
    title: VLAN
    group: 2
    description: 'The VLAN fields are used to identify 802.1q tag(s) of a packet,
      as well as ingress and egress VLAN associations of an observer in relation to
      a specific packet or connection.

      Network.vlan fields are used to record a single VLAN tag, or the outer tag in
      the case of q-in-q encapsulations, for a packet or connection as observed, typically
      provided by a network sensor (e.g. Zeek, Wireshark) passively reporting on traffic.

      Network.inner VLAN fields are used to report inner q-in-q 802.1q tags (multiple
      802.1q encapsulations) as observed, typically provided by a network sensor  (e.g.
      Zeek, Wireshark) passively reporting on traffic. Network.inner VLAN fields should
      only be used in addition to network.vlan fields to indicate q-in-q tagging.

      Observer.ingress and observer.egress VLAN values are used to record observer
      specific information when observer events contain discrete ingress and egress
      VLAN information, typically provided by firewalls, routers, or load balancers.'
    type: group
    fields:
    - name: id
      level: extended
      type: keyword
      ignore_above: 1024
      description: VLAN ID as reported by the observer.
      example: 10
      default_field: false
    - name: name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Optional VLAN name as reported by the observer.
      example: outside
      default_field: false
  - name: vulnerability
    title: Vulnerability
    group: 2
    description: The vulnerability fields describe information about a vulnerability
      that is relevant to an event.
    type: group
    fields:
    - name: category
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The type of system or architecture that the vulnerability affects.
        These may be platform-specific (for example, Debian or SUSE) or general (for
        example, Database or Firewall). For example (https://qualysguard.qualys.com/qwebhelp/fo_portal/knowledgebase/vulnerability_categories.htm[Qualys
        vulnerability categories])

        This field must be an array.'
      example: '["Firewall"]'
      default_field: false
    - name: classification
      level: extended
      type: keyword
      ignore_above: 1024
      description: The classification of the vulnerability scoring system. For example
        (https://www.first.org/cvss/)
      example: CVSS
      default_field: false
    - name: description
      level: extended
      type: keyword
      ignore_above: 1024
      multi_fields:
      - name: text
        type: text
        norms: false
      description: The description of the vulnerability that provides additional context
        of the vulnerability. For example (https://cve.mitre.org/about/faqs.html#cve_entry_descriptions_created[Common
        Vulnerabilities and Exposure CVE description])
      example: In macOS before 2.12.6, there is a vulnerability in the RPC...
      default_field: false
    - name: enumeration
      level: extended
      type: keyword
      ignore_above: 1024
      description: The type of identifier used for this vulnerability. For example
        (https://cve.mitre.org/about/)
      example: CVE
      default_field: false
    - name: id
      level: extended
      type: keyword
      ignore_above: 1024
      description: The identification (ID) is the number portion of a vulnerability
        entry. It includes a unique identification number for the vulnerability. For
        example (https://cve.mitre.org/about/faqs.html#what_is_cve_id)[Common Vulnerabilities
        and Exposure CVE ID]
      example: CVE-2019-00001
      default_field: false
    - name: reference
      level: extended
      type: keyword
      ignore_above: 1024
      description: A resource that provides additional information, context, and mitigations
        for the identified vulnerability.
      example: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6111
      default_field: false
    - name: report_id
      level: extended
      type: keyword
      ignore_above: 1024
      description: The report or scan identification number.
      example: 20191018.0001
      default_field: false
    - name: scanner.vendor
      level: extended
      type: keyword
      ignore_above: 1024
      description: The name of the vulnerability scanner vendor.
      example: Tenable
      default_field: false
    - name: score.base
      level: extended
      type: float
      description: 'Scores can range from 0.0 to 10.0, with 10.0 being the most severe.

        Base scores cover an assessment for exploitability metrics (attack vector,
        complexity, privileges, and user interaction), impact metrics (confidentiality,
        integrity, and availability), and scope. For example (https://www.first.org/cvss/specification-document)'
      example: 5.5
      default_field: false
    - name: score.environmental
      level: extended
      type: float
      description: 'Scores can range from 0.0 to 10.0, with 10.0 being the most severe.

        Environmental scores cover an assessment for any modified Base metrics, confidentiality,
        integrity, and availability requirements. For example (https://www.first.org/cvss/specification-document)'
      example: 5.5
      default_field: false
    - name: score.temporal
      level: extended
      type: float
      description: 'Scores can range from 0.0 to 10.0, with 10.0 being the most severe.

        Temporal scores cover an assessment for code maturity, remediation level,
        and confidence. For example (https://www.first.org/cvss/specification-document)'
      default_field: false
    - name: score.version
      level: extended
      type: keyword
      ignore_above: 1024
      description: 'The National Vulnerability Database (NVD) provides qualitative
        severity rankings of "Low", "Medium", and "High" for CVSS v2.0 base score
        ranges in addition to the severity ratings for CVSS v3.0 as they are defined
        in the CVSS v3.0 specification.

        CVSS is owned and managed by FIRST.Org, Inc. (FIRST), a US-based non-profit
        organization, whose mission is to help computer security incident response
        teams across the world. For example (https://nvd.nist.gov/vuln-metrics/cvss)'
      example: 2.0
      default_field: false
    - name: severity
      level: extended
      type: keyword
      ignore_above: 1024
      description: The severity of the vulnerability can help with metrics and internal
        prioritization regarding remediation. For example (https://nvd.nist.gov/vuln-metrics/cvss)
      example: Critical
      default_field: false
  - name: x509
    title: x509 Certificate
    group: 2
    description: This implements the common core fields for x509 certificates. This
      information is likely logged with TLS sessions, digital signatures found in
      executable binaries, S/MIME information in email bodies, or analysis of files
      on disk. When only a single certificate is logged in an event, it should be
      nested under `file`. When hashes of the DER-encoded certificate are available,
      the `hash` data set should be populated as well (e.g. `file.hash.sha256`). For
      events that contain certificate information for both sides of the connection,
      the x509 object could be nested under the respective side of the connection
      information (e.g. `tls.server.x509`).
    type: group
    fields:
    - name: alternative_names
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of subject alternative names (SAN). Name types vary by certificate
        authority and certificate type but commonly contain IP addresses, DNS names
        (and wildcards), and email addresses.
      example: '*.elastic.co'
      default_field: false
    - name: issuer.common_name
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of common name (CN) of issuing certificate authority.
      example: Example SHA2 High Assurance Server CA
      default_field: false
    - name: issuer.country
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of country (C) codes
      example: US
      default_field: false
    - name: issuer.distinguished_name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Distinguished name (DN) of issuing certificate authority.
      example: C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance
        Server CA
      default_field: false
    - name: issuer.locality
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of locality names (L)
      example: Mountain View
      default_field: false
    - name: issuer.organization
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of organizations (O) of issuing certificate authority.
      example: Example Inc
      default_field: false
    - name: issuer.organizational_unit
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of organizational units (OU) of issuing certificate authority.
      example: www.example.com
      default_field: false
    - name: issuer.state_or_province
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of state or province names (ST, S, or P)
      example: California
      default_field: false
    - name: not_after
      level: extended
      type: date
      description: Time at which the certificate is no longer considered valid.
      example: 2020-07-16 03:15:39+00:00
      default_field: false
    - name: not_before
      level: extended
      type: date
      description: Time at which the certificate is first considered valid.
      example: 2019-08-16 01:40:25+00:00
      default_field: false
    - name: public_key_algorithm
      level: extended
      type: keyword
      ignore_above: 1024
      description: Algorithm used to generate the public key.
      example: RSA
      default_field: false
    - name: public_key_curve
      level: extended
      type: keyword
      ignore_above: 1024
      description: The curve used by the elliptic curve public key algorithm. This
        is algorithm specific.
      example: nistp521
      default_field: false
    - name: public_key_exponent
      level: extended
      type: long
      description: Exponent used to derive the public key. This is algorithm specific.
      example: 65537
      index: false
      default_field: false
    - name: public_key_size
      level: extended
      type: long
      description: The size of the public key space in bits.
      example: 2048
      default_field: false
    - name: serial_number
      level: extended
      type: keyword
      ignore_above: 1024
      description: Unique serial number issued by the certificate authority. For consistency,
        if this value is alphanumeric, it should be formatted without colons and uppercase
        characters.
      example: 55FBB9C7DEBF09809D12CCAA
      default_field: false
    - name: signature_algorithm
      level: extended
      type: keyword
      ignore_above: 1024
      description: Identifier for certificate signature algorithm. We recommend using
        names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353.
      example: SHA256-RSA
      default_field: false
    - name: subject.common_name
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of common names (CN) of subject.
      example: shared.global.example.net
      default_field: false
    - name: subject.country
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of country (C) code
      example: US
      default_field: false
    - name: subject.distinguished_name
      level: extended
      type: keyword
      ignore_above: 1024
      description: Distinguished name (DN) of the certificate subject entity.
      example: C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net
      default_field: false
    - name: subject.locality
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of locality names (L)
      example: San Francisco
      default_field: false
    - name: subject.organization
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of organizations (O) of subject.
      example: Example, Inc.
      default_field: false
    - name: subject.organizational_unit
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of organizational units (OU) of subject.
      default_field: false
    - name: subject.state_or_province
      level: extended
      type: keyword
      ignore_above: 1024
      description: List of state or province names (ST, S, or P)
      example: California
      default_field: false
    - name: version_number
      level: extended
      type: keyword
      ignore_above: 1024
      description: Version of x509 format.
      example: 3
      default_field: false
- key: beat
  anchor: beat-common
  title: Beat
  description: >
    Contains common beat fields available in all event types.
  fields:
    - name: agent.hostname
      type: keyword
      description: >
        Deprecated - use agent.name or agent.id to identify an agent.
        Hostname of the agent.

    - name: beat.timezone
      type: alias
      path: event.timezone
      migration: true

    - name: fields
      type: object
      object_type: keyword
      description: >
        Contains user configurable fields.

    - name: beat.name
      type: alias
      path: host.name
      migration: true

    - name: beat.hostname
      type: alias
      path: agent.hostname
      migration: true

    - name: timeseries.instance
      type: keyword
      description: Time series instance id
- key: cloud
  title: Cloud provider metadata
  description: >
    Metadata from cloud providers added by the add_cloud_metadata processor.
  fields:
    
    - name: cloud.image.id
      example: ami-abcd1234
      description: >
        Image ID for the cloud instance.

    # Alias for old fields
    - name: meta.cloud.provider
      type: alias
      path: cloud.provider
      migration: true

    - name: meta.cloud.instance_id
      type: alias
      path: cloud.instance.id
      migration: true

    - name: meta.cloud.instance_name
      type: alias
      path: cloud.instance.name
      migration: true

    - name: meta.cloud.machine_type
      type: alias
      path: cloud.machine.type
      migration: true

    - name: meta.cloud.availability_zone
      type: alias
      path: cloud.availability_zone
      migration: true

    - name: meta.cloud.project_id
      type: alias
      path: cloud.project.id
      migration: true

    - name: meta.cloud.region
      type: alias
      path: cloud.region
      migration: true

    
- key: docker
  title: Docker
  description: >
    Docker stats collected from Docker.
  short_config: false
  anchor: docker-processor
  fields:
    - name: docker
      type: group
      fields:
        - name: container.id
          type: alias
          path: container.id
          migration: true

        - name: container.image
          type: alias
          path: container.image.name
          migration: true

        - name: container.name
          type: alias
          path: container.name
          migration: true

        - name: container.labels  # TODO: How to map these?
          type: object
          object_type: keyword
          description: >
            Image labels.
- key: host
  title: Host
  description: >
    Info collected for the host machine.
  anchor: host-processor
  fields:

    # ECS fields are in fields.ecs.yml.
    # These are the non-ECS fields.
    - name: host
      type: group
      fields:

        - name: containerized
          type: boolean
          description: >
            If the host is a container.

        - name: os.build
          type: keyword
          example: "18D109"
          description: >
            OS build information.

        - name: os.codename
          type: keyword
          example: "stretch"
          description: >
            OS codename, if any.
- key: kubernetes
  title: Kubernetes
  description: >
    Kubernetes metadata added by the kubernetes processor
  short_config: false
  anchor: kubernetes-processor
  fields:
    - name: kubernetes
      type: group
      fields:
        - name: pod.name
          type: keyword
          description: >
            Kubernetes pod name

        - name: pod.uid
          type: keyword
          description: >
            Kubernetes Pod UID

        - name: namespace
          type: keyword
          description: >
            Kubernetes namespace

        - name: node.name
          type: keyword
          description: >
            Kubernetes node name

        - name: labels.*
          type: object
          object_type: keyword
          object_type_mapping_type: "*"
          description: >
            Kubernetes labels map

        - name: annotations.*
          type: object
          object_type: keyword
          object_type_mapping_type: "*"
          description: >
            Kubernetes annotations map

        - name: replicaset.name
          type: keyword
          description: >
            Kubernetes replicaset name

        - name: deployment.name
          type: keyword
          description: >
            Kubernetes deployment name

        - name: statefulset.name
          type: keyword
          description: >
            Kubernetes statefulset name

        - name: container.name
          type: keyword
          description: >
            Kubernetes container name

        - name: container.image
          type: keyword
          description: >
            Kubernetes container image
- key: process
  title: Process
  description: >
    Process metadata fields
  fields:
    - name: process
      type: group
      fields:
        - name: exe
          type: alias
          path: process.executable
          migration: true
- key: jolokia-autodiscover
  title: Jolokia Discovery autodiscover provider
  description: >
    Metadata from Jolokia Discovery added by the jolokia provider.
  fields:
    - name: jolokia.agent.version
      type: keyword
      description: >
        Version number of jolokia agent.
    - name: jolokia.agent.id
      type: keyword
      description: >
        Each agent has a unique id which can be either provided during startup of the agent in form of a configuration parameter or being autodetected. If autodected, the id has several parts: The IP, the process id, hashcode of the agent and its type.
    - name: jolokia.server.product
      type: keyword
      description: >
        The container product if detected.
    - name: jolokia.server.version
      type: keyword
      description: >
        The container's version (if detected).
    - name: jolokia.server.vendor
      type: keyword
      description: >
        The vendor of the container the agent is running in.
    - name: jolokia.url
      type: keyword
      description: >
        The URL how this agent can be contacted.
    - name: jolokia.secured
      type: boolean
      description: >
        Whether the agent was configured for authentication or not.
- key: common
  title: Common
  description: >
    Contains common fields available in all event types.
  fields:

    - name: metricset.module
      description: >
        The name of the module that generated the event.
      type: alias
      path: event.module
      migration: true

    - name: metricset.name
      description: >
        The name of the metricset that generated the event.

    - name: metricset.period
      type: integer
      description: >
        Current data collection period for this event in milliseconds.

    - name: service.address
      description: >
        Address of the machine where the service is running. This
        field may not be present when the data was collected locally.

    - name: service.hostname
      description: >
        Host name of the machine where the service is running.

    - name: type
      required: true
      example: metricsets
      description: >
        The document type. Always set to "doc".

    - name: systemd.fragment_path
      type: keyword
      description: the location of the systemd unit path
    - name: systemd.unit
      type: keyword
      description: the unit name of the systemd service

    - name: host
      type: group
      fields:
        - name: cpu.pct
          type: scaled_float
          format: percent
          description: Percent CPU used. This value is normalized by the number of CPU cores and it ranges from 0 to 1.
        - name: network.in.bytes
          type: long
          format: bytes
          description: The number of bytes received on all network interfaces by the host in a given period of time.
        - name: network.out.bytes
          type: long
          format: bytes
          description: The number of bytes sent out on all network interfaces by the host in a given period of time.
        - name: network.in.packets
          type: long
          description: The number of packets received on all network interfaces by the host in a given period of time.
        - name: network.out.packets
          type: long
          description: The number of packets sent out on all network interfaces by the host in a given period of time.
        - name: disk.read.bytes
          type: long
          format: bytes
          description: The total number of bytes read successfully in a given period of time.
        - name: disk.write.bytes
          type: long
          format: bytes
          description: The total number of bytes write successfully in a given period of time.
- key: aerospike
  title: "Aerospike"
  description: >
    Aerospike module
  release: ga
  fields:
    - name: aerospike
      type: group
      description: >
      fields:
        - name: namespace
          type: group
          description: >
            namespace
          release: ga
          fields:
            - name: client
              type: group
              description: >
                Client stats.
              fields:
                - name: delete
                  type: group
                  description: >
                    Client delete transactions stats.
                  fields:
                    - name: error
                      type: long
                      description: >
                        Number of client delete transactions that failed with an error.
                    - name: not_found
                      type: long
                      description: >
                        Number of client delete transactions that resulted in a not found.
                    - name: success
                      type: long
                      description: >
                        Number of successful client delete transactions.
                    - name: timeout
                      type: long
                      description: >
                        Number of client delete transactions that timed out.
                - name: read
                  type: group
                  description: >
                    Client read transactions stats.
                  fields:
                    - name: error
                      type: long
                      description: >
                        Number of client read transaction errors.
                    - name: not_found
                      type: long
                      description: >
                        Number of client read transaction that resulted in not found.
                    - name: success
                      type: long
                      description: >
                        Number of successful client read transactions.
                    - name: timeout
                      type: long
                      description: >
                        Number of client read transaction that timed out.
                - name: write
                  type: group
                  description: >
                    Client write transactions stats.
                  fields:
                    - name: error
                      type: long
                      description: >
                        Number of client write transactions that failed with an error.
                    - name: success
                      type: long
                      description: >
                        Number of successful client write transactions.
                    - name: timeout
                      type: long
                      description: >
                        Number of client write transactions that timed out.
            - name: device
              type: group
              description: >
                Disk storage stats
              fields:
                - name: available.pct
                  type: scaled_float
                  format: percent
                  description: >
                    Measures the minimum contiguous disk space across all disks in a namespace.
                - name: free.pct
                  type: scaled_float
                  format: percent
                  description: >
                    Percentage of disk capacity free for this namespace.
                - name: total.bytes
                  type: long
                  format: bytes
                  description: >
                    Total bytes of disk space allocated to this namespace on this node.
                - name: used.bytes
                  type: long
                  format: bytes
                  description: >
                    Total bytes of disk space used by this namespace on this node.
            - name: hwm_breached
              type: boolean
              description: >
                If true, Aerospike has breached 'high-water-[disk|memory]-pct' for this namespace.
            - name: memory
              type: group
              description: >
                Memory storage stats.
              fields:
                - name: free.pct
                  type: scaled_float
                  format: percent
                  description: >
                    Percentage of memory capacity free for this namespace on this node.
                - name: used.data.bytes
                  type: long
                  format: bytes
                  description: >
                    Amount of memory occupied by data for this namespace on this node.
                - name: used.index.bytes
                  type: long
                  format: bytes
                  description: >
                    Amount of memory occupied by the index for this namespace on this node.
                - name: used.sindex.bytes
                  type: long
                  format: bytes
                  description: >
                    Amount of memory occupied by secondary indexes for this namespace on this node.
                - name: used.total.bytes
                  type: long
                  format: bytes
                  description: >
                    Total bytes of memory used by this namespace on this node.
            - name: name
              type: keyword
              description: >
                Namespace name
            - name: node.host
              type: keyword
              description: >
                Node host
            - name: node.name
              type: keyword
              description: >
                Node name
            - name: objects
              type: group
              description: >
                Records stats.
              fields:
                - name: master
                  type: long
                  description: >
                    Number of records on this node which are active masters.
                - name: total
                  type: long
                  description: >
                    Number of records in this namespace for this node.
            - name: stop_writes
              type: boolean
              description: >
                If true this namespace is currently not allowing writes.
- key: apache
  title: "Apache"
  description: >
    Apache HTTPD server metricsets collected from the Apache web server.
  short_config: false
  release: ga
  settings: ["ssl", "http"]
  fields:
    - name: apache
      type: group
      description: >
        `apache` contains the metrics that were scraped from Apache.
      fields:
        - name: status
          type: group
          release: ga
          description: >
            `status` contains the metrics that were scraped from the Apache status page.
          fields:
            - name: hostname
              type: keyword
              description: >
                Apache hostname.
            - name: total_accesses
              type: long
              description: >
                Total number of access requests.
            - name: total_kbytes
              type: long
              description: >
                Total number of kilobytes served.
            - name: requests_per_sec
              type: scaled_float
              description: >
                Requests per second.
            - name: bytes_per_sec
              type: scaled_float
              description: >
                Bytes per second.
            - name: bytes_per_request
              type: scaled_float
              description: >
                Bytes per request.
            - name: workers.busy
              type: long
              description: >
                Number of busy workers.
            - name: workers.idle
              type: long
              description: >
                Number of idle workers.
            - name: uptime
              type: group
              description: >
                Uptime stats.
              fields:
                - name: server_uptime
                  type: long
                  description: >
                    Server uptime in seconds.
                - name: uptime
                  type: long
                  description: >
                    Server uptime.
            - name: cpu
              type: group
              description: >
                CPU stats.
              fields:
                - name: load
                  type: scaled_float
                  description: >
                    CPU Load.
                - name: user
                  type: scaled_float
                  description: >
                    CPU user load.
                - name: system
                  type: scaled_float
                  description: >
                    System cpu.
                - name: children_user
                  type: scaled_float
                  description: >
                    CPU of children user.
                - name: children_system
                  type: scaled_float
                  description: >
                    CPU of children system.
            - name: connections
              type: group
              description: >
                Connection stats.
              fields:
                - name: total
                  type: long
                  description: >
                    Total connections.
                - name: async.writing
                  type: long
                  description: >
                    Async connection writing.
                - name: async.keep_alive
                  type: long
                  description: >
                    Async keeped alive connections.
                - name: async.closing
                  type: long
                  description: >
                    Async closed connections.
            - name: load
              type: group
              description: >
                Load averages.
              fields:
                - name: "1"
                  type: scaled_float
                  scaling_factor: 100
                  description: >
                    Load average for the last minute.
                - name: "5"
                  type: scaled_float
                  scaling_factor: 100
                  description: >
                    Load average for the last 5 minutes.
                - name: "15"
                  type: scaled_float
                  scaling_factor: 100
                  description: >
                    Load average for the last 15 minutes.
            - name: scoreboard
              type: group
              description: >
                Scoreboard metrics.
              fields:
                - name: starting_up
                  type: long
                  description: >
                    Starting up.
                - name: reading_request
                  type: long
                  description: >
                    Reading requests.
                - name: sending_reply
                  type: long
                  description: >
                    Sending Reply.
                - name: keepalive
                  type: long
                  description: >
                    Keep alive.
                - name: dns_lookup
                  type: long
                  description: >
                    Dns Lookups.
                - name: closing_connection
                  type: long
                  description: >
                    Closing connections.
                - name: logging
                  type: long
                  description: >
                    Logging
                - name: gracefully_finishing
                  type: long
                  description: >
                    Gracefully finishing.
                - name: idle_cleanup
                  type: long
                  description: >
                    Idle cleanups.
                - name: open_slot
                  type: long
                  description: >
                    Open slots.
                - name: waiting_for_connection
                  type: long
                  description: >
                    Waiting for connections.
                - name: total
                  type: long
                  description: >
                    Total.
- key: beat
  title: "Beat"
  description: >
    Beat module
  release: ga
  settings: ["ssl", "http"]
  short_config: false
  fields:
    - name: beat
      type: group
      description: >
      fields:
        - name: id
          type: keyword
          description: >
            Beat ID.
        - name: type
          type: keyword
          description: >
            Beat type.
        - name: state
          type: group
          description: >
            Beat state
          release: ga
          fields:
            - name: management.enabled
              type: boolean
              description: >
                Is central management enabled?
            - name: module.count
              type: integer
              description: >
                Number of modules enabled
            - name: output.name
              type: keyword
              description: >
                Name of output used by Beat
            - name: queue.name
              type: keyword
              description: >
                Name of queue being used by Beat
        - name: stats
          type: group
          description: >
            Beat stats
          release: ga
          fields:
            - name: uptime.ms
              type: long
              description: >
                Beat uptime
            - name: runtime.goroutines
              type: long
              description: >
                Number of goroutines running in Beat
            - name: libbeat
              type: group
              description: >
                Fields common to all Beats
              fields:
                - name: output
                  type: group
                  description: >
                    Output stats
                  fields:
                    - name: type
                      type: keyword
                      description: >
                        Type of output
                    - name: events
                      type: group
                      description: >
                        Event counters
                      fields:
                        - name: acked
                          type: long
                          description: >
                            Number of events acknowledged
                        - name: active
                          type: long
                          description: >
                            Number of active events
                        - name: batches
                          type: long
                          description: >
                            Number of event batches
                        - name: dropped
                          type: long
                          description: >
                            Number of events dropped
                        - name: duplicates
                          type: long
                          description: >
                            Number of events duplicated
                        - name: failed
                          type: long
                          description: >
                            Number of events failed
                        - name: toomany
                          type: long
                          description: >
                            Number of too many events
                        - name: total
                          type: long
                          description: >
                            Total number of events
                    - name: read
                      type: group
                      description: >
                        Read stats
                      fields:
                        - name: bytes
                          type: long
                          description: >
                            Number of bytes read
                        - name: errors
                          type: long
                          description: >
                            Number of read errors
                    - name: write
                      type: group
                      description: >
                        Write stats
                      fields:
                        - name: bytes
                          type: long
                          description: >
                            Number of bytes written
                        - name: errors
                          type: long
                          description: >
                            Number of write errors
        
        
        
        
- key: ceph
  title: "Ceph"
  description: >
    Ceph module
  short_config: false
  release: ga
  settings: ["ssl", "http"]
  fields:
    - name: ceph
      type: group
      description: >
        `ceph` contains the metrics that were scraped from CEPH.
      fields:
        - name: cluster_disk
          type: group
          description: >
            cluster_disk
          release: ga
          fields:
            - name: available.bytes
              type: long
              description: >
                Available bytes of the cluster
              format: bytes
            - name: total.bytes
              type: long
              description: >
                Total bytes of the cluster
              format: bytes
            - name: used.bytes
              type: long
              description: >
                Used bytes of the cluster
              format: bytes
        - name: cluster_health
          type: group
          description: >
            cluster_health
          release: ga
          fields:
            - name: overall_status
              type: keyword
              description: >
                Overall status of the cluster
            - name: timechecks.epoch
              type: long
              description: >
                Map version
            - name: timechecks.round.value
              type: long
              description: >
                timecheck round
            - name: timechecks.round.status
              type: keyword
              description: >
                Status of the round
        - name: cluster_status
          type: group
          release: ga
          description: >
            cluster_status
          fields:
            - name: version
              type: long
              description: >
                Ceph Status version
            - name: traffic.read_bytes
              type: long
              format: bytes
              description: >
                Cluster read throughput per second
            - name: traffic.write_bytes
              type: long
              format: bytes
              description: >
                Cluster write throughput per second
            - name: traffic.read_op_per_sec
              type: long
              description: >
                Cluster read iops per second
            - name: traffic.write_op_per_sec
              type: long
              description: >
                Cluster write iops per second
            - name: misplace.total
              type: long
              description: >
                Cluster misplace pg number
            - name: misplace.objects
              type: long
              description: >
                Cluster misplace objects number
            - name: misplace.ratio
              type: scaled_float
              format: percent
              description: >
                Cluster misplace ratio
            - name: degraded.total
              type: long
              description: >
                Cluster degraded pg number
            - name: degraded.objects
              type: long
              description: >
                Cluster degraded objects number
            - name: degraded.ratio
              type: scaled_float
              format: percent
              description: >
                Cluster degraded ratio
            - name: pg.data_bytes
              type: long
              format: bytes
              description: >
                Cluster pg data bytes
            - name: pg.avail_bytes
              type: long
              format: bytes
              description: >
                Cluster available bytes
            - name: pg.total_bytes
              type: long
              format: bytes
              description: >
                Cluster total bytes
            - name: pg.used_bytes
              type: long
              format: bytes
              description: >
                Cluster used bytes
            - name: pg_state.state_name
              type: long
              description: >
                Pg state description
            - name: pg_state.count
              type: long
              description: >
                Shows how many pgs are in state of pg_state.state_name
            - name: pg_state.version
              type: long
              description: >
                Cluster status version
            - name: osd.full
              type: boolean
              description: >
                Is osd full
            - name: osd.nearfull
              type: boolean
              description: >
                Is osd near full
            - name: osd.num_osds
              type: long
              description: >
                Shows how many osds in the cluster
            - name: osd.num_up_osds
              type: long
              description: >
                Shows how many osds are on the state of UP
            - name: osd.num_in_osds
              type: long
              description: >
                Shows how many osds are on the state of IN
            - name: osd.num_remapped_pgs
              type: long
              description: >
                Shows how many osds are on the state of REMAPPED
            - name: osd.epoch
              type: long
              description: >
                epoch number
        - name: mgr_cluster_disk
          type: group
          description: >
            see: cluster_disk
          release: beta
          fields:
        - name: mgr_cluster_health
          type: group
          description: >
            see: cluster_health
          release: beta
          fields:
        - name: mgr_osd_perf
          type: group
          description: >
            OSD performance metrics of Ceph cluster
          release: beta
          fields:
            - name: id
              type: long
              description: OSD ID
            - name: stats.commit_latency_ms
              type: long
              description: Commit latency in ms
            - name: stats.apply_latency_ms
              type: long
              description: Apply latency in ms
            - name: stats.commit_latency_ns
              type: long
              description: Commit latency in ns
            - name: stats.apply_latency_ns
              type: long
              description: Apply latency in ns
        - name: mgr_osd_pool_stats
          type: group
          description: >
            OSD pool stats of Ceph cluster
          release: beta
          fields:
            - name: pool_name
              type: keyword
              description: Pool name
            - name: pool_id
              type: long
              description: Pool ID
            - name: client_io_rate
              type: object
              description: Client I/O rates
              fields:
                - name: read_bytes_sec
                  type: long
                  keyword: Bytes read per second
                - name: write_bytes_sec
                  type: long
                  keyword: Bytes written per second
                - name: read_op_per_sec
                  type: long
                  keyword: Read operations per second
                - name: write_op_per_sec
                  type: long
                  keyword: Write operations per second
        - name: mgr_osd_tree
          type: group
          description: >
            see: osd_tree
          release: beta
          fields:
        - name: mgr_pool_disk
          type: group
          description: >
            see: pool_disk
          release: beta
          fields:
        - name: monitor_health
          type: group
          release: ga
          description: >
            monitor_health stats data
          fields:
            - name: available.pct
              type: long
              description: >
                Available percent of the MON
            - name: health
              type: keyword
              description: >
                Health of the MON
            - name: available.kb
              type: long
              description: >
                Available KB of the MON
            - name: total.kb
              type: long
              description: >
                Total KB of the MON
            - name: used.kb
              type: long
              description: >
                Used KB of the MON
            - name: last_updated
              type: date
              description: >
                Time when was updated
            - name: name
              type: keyword
              description: >
                Name of the MON
            - name: store_stats.log.bytes
              type: long
              description: >
                Log bytes of MON
              format: bytes
            - name: store_stats.misc.bytes
              type: long
              description: >
                Misc bytes of MON
              format: bytes
            - name: store_stats.sst.bytes
              type: long
              description: >
                SST bytes of MON
              format: bytes
            - name: store_stats.total.bytes
              type: long
              description: >
                Total bytes of MON
              format: bytes
            - name: store_stats.last_updated
              type: long
              description: >
                Last updated
        - name: osd_df
          type: group
          release: ga
          description: >
            ceph osd disk usage information
          fields:
            - name: id
              type: long
              description: >
                osd node id
            - name: name
              type: keyword
              description: >
                osd node name
            - name: device_class
              type: keyword
              description: >
                osd node type, illegal type include hdd, ssd etc.
            - name: total.byte
              type: long
              format: bytes
              description: >
                osd disk total volume
            - name: used.byte
              type: long
              format: bytes
              description: >
                osd disk usage volume
            - name: available.bytes
              type: long
              format: bytes
              description: >
                osd disk available volume
            - name: pg_num
              type: long
              description: >
                shows how many pg located on this osd
            - name: used.pct
              type: scaled_float
              format: percent
              description: >
                osd disk usage percentage
        - name: osd_tree
          type: group
          description: >
            ceph osd tree info
          release: ga
          fields:
            - name: id
              type: long
              description: >
                osd or bucket node id
            - name: name
              type: keyword
              description: >
                osd or bucket node name
            - name: type
              type: keyword
              description: >
                osd or bucket node type, illegal type include osd, host, root etc.
            - name: type_id
              type: long
              description: >
                osd or bucket node typeID
            - name: children
              type: keyword
              description: >
                bucket children list, separated by comma.
            - name: crush_weight
              type: float
              description: >
                osd node crush weight
            - name: depth
              type: long
              description: >
                node depth
            - name: exists
              type: boolean
              description: >
                is node still exist or not(1-yes, 0-no)
            - name: primary_affinity
              type: float
              description: >
                the weight of reading data from primary osd
            - name: reweight
              type: long
              description: >
                the reweight of osd
            - name: status
              type: keyword
              description: >
                status of osd, it should be up or down
            - name: device_class
              type: keyword
              description: >
                the device class of osd, like hdd, ssd etc.
            - name: father
              type: keyword
              description: >
                the parent node of this osd or bucket node
        - name: pool_disk
          type: group
          description: >
            pool_disk
          release: ga
          fields:
            - name: id
              type: long
              description: >
                Id of the pool
            - name: name
              type: keyword
              description: >
                Name of the pool
            - name: stats.available.bytes
              type: long
              description: >
                Available bytes of the pool
              format: bytes
            - name: stats.objects
              type: long
              description: >
                Number of objects of the pool
            - name: stats.used.bytes
              type: long
              description: >
                Used bytes of the pool
              format: bytes
            - name: stats.used.kb
              type: long
              description: >
                Used kb of the pool
- key: consul
  title: "Consul"
  description: >
    Consul module
  release: beta
  settings: ["ssl", "http"]
  fields:
    - name: consul
      type: group
      fields:
        - name: agent
          type: group
          release: beta
          description: >
            Agent Metricset fetches metrics information from a Consul instance running as Agent
          fields:
            - name: autopilot
              type: group
              fields:
                - name: healthy
                  type: boolean
                  description: Overall health of the local server cluster
            - name: runtime
              type: group
              description: Runtime related metrics
              fields:
                - name: sys
                  type: group
                  fields:
                    - name: bytes
                      type: long
                      description: Number of bytes of memory obtained from the OS.
                - name: malloc_count
                  type: long
                  description: Heap objects allocated
                - name: heap_objects
                  type: long
                  description: Objects allocated on the heap and is a general memory pressure indicator. This may burst from time to time but should return to a steady state value.
                - name: goroutines
                  type: long
                  description: Running goroutines and is a general load pressure indicator. This may burst from time to time but should return to a steady state value.
                - name: alloc
                  type: group
                  fields:
                    - name: bytes
                      type: long
                      description: Bytes allocated by the Consul process.
                - name: garbage_collector
                  type: group
                  description: Garbage collector metrics
                  fields:
                    - name: runs
                      type: long
                      description: Garbage collector total executions
                    - name: pause
                      type: group
                      description: Time that the garbage collector has paused the app
                      fields:
                        - name: current
                          type: group
                          fields:
                            - name: ns
                              type: long
                              description: Garbage collector pause time in nanoseconds
                        - name: total
                          type: group
                          fields:
                            - name: ns
                              type: long
                              description: Nanoseconds consumed by stop-the-world garbage collection pauses since Consul started.
- key: couchbase
  title: "Couchbase"
  description: >
    Metrics collected from Couchbase servers.
  short_config: false
  release: ga
  settings: ["ssl", "http"]
  fields:
    - name: couchbase
      type: group
      description: >
        `couchbase` contains the metrics that were scraped from Couchbase.
      fields:
        - name: bucket
          type: group
          description: >
            Couchbase bucket metrics.
          release: ga
          fields:
            - name: name
              type: keyword
              description: >
                Name of the bucket.
            - name: type
              type: keyword
              description: >
                Type of the bucket.
            - name: data.used.bytes
              format: bytes
              type: long
              description: >
                Size of user data within buckets of the specified state that are resident in RAM.
            - name: disk.fetches
              type: double
              description: >
                Number of disk fetches.
            - name: disk.used.bytes
              format: bytes
              type: long
              description: >
                Amount of disk used (bytes).
            - name: memory.used.bytes
              format: bytes
              type: long
              description: >
                Amount of memory used by the bucket (bytes).
            - name: quota.ram.bytes
              format: bytes
              type: long
              description: >
                Amount of RAM used by the bucket (bytes).
            - name: quota.use.pct
              format: percent
              type: scaled_float
              description: >
                Percentage of RAM used (for active objects) against the configured bucket size (%).
            - name: ops_per_sec
              type: double
              description: >
                Number of operations per second.
            - name: item_count
              type: long
              description: >
                Number of items associated with the bucket.
        - name: cluster
          type: group
          description: >
            Couchbase cluster metrics.
          release: ga
          fields:
            - name: hdd.free.bytes
              format: bytes
              type: long
              description: >
                Free hard drive space in the cluster (bytes).
            - name: hdd.quota.total.bytes
              format: bytes
              type: long
              description: >
                Hard drive quota total for the cluster (bytes).
            - name: hdd.total.bytes
              format: bytes
              type: long
              description: >
                Total hard drive space available to the cluster (bytes).
            - name: hdd.used.value.bytes
              format: bytes
              type: long
              description: >
                Hard drive space used by the cluster (bytes).
            - name: hdd.used.by_data.bytes
              format: bytes
              type: long
              description: >
                Hard drive space used by the data in the cluster (bytes).
            - name: max_bucket_count
              type: long
              description: >
                Max bucket count setting.
            - name: quota.index_memory.mb
              type: double
              description: >
                Memory quota setting for the Index service (Mbyte).
            - name: quota.memory.mb
              type: double
              description: >
                Memory quota setting for the cluster (Mbyte).
            - name: ram.quota.total.value.bytes
              format: bytes
              type: long
              description: >
                RAM quota total for the cluster (bytes).
            - name: ram.quota.total.per_node.bytes
              format: bytes
              type: long
              description: >
                RAM quota used by the current node in the cluster (bytes).
            - name: ram.quota.used.value.bytes
              format: bytes
              type: long
              description: >
                RAM quota used by the cluster (bytes).
            - name: ram.quota.used.per_node.bytes
              format: bytes
              type: long
              description: >
                Ram quota used by the current node in the cluster (bytes)
            - name: ram.total.bytes
              format: bytes
              type: long
              description: >
                Total RAM available to cluster (bytes).
            - name: ram.used.value.bytes
              format: bytes
              type: long
              description: >
                RAM used by the cluster (bytes).
            - name: ram.used.by_data.bytes
              format: bytes
              type: long
              description: >
                RAM used by the data in the cluster (bytes).
        - name: node
          type: group
          description: >
            Couchbase node metrics.
          release: ga
          fields:
            - name: cmd_get
              type: double
              description: >
                Number of get commands
            - name: couch.docs.disk_size.bytes
              format: bytes
              type: long
              description: >
                Amount of disk space used by Couch docs (bytes).
            - name: couch.docs.data_size.bytes
              format: bytes
              type: long
              description: >
                Data size of Couch docs associated with a node (bytes).
            - name: couch.spatial.data_size.bytes
              type: long
              description: >
                Size of object data for spatial views (bytes).
            - name: couch.spatial.disk_size.bytes
              type: long
              description: >
                Amount of disk space used by spatial views (bytes).
            - name: couch.views.disk_size.bytes
              type: long
              description: >
                Amount of disk space used by Couch views (bytes).
            - name: couch.views.data_size.bytes
              type: long
              description: >
                Size of object data for Couch views (bytes).
            - name: cpu_utilization_rate.pct
              type: scaled_float
              description: >
                The CPU utilization rate (%).
            - name: current_items.value
              type: long
              description: >
                Number of current items.
            - name: current_items.total
              type: long
              description: >
                Total number of items associated with the node.
            - name: ep_bg_fetched
              type: long
              description: >
                Number of disk fetches performed since the server was started.
            - name: get_hits
              type: long
              description: >
                Number of get hits.
            - name: hostname
              type: keyword
              description: >
                The hostname of the node.
            - name: mcd_memory.allocated.bytes
              format: bytes
              type: long
              description: >
                Amount of memcached memory allocated (bytes).
            - name: mcd_memory.reserved.bytes
              type: long
              description: >
                Amount of memcached memory reserved (bytes).
            - name: memory.free.bytes
              type: long
              description: >
                Amount of memory free for the node (bytes).
            - name: memory.total.bytes
              type: long
              description: >
                Total memory available to the node (bytes).
            - name: memory.used.bytes
              type: long
              description: >
                Memory used by the node (bytes).
            - name: ops
              type: long
              description: >
                Number of operations performed on Couchbase.
            - name: swap.total.bytes
              type: long
              description: >
                Total swap size allocated (bytes).
            - name: swap.used.bytes
              type: long
              description: >
                Amount of swap space used (bytes).
            - name: uptime.sec
              type: long
              description: >
                Time during which the node was in operation (sec).
            - name: vb_replica_curr_items
              type: long
              description: >
                Number of items/documents that are replicas.
- key: couchdb
  title: "CouchDB"
  description: >
    couchdb module
  release: ga
  settings: ["ssl", "http"]
  fields:
    - name: couchdb
      type: group
      description: Couchdb metrics
      fields:
        - name: server
          type: group
          description: >
            Contains CouchDB server stats
          release: ga
          fields:
            - name: httpd
              type: group
              description: >
                HTTP statistics
              fields:
                - name: view_reads
                  type: long
                  description: >
                     Number of view reads
        
                - name: bulk_requests
                  type: long
                  description: >
                    Number of bulk requests
        
                - name: clients_requesting_changes
                  type: long
                  description: >
                    Number of clients for continuous _changes
        
                - name: temporary_view_reads
                  type: long
                  description: >
                    Number of temporary view reads
        
                - name: requests
                  type: long
                  description: >
                    Number of HTTP requests
        
            - name: httpd_request_methods
              type: group
              description: >
                HTTP request methods
              fields:
                - name: COPY
                  type: long
                  description: >
                    Number of HTTP COPY requests
        
                - name: HEAD
                  type: long
                  description: >
                    Number of HTTP HEAD requests
        
                - name: POST
                  type: long
                  description: >
                    Number of HTTP POST requests
        
                - name: DELETE
                  type: long
                  description: >
                    Number of HTTP DELETE requests
        
                - name: GET
                  type: long
                  description: >
                    Number of HTTP GET requests
        
                - name: PUT
                  type: long
                  description: >
                    Number of HTTP PUT requests
        
            - name: httpd_status_codes
              type: group
              description: >
                HTTP status codes statistics
              fields:
                - name: "200"
                  type: long
                  description: >
                    Number of HTTP 200 OK responses
        
                - name: "201"
                  type: long
                  description: >
                    Number of HTTP 201 Created responses
        
                - name: "202"
                  type: long
                  description: >
                    Number of HTTP 202 Accepted responses
        
                - name: "301"
                  type: long
                  description: >
                    Number of HTTP 301 Moved Permanently responses
        
                - name: "304"
                  type: long
                  description: >
                    Number of HTTP 304 Not Modified responses
        
                - name: "400"
                  type: long
                  description: >
                    Number of HTTP 400 Bad Request responses
        
                - name: "401"
                  type: long
                  description: >
                    Number of HTTP 401 Unauthorized responses
        
                - name: "403"
                  type: long
                  description: >
                    Number of HTTP 403 Forbidden responses
        
                - name: "404"
                  type: long
                  description: >
                     Number of HTTP 404 Not Found responses
        
                - name: "405"
                  type: long
                  description: >
                    Number of HTTP 405 Method Not Allowed responses
        
                - name: "409"
                  type: long
                  description: >
                    Number of HTTP 409 Conflict responses
        
                - name: "412"
                  type: long
                  description: >
                    Number of HTTP 412 Precondition Failed responses
        
                - name: "500"
                  type: long
                  description: >
                    Number of HTTP 500 Internal Server Error responses
        
            - name: couchdb
              type: group
              description: >
                couchdb statistics
              fields:
                - name: database_writes
                  type: long
                  description: >
                    Number of times a database was changed
        
                - name: open_databases
                  type: long
                  description: >
                    Number of open databases
        
                - name: auth_cache_misses
                  type: long
                  description: >
                    Number of authentication cache misses
        
                - name: request_time
                  type: long
                  description: >
                    Length of a request inside CouchDB without MochiWeb
        
                - name: database_reads
                  type: long
                  description: >
                    Number of times a document was read from a database
        
                - name: auth_cache_hits
                  type: long
                  description: >
                    Number of authentication cache hits
        
                - name: open_os_files
                  type: long
                  description: >
                    Number of file descriptors CouchDB has open
- key: docker
  title: "Docker"
  description: >
    Docker stats collected from Docker.
  release: ga
  settings: ["ssl"]
  short_config: false
  fields:
    - name: docker
      type: group
      description: >
        Information and statistics about docker's running containers.
      fields:
        - name: container
          type: group
          description: >
            Docker container metrics.
          release: ga
          fields:
            - name: command
              type: keyword
              description: >
                Command that was executed in the Docker container.
            - name: created
              type: date
              description: >
                Date when the container was created.
            - name: status
              type: keyword
              description: >
                Container status.
            - name: ip_addresses
              type: ip
              description: >
                Container IP addresses.
            - name: size
              type: group
              description: >
                Container size metrics.
              fields:
                - name: root_fs
                  type: long
                  description: >
                     Total size of all the files in the container.
                - name: rw
                  type: long
                  description: >
                     Size of the files that have been created or changed since creation.
            - name: tags
              type: keyword
              description: >
                Image tags.
        - name: cpu
          type: group
          description: >
            Runtime CPU metrics.
          release: ga
          fields:
            - name: kernel.pct
              type: scaled_float
              format: percent
              description: >
                Percentage of time in kernel space.
            - name: kernel.norm.pct
              type: scaled_float
              format: percent
              description: >
                Percentage of time in kernel space normalized by the number of CPU cores.
            - name: kernel.ticks
              type: long
              description: >
                CPU ticks in kernel space.
            - name: system.pct
              type: scaled_float
              format: percent
              description: >
                Percentage of total CPU time in the system.
            - name: system.norm.pct
              type: scaled_float
              format: percent
              description: >
                Percentage of total CPU time in the system normalized by the number of CPU cores.
            - name: system.ticks
              type: long
              description: >
                CPU system ticks.
            - name: user.pct
              type: scaled_float
              format: percent
              description: >
                Percentage of time in user space.
            - name: user.norm.pct
              type: scaled_float
              format: percent
              description: >
                Percentage of time in user space normalized by the number of CPU cores.
            - name: user.ticks
              type: long
              description: >
                CPU ticks in user space.
            - name: total.pct
              type: scaled_float
              format: percent
              description: >
                Total CPU usage.
            - name: total.norm.pct
              type: scaled_float
              format: percent
              description: >
                Total CPU usage normalized by the number of CPU cores.
            - name: core.*.pct
              type: object
              object_type: scaled_float
              format: percent
              description: >
                Percentage of CPU time in this core.
            - name: core.*.norm.pct
              type: object
              object_type: scaled_float
              format: percent
              description: >
                Percentage of CPU time in this core, normalized by the number of CPU cores.
            - name: core.*.ticks
              type: object
              object_type: long
              description: >
                Number of CPU ticks in this core.
        - name: diskio
          type: group
          description: >
            Disk I/O metrics.
          release: ga
          fields:
            - name: read
              type: group
              description: >
                Accumulated reads during the life of the container
              fields:
                - name: ops
                  type: long
                  description: >
                    Number of reads during the life of the container
                - name: bytes
                  type: long
                  format: bytes
                  description: >
                    Bytes read during the life of the container
                - name: rate
                  type: long
                  description: >
                    Number of current reads per second
                - name: service_time
                  type: long
                  description: >
                    Total time to service IO requests, in nanoseconds
                - name: wait_time
                  type: long
                  description: > 
                    Total time requests spent waiting in queues for service, in nanoseconds
                - name: queued
                  type: long
                  description: >
                    Total number of queued requests
            - name: reads
              type: scaled_float
              deprecated: 6.4
              description: >
                Number of current reads per second
            - name: write
              type: group
              description: >
                Accumulated writes during the life of the container
              fields:
                - name: ops
                  type: long
                  description: >
                    Number of writes during the life of the container
                - name: bytes
                  type: long
                  format: bytes
                  description: >
                    Bytes written during the life of the container
                - name: rate
                  type: long
                  description: >
                    Number of current writes per second
                - name: service_time
                  type: long
                  description: >
                    Total time to service IO requests, in nanoseconds
                - name: wait_time
                  type: long
                  description: > 
                    Total time requests spent waiting in queues for service, in nanoseconds
                - name: queued
                  type: long
                  description: >
                    Total number of queued requests
            - name: writes
              type: scaled_float
              deprecated: 6.4
              description: >
                Number of current writes per second
            - name: summary
              type: group
              description: >
                Accumulated reads and writes during the life of the container
              fields:
                - name: ops
                  type: long
                  description: >
                    Number of I/O operations during the life of the container
                - name: bytes
                  type: long
                  format: bytes
                  description: >
                    Bytes read and written during the life of the container
                - name: rate
                  type: long
                  description: >
                    Number of current operations per second
                - name: service_time
                  type: long
                  description: >
                    Total time to service IO requests, in nanoseconds
                - name: wait_time
                  type: long
                  description: > 
                    Total time requests spent waiting in queues for service, in nanoseconds
                - name: queued
                  type: long
                  description: >
                    Total number of queued requests
            - name: total
              type: scaled_float
              deprecated: 6.4
              description: >
                Number of reads and writes per second
        - name: event
          type: group
          description: >
            Docker event
          release: ga
          fields:
            - name: status
              type: keyword
              description: >
                Event status
            - name: id
              type: keyword
              description: >
                Event id when available
            - name: from
              type: keyword
              description: >
                Event source
            - name: type
              type: keyword
              description: >
                The type of object emitting the event
            - name: action
              type: keyword
              description: >
                The type of event
            - name: actor
              type: group
              description: >
                Actor
              fields:
                - name: id
                  type: keyword
                  description: >
                    The ID of the object emitting the event
                - name: attributes
                  type: object
                  object_type: keyword
                  description: >
                    Various key/value attributes of the object, depending on its type
        - name: healthcheck
          type: group
          description: >
            Docker healthcheck metrics.
        
            Healthcheck data will only be available from docker containers where the
            docker `HEALTHCHECK` instruction has been used to build the docker image.
          release: ga
          fields:
            - name: failingstreak
              type: integer
              description: >
                concurent failed check
            - name: status
              type: keyword
              description: >
                Healthcheck status code
            - name: event
              type: group
              description: >
                event fields.
              fields:
                - name: end_date
                  type: date
                  description: >
                    Healthcheck end date
                - name: start_date
                  type: date
                  description: >
                    Healthcheck start date
                - name: output
                  type: keyword
                  description: >
                    Healthcheck output
                - name: exit_code
                  type: integer
                  description: >
                    Healthcheck status code
        - name: image
          type: group
          description: >
            Docker image metrics.
          release: ga
          fields:
            - name: id
              type: group
              description: >
                The image layers identifier.
              fields:
                - name: current
                  type: keyword
                  description: >
                     Unique image identifier given upon its creation.
                - name: parent
                  type: keyword
                  description: >
                     Identifier of the image, if it exists, from which the current image directly descends.
            - name: created
              type: date
              description: >
                Date and time when the image was created.
            - name: size
              type: group
              description: >
                Image size layers.
              fields:
                - name: virtual
                  type: long
                  description: >
                     Size of the image.
                - name: regular
                  type: long
                  description: >
                     Total size of the all cached images associated to the current image.
        
            - name: labels
              type: object
              object_type: keyword
              description: >
                Image labels.
        
            - name: tags
              type: keyword
              description: >
                Image tags.
        - name: info
          type: group
          description: >
            Info metrics based on https://docs.docker.com/engine/reference/api/docker_remote_api_v1.24/#/display-system-wide-information.
          release: ga
          fields:
            - name: containers
              type: group
              description: >
                Overall container stats.
              fields:
                - name: paused
                  type: long
                  description: >
                    Total number of paused containers.
                - name: running
                  type: long
                  description: >
                    Total number of running containers.
                - name: stopped
                  type: long
                  description: >
                    Total number of stopped containers.
                - name: total
                  type: long
                  description: >
                    Total number of existing containers.
            - name: id
              type: keyword
              description: >
                Unique Docker host identifier.
        
            - name: images
              type: long
              description: >
                Total number of existing images.
        - name: memory
          type: group
          description: >
            Memory metrics.
          release: ga
          fields:
            - name: stats.*
              type: object
              object_type: long
              object_type_mapping_type: "*"
              description: >
                Raw memory stats from the cgroups memory.stat interface
            - name: commit
              type: group
              description: >
                Committed bytes on Windows
              fields:
                - name: total
                  type: long
                  format: bytes
                  description: >
                    Total bytes
                - name: peak
                  type: long
                  format: bytes
                  description: >
                    Peak committed bytes on Windows
            - name: private_working_set.total
              type: long
              format: bytes
              description: >
                private working sets on Windows
            - name: fail.count
              type: scaled_float
              description: >
                Fail counter.
            - name: limit
              type: long
              format: bytes
              description: >
                Memory limit.
            - name: rss
              type: group
              description: >
                RSS memory stats.
              fields:
                - name: total
                  type: long
                  format: bytes
                  description: >
                    Total memory resident set size.
                - name: pct
                  type: scaled_float
                  format: percent
                  description: >
                    Memory resident set size percentage.
            - name: usage
              type: group
              description: >
                Usage memory stats.
              fields:
                - name: max
                  type: long
                  format: bytes
                  description: >
                    Max memory usage.
                - name: pct
                  type: scaled_float
                  format: percent
                  description: >
                    Memory usage percentage.
                - name: total
                  type: long
                  format: bytes
                  description: >
                    Total memory usage.
        
        - name: network
          type: group
          description: >
            Network metrics.
          release: ga
          fields:
        
            - name: interface
              type: keyword
              description: >
                Network interface name.
            - name: in
              type: group
              deprecated: 6.4
              description: >
                Incoming network stats per second.
              fields:
                - name: bytes
                  type: long
                  format: bytes
                  description: >
                    Total number of incoming bytes.
                - name: dropped
                  type: scaled_float
                  description: >
                    Total number of dropped incoming packets.
                - name: errors
                  type: long
                  description: >
                    Total errors on incoming packets.
                - name: packets
                  type: long
                  description: >
                    Total number of incoming packets.
            - name: out
              type: group
              deprecated: 6.4
              description: >
                Outgoing network stats per second.
              fields:
                - name: bytes
                  type: long
                  format: bytes
                  description: >
                    Total number of outgoing bytes.
                - name: dropped
                  type: scaled_float
                  description: >
                    Total number of dropped outgoing packets.
                - name: errors
                  type: long
                  description: >
                    Total errors on outgoing packets.
                - name: packets
                  type: long
                  description: >
                    Total number of outgoing packets.
            - name: inbound
              type: group
              description: >
                Incoming network stats since the container started.
              fields:
                - name: bytes
                  type: long
                  format: bytes
                  description: >
                    Total number of incoming bytes.
                - name: dropped
                  type: long
                  description: >
                    Total number of dropped incoming packets.
                - name: errors
                  type: long
                  description: >
                    Total errors on incoming packets.
                - name: packets
                  type: long
                  description: >
                    Total number of incoming packets.
            - name: outbound
              type: group
              description: >
                Outgoing network stats since the container started.
              fields:
                - name: bytes
                  type: long
                  format: bytes
                  description: >
                    Total number of outgoing bytes.
                - name: dropped
                  type: long
                  description: >
                    Total number of dropped outgoing packets.
                - name: errors
                  type: long
                  description: >
                    Total errors on outgoing packets.
                - name: packets
                  type: long
                  description: >
                    Total number of outgoing packets.
- key: dropwizard
  title: "Dropwizard"
  description: >
    Stats collected from Dropwizard.
  release: ga
  settings: ["ssl", "http"]
  short_config: false
  fields:
    - name: dropwizard
      type: group
      description: >
      fields:
        - release: ga
- key: elasticsearch
  title: "Elasticsearch"
  description: >
    Elasticsearch module
  release: ga
  settings: ["ssl", "http"]
  short_config: false
  fields:
    - name: elasticsearch
      type: group
      description: >
      fields:
        - name: cluster.name
          type: keyword
          description: >
            Elasticsearch cluster name.

        - name: cluster.id
          type: keyword
          description: >
            Elasticsearch cluster id.

        - name: cluster.state.id
          type: keyword
          description: >
            Elasticsearch state id.

        - name: node.id
          type: keyword
          description: >
            Node ID

        - name: node.name
          type: keyword
          description: >
            Node name.
        - name: ccr
          type: group
          description: >
            Cross-cluster replication stats
          release: ga
          fields:
            - name: leader
              type: group
              fields:
                - name: index
                  type: keyword
                  description: >
                    Name of leader index
                - name: max_seq_no
                  type: long
                  description: >
                    Maximum sequence number of operation on the leader shard
            - name: follower
              type: group
              fields:
                - name: index
                  type: keyword
                  description: >
                    Name of follower index
                - name: shard.number
                  type: long
                  description: >
                    Number of the shard within the index
                - name: operations_written
                  type: long
                  description: >
                    Number of operations indexed (replicated) into the follower shard from the leader shard
                - name: time_since_last_read.ms
                  type: long
                  description: >
                    Time, in ms, since the follower last fetched from the leader
                - name: global_checkpoint
                  type: long
                  description: >
                    Global checkpoint value on follower shard
        - name: cluster.stats
          type: group
          description: >
            Cluster stats
          release: ga
          fields:
            - name: status
              type: keyword
              description: >
                Cluster status (green, yellow, red).
            - name: nodes
              type: group
              description: >
                Nodes statistics.
              fields:
              - name: count
                type: long
                description: >
                  Total number of nodes in cluster.
              - name: master
                type: long
                description: >
                  Number of master-eligible nodes in cluster.
              - name: data
                type: long
                description: >
                  Number of data nodes in cluster.
            - name: indices
              type: group
              description: >
                Indices statistics.
              fields:
              - name: count
                type: long
                description: >
                  Total number of indices in cluster.
              - name: shards
                type: group
                description: >
                  Shard statistics.
                fields:
                - name: count
                  type: long
                  description: >
                    Total number of shards in cluster.
                - name: primaries
                  type: long
                  description: >
                    Total number of primary shards in cluster.
              - name: fielddata.memory.bytes
                type: long
                description: >
                  Memory used for fielddata.
        - name: enrich
          type: group
          description: >
            Enrich stats
          release: ga
          fields:
            - name: queue.size
              type: long
              description: >
                Number of search requests in the queue.
            - name: remote_requests
              type: group
              fields:
                - name: current
                  type: long
                  description: >
                    Current number of outstanding remote requests.
                - name: total
                  type: long
                  description: >
                    Number of outstanding remote requests executed since node startup.
            - name: executed_searches.total
              type: long
              description: >
                Number of search requests that enrich processors have executed since node startup.
        - name: index
          type: group
          description: >
            index
          release: ga
          fields:
            - name: name
              type: keyword
              description: >
                Index name.
            - name: total
              type: group
              fields:
                - name: docs.count
                  type: long
                  description: >
                    Total number of documents in the index.
                - name: docs.deleted
                  type: long
                  description: >
                    Total number of deleted documents in the index.
                - name: store.size.bytes
                  type: long
                  format: bytes
                  description: >
                    Total size of the index in bytes.
                - name: segments.count
                  type: long
                  description: >
                    Total number of index segments.
                - name: segments.memory.bytes
                  type: long
                  format: bytes
                  description: >
                    Total number of memory used by the segments in bytes.
        
        - name: index.recovery
          type: group
          description: >
            index
          release: ga
          fields:
            - name: id
              type: long
              description: >
                Shard recovery id.
            - name: type
              type: keyword
              description: >
                Shard recovery type.
            - name: primary
              type: boolean
              description: >
                True if primary shard.
            - name: stage
              type: keyword
              description: >
                Recovery stage.
        
            - name: target.id
              type: keyword
              description: >
                Target node id.
            - name: target.host
              type: keyword
              description: >
                Target node host address (could be IP address or hostname).
            - name: target.name
              type: keyword
              description: >
                Target node name.
        
            - name: source.id
              type: keyword
              description: >
                Source node id.
            - name: source.host
              type: keyword
              description: >
                Source node host address (could be IP address or hostname).
            - name: source.name
              type: keyword
              description: >
                Source node name.
        - name: index.summary
          type: group
          description: >
            index
          release: ga
          fields:
            - name: primaries
              type: group
              fields:
                - name: docs.count
                  type: long
                  description: >
                    Total number of documents in the index.
                - name: docs.deleted
                  type: long
                  description: >
                    Total number of deleted documents in the index.
                - name: store.size.bytes
                  type: long
                  format: bytes
                  description: >
                    Total size of the index in bytes.
                - name: segments.count
                  type: long
                  description: >
                    Total number of index segments.
                - name: segments.memory.bytes
                  type: long
                  format: bytes
                  description: >
                    Total number of memory used by the segments in bytes.
            - name: total
              type: group
              fields:
                - name: docs.count
                  type: long
                  description: >
                    Total number of documents in the index.
                - name: docs.deleted
                  type: long
                  description: >
                    Total number of deleted documents in the index.
                - name: store.size.bytes
                  type: long
                  format: bytes
                  description: >
                    Total size of the index in bytes.
                - name: segments.count
                  type: long
                  description: >
                    Total number of index segments.
                - name: segments.memory.bytes
                  type: long
                  format: bytes
                  description: >
                    Total number of memory used by the segments in bytes.
        - name: ml.job
          type: group
          description: >
            ml
          release: ga
          fields:
            - name: id
              type: keyword
              description: >
                Unique ml job id.
            - name: state
              type: keyword
              description: >
                Job state.
            - name: data_counts.processed_record_count
              type: long
              description: >
                Processed data events.
            - name: data_counts.invalid_date_count
              type: long
              description: >
                The number of records with either a missing date field or a date that could not be parsed.
        
        
        - name: node
          type: group
          description: >
            node
          release: ga
          fields:
            - name: version
              type: keyword
              description: >
                Node version.
            - name: jvm
              type: group
              description: >
                JVM Info.
              fields:
                - name: version
                  type: keyword
                  description: >
                    JVM version.
                - name: memory.heap.init.bytes
                  type: long
                  format: bytes
                  description: >
                    Heap init used by the JVM in bytes.
                - name: memory.heap.max.bytes
                  type: long
                  format: bytes
                  description: >
                    Heap max used by the JVM in bytes.
                - name: memory.nonheap.init.bytes
                  type: long
                  format: bytes
                  description: >
                    Non-Heap init used by the JVM in bytes.
                - name: memory.nonheap.max.bytes
                  type: long
                  format: bytes
                  description: >
                    Non-Heap max used by the JVM in bytes.
            - name: process.mlockall
              type: boolean
              description: >
                If process locked in memory.
        - name: node.stats
          type: group
          description: >
            node_stats
          release: ga
          fields:
            - name: indices
              type: group
              description: >
                Node indices stats
              fields:
                - name: docs.count
                  type: long
                  description: >
                    Total number of existing documents.
                - name: docs.deleted
                  type: long
                  description: >
                    Total number of deleted documents.
                - name: segments.count
                  type: long
                  description: >
                    Total number of segments.
                - name: segments.memory.bytes
                  type: long
                  format: bytes
                  description: >
                    Total size of segments in bytes.
                - name: store.size.bytes
                  type: long
                  description: >
                    Total size of the store in bytes.
            - name: jvm.mem.pools
              type: group
              description: >
                JVM memory pool stats
              fields:
                - name: old
                  type: group
                  description: >
                    Old memory pool stats.
                  fields:
                    - name: max.bytes
                      type: long
                      format: bytes
                      description:
                        Max bytes.
                    - name: peak.bytes
                      type: long
                      format: bytes
                      description:
                        Peak bytes.
                    - name: peak_max.bytes
                      type: long
                      format: bytes
                      description:
                        Peak max bytes.
                    - name: used.bytes
                      type: long
                      format: bytes
                      description:
                        Used bytes.
                - name: young
                  type: group
                  description: >
                    Young memory pool stats.
                  fields:
                    - name: max.bytes
                      type: long
                      format: bytes
                      description:
                        Max bytes.
                    - name: peak.bytes
                      type: long
                      format: bytes
                      description:
                        Peak bytes.
                    - name: peak_max.bytes
                      type: long
                      format: bytes
                      description:
                        Peak max bytes.
                    - name: used.bytes
                      type: long
                      format: bytes
                      description:
                        Used bytes.
                - name: survivor
                  type: group
                  description: >
                    Survivor memory pool stats.
                  fields:
                    - name: max.bytes
                      type: long
                      format: bytes
                      description:
                        Max bytes.
                    - name: peak.bytes
                      type: long
                      format: bytes
                      description:
                        Peak bytes.
                    - name: peak_max.bytes
                      type: long
                      format: bytes
                      description:
                        Peak max bytes.
                    - name: used.bytes
                      type: long
                      format: bytes
                      description:
                        Used bytes.
        
            - name: jvm.gc.collectors
              type: group
              description: >
                GC collector stats.
              fields:
                - name: old.collection
                  type: group
                  description: >
                    Old collection gc.
                  fields:
                    - name: count
                      type: long
                      description: >
                    - name: ms
                      type: long
                      description: >
                - name: young.collection
                  type: group
                  description: >
                    Young collection gc.
                  fields:
                    - name: count
                      type: long
                      description: >
                    - name: ms
                      type: long
                      description: >
        
            - name: fs.summary
              type: group
              description: >
                File system summary
              fields:
                - name: total.bytes
                  type: long
                  format: bytes
                  description: >
                - name: free.bytes
                  type: long
                  format: bytes
                  description: >
                - name: available.bytes
                  type: long
                  format: bytes
                  description: >
        - name: cluster.pending_task
          type: group
          description: >
            `cluster.pending_task` contains a pending task description.
          release: ga
          fields:
            - name: insert_order
              type: long
              description: >
                Insert order
            - name: priority
              type: long
              description: >
                Priority
            - name: source
              type: keyword
              description: >
                Source. For example: put-mapping
            - name: time_in_queue.ms
              type: long
              description: >
                Time in queue
        - name: shard
          type: group
          description: >
            shard fields
          release: ga
          fields:
            - name: primary
              type: boolean
              description: >
                True if this is the primary shard.
            - name: number
              type: long
              description: >
                The number of this shard.
            - name: state
              type: keyword
              description: >
                The state of this shard.
            - name: relocating_node.name
              type: keyword
              description: >
                The node the shard was relocated from.
- key: envoyproxy
  title: "Envoyproxy"
  description: >
    envoyproxy module
  release: ga
  settings: ["ssl", "http"]
  fields:
    - name: envoyproxy
      type: group
      description: >
      fields:
        - name: server
          type: group
          release: ga
          description: >
            Contains envoy proxy server stats
          fields:
            - name: cluster_manager
              type: group
              fields:
                - name: active_clusters 
                  type: integer
                  description: >
                    Number of currently active (warmed) clusters
                - name: cluster_added
                  type: integer
                  description: >
                    Total clusters added (either via static config or CDS)
                - name: cluster_modified
                  type: integer
                  description: >
                    Total clusters modified (via CDS)
                - name: cluster_removed
                  type: integer
                  description: >
                    Total clusters removed (via CDS)
                - name: warming_clusters
                  type: integer
                  description: >
                    Number of currently warming (not active) clusters
                - name: cluster_updated
                  type: integer
                  description: >
                    Total cluster updates
                - name: cluster_updated_via_merge
                  type: integer
                  description: >
                    Total cluster updates applied as merged updates
                - name: update_merge_cancelled
                  type: integer
                  description: >
                    Total merged updates that got cancelled and delivered early
                - name: update_out_of_merge_window
                  type: integer
                  description: >
                    Total updates which arrived out of a merge window
        
            - name: filesystem
              type: group
              fields:
                - name: flushed_by_timer
                  type: integer
                  description: >
                    Total number of times internal flush buffers are written to a file due to flush timeout
                - name: reopen_failed
                  type: integer
                  description: >
                    Total number of times a file was failed to be opened
                - name: write_buffered
                  type: integer
                  description: >
                    Total number of times file data is moved to Envoys internal flush buffer
                - name: write_completed
                  type: integer
                  description: >
                    Total number of times a file was written
                - name: write_total_buffered 
                  type: integer
                  description: >
                    Current total size of internal flush buffer in bytes
                - name: write_failed
                  type: integer
                  description: >
                    Total number of times an error occurred during a file write operation
        
            - name: runtime
              type: group
              fields:
                - name: load_error
                  type: integer
                  description: >
                    Total number of load attempts that resulted in an error in any layer
                - name: load_success
                  type: integer
                  description: >
                    Total number of load attempts that were successful at all layers
                - name: num_keys 
                  type: integer
                  description: >
                    Number of keys currently loaded
                - name: override_dir_exists
                  type: integer
                  description: >
                    Total number of loads that did use an override directory
                - name: override_dir_not_exists
                  type: integer
                  description: >
                    Total number of loads that did not use an override directory
                - name: admin_overrides_active
                  type: integer
                  description: >
                    1 if any admin overrides are active otherwise 0
                - name: deprecated_feature_use
                  type: integer
                  description: >
                    Total number of times deprecated features were used.
                - name: num_layers
                  type: integer
                  description: >
                    Number of layers currently active (without loading errors)
        
            - name: listener_manager
              type: group
              fields:
                - name: listener_added
                  type: integer
                  description: >
                    Total listeners added (either via static config or LDS)
                - name: listener_create_failure
                  type: integer
                  description: >
                    Total failed listener object additions to workers
                - name: listener_create_success
                  type: integer
                  description: >
                    Total listener objects successfully added to workers
                - name: listener_modified
                  type: integer
                  description: >
                    Total listeners modified (via LDS)
                - name: listener_removed
                  type: integer
                  description: >
                    Total listeners removed (via LDS)
                - name: total_listeners_active
                  type: integer
                  description: >
                    Number of currently active listeners
                - name: total_listeners_draining
                  type: integer
                  description: >
                    Number of currently draining listeners
                - name: total_listeners_warming
                  type: integer
                  description: >
                    Number of currently warming listeners
                - name: listener_stopped
                  type: integer
                  description: >
                    Total listeners stopped
        
            - name: stats
              type: group
              fields:
                - name: overflow
                  type: integer
                  description: >
                    Total number of times Envoy cannot allocate a statistic due to a shortage of shared memory
        
            - name: server
              type: group
              fields:      
                - name: days_until_first_cert_expiring
                  type: integer
                  description: >
                    Number of days until the next certificate being managed will expire
                - name: live
                  type: integer
                  description: >
                    1 if the server is not currently draining, 0 otherwise
                - name: memory_allocated
                  type: integer
                  description: >
                    Current amount of allocated memory in bytes
                - name: memory_heap_size
                  type: integer
                  description: >
                    Current reserved heap size in bytes
                - name: parent_connections
                  type: integer
                  description: >
                    Total connections of the old Envoy process on hot restart
                - name: total_connections
                  type: integer
                  description: >
                    Total connections of both new and old Envoy processes
                - name: uptime
                  type: integer
                  description: >
                    Current server uptime in seconds
                - name: version
                  type: integer
                  description: >
                    Integer represented version number based on SCM revision
                - name: watchdog_mega_miss
                  type: integer
                - name: watchdog_miss
                  type: integer
                - name: hot_restart_epoch
                  type: integer
                  description: >
                    Current hot restart epoch
                - name: concurrency
                  type: integer
                  description: >
                    Number of worker threads
                - name: debug_assertion_failures
                  type: integer
                - name: dynamic_unknown_fields
                  type: integer
                  description: >
                    Number of messages in dynamic configuration with unknown fields
                - name: state
                  type: integer
                  description: >
                    Current state of the Server
                - name: static_unknown_fields
                  type: integer
                  description: >
                    Number of messages in static configuration with unknown fields
                - name: stats_recent_lookups
                  type: integer
        
            - name: http2
              type: group
              fields:
                - name: header_overflow
                  type: integer
                  description: >
                    Total number of connections reset due to the headers being larger than Envoy::Http::Http2::ConnectionImpl::StreamImpl::MAX_HEADER_SIZE (63k)
                - name: headers_cb_no_stream
                  type: integer
                  description: >
                    Total number of errors where a header callback is called without an associated stream. This tracks an unexpected occurrence due to an as yet undiagnosed bug
                - name: rx_messaging_error
                  type: integer
                  description: >
                    Total number of invalid received frames that violated section 8 of the HTTP/2 spec. This will result in a tx_reset
                - name: rx_reset
                  type: integer
                  description: >
                    Total number of reset stream frames received by Envoy
                - name: too_many_header_frames
                  type: integer
                  description: >
                    Total number of times an HTTP2 connection is reset due to receiving too many headers frames. Envoy currently supports proxying at most one header frame for 100-Continue one non-100 response code header frame and one frame with trailers
                - name: trailers
                  type: integer
                  description: >
                    Total number of trailers seen on requests coming from downstream
                - name: tx_reset
                  type: integer
                  description: >
                    Total number of reset stream frames transmitted by Envoy
- key: etcd
  title: "Etcd"
  description: >
    etcd Module
  release: ga
  settings: ["ssl", "http"]
  fields:
    - name: etcd
      type: group
      description: >
        `etcd` contains statistics that were read from Etcd
      fields:
        - name: api_version
          type: keyword
          description: >
            Etcd API version for metrics retrieval


        - name: leader
          type: group
          description: >
            Contains etcd leader statistics.
          release: ga
          fields:
            - name: followers.counts
              type: group
              description: >
                The number of failed and successful Raft RPC requests.
              fields:
                - name: followers.counts.success
                  type: integer
                  description: successful Raft RPC requests
                - name: followers.counts.fail
                  type: integer
                  description: failed Raft RPC requests
        
        
            - name: followers.latency
              type: group
              description: >
                 latency to each peer in the cluster
              fields:
                - name: followers.latency.average
                  type: scaled_float
                - name: followers.latency.current
                  type: scaled_float
                - name: followers.latency.maximum
                  type: scaled_float
                - name: followers.latency.minimum
                  type: integer
                - name: follower.latency.standardDeviation
                  type: scaled_float
            - name: leader
              type: keyword
              description: ID of actual leader
        
        - name: server
          type: group
          description: >
            Server metrics from the Etcd V3 /metrics endpoint
          release: beta
          fields:
            - name: has_leader
              type: byte
              description: >
                Whether a leader exists in the cluster
        
            - name: leader_changes.count
              type: long
              description: >
                Number of leader changes seen at the cluster
        
            - name: proposals_committed.count
              type: long
              description: >
                Number of consensus proposals commited
        
            - name: proposals_pending.count
              type: long
              description: >
                Number of consensus proposals pending
        
            - name: proposals_failed.count
              type: long
              description: >
                Number of consensus proposals failed
        
            - name: grpc_started.count
              type: long
              description: >
                Number of sent gRPC requests
        
            - name: grpc_handled.count
              type: long
              description: >
                Number of received gRPC requests
        
        - name: disk
          type: group
          description: >
            Disk metrics from the Etcd V3 /metrics endpoint
          release: beta
          fields:
            - name: mvcc_db_total_size.bytes
              type: long
              format: bytes
              description: >
                Size of stored data at MVCC
        
            - name: wal_fsync_duration.ns.bucket.*
              type: object
              object_type: long
              description: >
                Latency for writing ahead logs to disk
        
            - name: wal_fsync_duration.ns.count
              type: long
              description: >
                Write ahead logs count
            
            - name: wal_fsync_duration.ns.sum
              type: long
              description: >
                Write ahead logs latency sum
        
            - name: backend_commit_duration.ns.bucket.*
              type: object
              object_type: long
              description: >
                Latency for writing backend changes to disk
        
            - name: backend_commit_duration.ns.count
              type: long
              description: >
                Backend commits count
            
            - name: backend_commit_duration.ns.sum
              type: long
              description: >
                Backend commits latency sum
        
        - name: memory
          type: group
          description: >
            Memory metrics from the Etcd V3 /metrics endpoint
          release: beta
          fields:
            - name: go_memstats_alloc.bytes
              type: long
              format: bytes
              description: >
                Memory allocated bytes as of MemStats Go
        
        - name: network
          type: group
          description: >
            Network metrics from the Etcd V3 /metrics endpoint
          release: beta
          fields:
            - name: client_grpc_sent.bytes
              type: long
              format: bytes
              description: >
                gRPC sent bytes total
        
            - name: client_grpc_received.bytes
              type: long
              format: bytes
              description: >
                gRPC received bytes total
        - name: self
          type: group
          description: >
            Contains etcd self statistics.
          release: ga
          fields:
            - name: id
              type: keyword
              description: >
               the unique identifier for the member
        
            - name: leaderinfo.leader
              type: keyword
              description: >
                id of the current leader member
            - name: leaderinfo.starttime
              type: keyword
              description: >
                the time when this node was started
            - name: leaderinfo.uptime
              type: keyword
              description: >
                amount of time the leader has been leader
        
            - name: name
              type: keyword
              description: >
                this member's name
        
            - name: recv.appendrequest.count
              type: integer
              description: >
                number of append requests this node has processed
            - name: recv.bandwidthrate
              type: scaled_float
              description: >
                number of bytes per second this node is receiving (follower only)
            - name: recv.pkgrate
              type: scaled_float
              description: >
                number of requests per second this node is receiving (follower only)
        
            - name: send.appendrequest.count
              type: integer
              description: >
                 number of requests that this node has sent
            - name: send.bandwidthrate
              type: scaled_float
              description: >
                number of bytes per second this node is sending (leader only). This value is undefined on single member clusters.
            - name: send.pkgrate
              type: scaled_float
              description: >
                number of requests per second this node is sending (leader only). This value is undefined on single member clusters.
        
            - name: starttime
              type: keyword
              description: >
                the time when this node was started
        
            - name: state
              type: keyword
              description: >
                either leader or follower
        - name: store
          type: group
          description: >
            The store statistics include information about the operations that this node has handled.
          release: ga
          fields:
            - name: gets.success
              type: integer
            - name: gets.fail
              type: integer
        
            - name: sets.success
              type: integer
            - name: sets.fail
              type: integer
        
            - name: delete.success
              type: integer
            - name: delete.fail
              type: integer
        
            - name: update.success
              type: integer
            - name: update.fail
              type: integer
        
            - name: create.success
              type: integer
            - name: create.fail
              type: integer
        
            - name: compareandswap.success
              type: integer
            - name: compareandswap.fail
              type: integer
        
            - name: compareanddelete.success
              type: integer
            - name: compareanddelete.fail
              type: integer
        
        
            - name: expire.count
              type: integer
        
            - name: watchers
              type: integer
- key: golang
  title: "Golang"
  description: >
    Golang module
  short_config: false
  release: ga
  settings: ["ssl", "http"]
  fields:
    - name: golang
      type: group
      description: >
      fields:
        - name: expvar
          type: group
          description: >
            expvar
          release: ga
          fields:
            - name: cmdline
              type: keyword
              description: >
                The cmdline of this Go program start with.
        - name: heap
          type: group
          description: >
            The Go program heap information exposed by expvar.
          release: ga
          fields:
            - name: cmdline
              type: keyword
              description: >
                The cmdline of this Go program start with.
        
            - name: gc
              type: group
              description: >
                Garbage collector summary.
              fields:
                - name: total_pause
                  type: group
                  description: >
                     Total GC pause duration over lifetime of process.
                  fields:
                    - name: ns
                      type: long
                      description: >
                        Duration in Ns.
                - name: total_count
                  type: long
                  description: >
                     Total number of GC was happened.
                - name: next_gc_limit
                  type: long
                  format: bytes
                  description: >
                     Next collection will happen when HeapAlloc > this amount.
                - name: cpu_fraction
                  type: float
                  description: >
                     Fraction of CPU time used by GC.
                - name: pause
                  type: group
                  description: >
                     Last GC pause durations during the monitoring period.
                  fields:
                    - name: count
                      type: long
                      description: >
                         Count of GC pause duration during this collect period.
                    - name: sum
                      type: group
                      description: >
                         Total GC pause duration during this collect period.
                      fields:
                        - name: ns
                          type: long
                          description: >
                            Duration in Ns.
                    - name: max
                      type: group
                      description: >
                         Max GC pause duration during this collect period.
                      fields:
                        - name: ns
                          type: long
                          description: >
                             Duration in Ns.
                    - name: avg
                      type: group
                      description: >
                         Average GC pause duration during this collect period.
                      fields:
                        - name: ns
                          type: long
                          description: >
                             Duration in Ns.
        
            - name: system
              type: group
              description: >
                Heap summary,which bytes was obtained from system.
              fields:
                - name: total
                  type: long
                  format: bytes
                  description: >
                    Total bytes obtained from system (sum of XxxSys below).
                - name: obtained
                  type: long
                  format: bytes
                  description: >
                    Via HeapSys, bytes obtained from system. heap_sys = heap_idle + heap_inuse.
                - name: stack
                  type: long
                  format: bytes
                  description: >
                    Bytes used by stack allocator, and these bytes was obtained from system.
                - name: released
                  type: long
                  format: bytes
                  description: >
                    Bytes released to the OS.
        
            - name: allocations
              type: group
              description: >
                Heap allocations summary.
              fields:
                - name: mallocs
                  type: long
                  description: >
                    Number of mallocs.
                - name: frees
                  type: long
                  description: >
                    Number of frees.
                - name: objects
                  type: long
                  description: >
                    Total number of allocated objects.
                - name: total
                  type: long
                  format: bytes
                  description: >
                    Bytes allocated (even if freed) throughout the lifetime.
                - name: allocated
                  type: long
                  format: bytes
                  description: >
                    Bytes allocated and not yet freed (same as Alloc above).
                - name: idle
                  type: long
                  format: bytes
                  description: >
                    Bytes in idle spans.
                - name: active
                  type: long
                  format: bytes
                  description: >
                    Bytes in non-idle span.
- key: graphite
  title: "Graphite"
  description: >
    graphite Module
  release: ga
  fields:
    - name: graphite
      type: group
      description: >
      fields:
        - name: server
          type: group
          description: >
            server
          release: ga
          fields:
            - name: example
              type: keyword
              description: >
                Example field
- key: haproxy
  title: "HAProxy"
  description: >
    HAProxy Module
  short_config: false
  release: ga
  settings: ["ssl", "http"]
  fields:
    - name: haproxy
      type: group
      description: >
        HAProxy metrics.
      fields:
        - name: info
          type: group
          description: >
            General information about HAProxy processes.
          release: ga
          fields:
            - name: processes
              type: long
              description: >
                Number of processes.
        
            - name: process_num
              type: long
              description: >
                Process number.
        
            - name: threads
              type: long
              description: >
                Number of threads.
        
            - name: pid
              type: alias
              path: process.pid
              migration: true
              description: >
                Process ID.
        
            - name: run_queue
              type: long
              description: >
        
            - name: stopping
              type: long
              description: >
                Number of stopping jobs.
        
            - name: jobs
              type: long
              description: >
                Number of all jobs.
        
            - name: unstoppable_jobs
              type: long
              description: >
                Number of unstoppable jobs.
        
            - name: listeners
              type: long
              description: >
                Number of listeners.
        
            - name: dropped_logs
              type: long
              description: >
                Number of dropped logs.
        
            - name: busy_polling
              type: long
              description: >
                Number of busy polling.
        
            - name: failed_resolutions
              type: long
              description: >
                Number of failed resolutions.
        
            - name: tasks
              type: long
              description: >
        
            - name: uptime.sec
              type: long
              description: >
                Current uptime in seconds.
        
            - name: memory.max.bytes
              type: long
              format: bytes
              description: >
                Maximum amount of memory usage in bytes (the 'Memmax_MB' value converted to bytes).
        
        
            - name: bytes
              type: group
              fields:
        
                - name: out
                  type: group
                  fields:
        
                    - name: total
                      type: long
                      description: >
                        Number of bytes sent out.
        
                    - name: rate
                      type: long
                      description: >
                        Average bytes output rate.
        
        
            - name: peers
              type: group
              fields:
        
                - name: active
                  type: long
                  description: >
                    Number of active peers.
        
                - name: connected
                  type: long
                  description: >
                    Number of connected peers.
        
        
            - name: pool
              type: group
              fields:
        
                - name: allocated
                  type: long
                  description: >
                    Size of the allocated pool.
        
                - name: used
                  type: long
                  description: >
                    Number of members used from the allocated pool.
        
                - name: failed
                  type: long
                  description: >
                    Number of failed connections to pool members.
        
        
            - name: ulimit_n
              type: long
              description: >
                Maximum number of open files for the process.
        
            - name: compress
              type: group
              description: >
        
              fields:
                - name: bps
                  type: group
                  description: >
        
                  fields:
                    - name: in
                      type: long
                      description: >
        
                    - name: out
                      type: long
                      description: >
        
                    - name: rate_limit
                      type: long
                      description: >
        
            - name: connection
              type: group
              description: >
        
              fields:
                - name: rate
                  type: group
                  description: >
        
                  fields:
                    - name: value
                      type: long
                      description: >
        
                    - name: limit
                      type: long
                      description: >
        
                    - name: max
                      type: long
                      description: >
        
                - name: current
                  type: long
                  description: >
                    Current connections.
        
                - name: total
                  type: long
                  description: >
                    Total connections.
        
                - name: ssl.current
                  type: long
                  description: >
                    Current SSL connections.
        
                - name: ssl.total
                  type: long
                  description: >
                    Total SSL connections.
        
                - name: ssl.max
                  type: long
                  description: >
                    Maximum SSL connections.
        
                - name: max
                  type: long
                  description: >
                    Maximum connections.
        
                - name: hard_max
                  type: long
                  description: >
        
            - name: requests.total
              type: long
              description: >
        
            - name: sockets.max
              type: long
              description: >
        
            - name: requests.max
              type: long
              description: >
        
            - name: pipes
              type: group
              description: >
              fields:
                - name: used
                  type: integer
                  description: >
        
                - name: free
                  type: integer
                  description: >
        
                - name: max
                  type: integer
                  description: >
        
            - name: session
              type: group
              description:
              fields:
                - name: rate.value
                  type: integer
                  description: >
        
                - name: rate.limit
                  type: integer
                  description: >
        
                - name: rate.max
                  type: integer
                  description: >
        
        
            - name: ssl
              type: group
              description:
              fields:
                - name: rate.value
                  type: integer
                  description:
        
                - name: rate.limit
                  type: integer
                  description:
        
                - name: rate.max
                  type: integer
                  description:
        
                - name: frontend
                  type: group
                  description:
                  fields:
                    - name: key_rate.value
                      type: integer
                      description:
        
                    - name: key_rate.max
                      type: integer
                      description:
        
                    - name: session_reuse.pct
                      type: scaled_float
                      format: percent
                      description:
        
                - name: backend
                  type: group
                  description:
                  fields:
                    - name: key_rate.value
                      type: integer
                      description:
        
                    - name: key_rate.max
                      type: integer
                      description: MaxConnRate
                - name: cached_lookups
                  type: long
                  description:
                - name: cache_misses
                  type: long
                  description:
        
        
            - name: zlib_mem_usage
              type: group
              description: >
        
              fields:
                - name: value
                  type: integer
                  description: >
        
                - name: max
                  type: integer
                  description: >
        
            - name: idle.pct
              type: scaled_float
              format: percent
              description: >
        - name: stat
          type: group
          description: >
            Stats collected from HAProxy processes.
          release: ga
          fields:
        
            - name: status
              type: keyword
              description: >
                Status (UP, DOWN, NOLB, MAINT, or MAINT(via)...).
        
            - name: weight
              type: long
              description: >
                Total weight (for backends), or server weight (for servers).
        
            - name: downtime
              type: long
              description: >
                Total downtime (in seconds). For backends, this value is the downtime
                for the whole backend, not the sum of the downtime for the servers.
        
            - name: component_type
              type: integer
              description: >
                Component type (0=frontend, 1=backend, 2=server, or 3=socket/listener).
        
            - name: process_id
              type: alias
              path: process.pid
              migration: true
              description: >
                Process ID (0 for first instance, 1 for second, and so on).
        
            - name: service_name
              type: keyword
              description: >
                Service name (FRONTEND for frontend, BACKEND for backend, or any name for server/listener).
        
            - name: in.bytes
              type: long
              format: bytes
              description: >
                Bytes in.
        
            - name: out.bytes
              type: long
              format: bytes
              description: >
                Bytes out.
        
            - name: last_change
              type: integer
              description: >
                Number of seconds since the last UP->DOWN or DOWN->UP transition.
        
            - name: throttle.pct
              type: scaled_float
              format: percent
              description: >
                Current throttle percentage for the server when slowstart
                is active, or no value if slowstart is inactive.
        
            - name: selected.total
              type: long
              description: >
                Total number of times a server was selected, either for new
                sessions, or when re-dispatching. For servers, this field reports the
                the number of times the server was selected.
        
            - name: tracked.id
              type: long
              description: >
                ID of the proxy/server if tracking is enabled.
        
            - name: cookie
              type: keyword
              description: >
                Cookie value of the server or the name of the cookie of the backend.
        
            - name: load_balancing_algorithm
              type: keyword
              description: >
                Load balancing algorithm.
        
            - name: connection
              type: group
              fields:
        
                - name: total
                  type: long
                  description: >
                    Cumulative number of connections.
        
                - name: retried
                  type: long
                  description: >
                    Number of times a connection to a server was retried.
        
                - name: time.avg
                  type: long
                  description: >
                    Average connect time in ms over the last 1024 requests.
        
                - name: rate
                  type: long
                  description: >
                    Number of connections over the last second.
        
                - name: rate_max
                  type: long
                  description: >
                    Highest value of connection.rate.
        
                - name: attempt.total
                  type: long
                  description: >
                    Number of connection establishment attempts.
        
                - name: reuse.total
                  type: long
                  description: >
                    Number of connection reuses.
        
                - name: idle
                  type: group
                  fields:
        
                    - name: total
                      type: long
                      description: >
                        Number of idle connections available for reuse.
        
                    - name: limit
                      type: long
                      description: >
                        Limit on idle connections available for reuse.
        
                - name: cache
                  type: group
                  fields:
        
                    - name: lookup.total
                      type: long
                      description: >
                        Number of cache lookups.
        
                    - name: hits
                      type: long
                      description: >
                        Number of cache hits.
        
            - name: request
              type: group
              fields:
        
                - name: denied
                  type: long
                  description: >
                    Requests denied because of security concerns.
        
                      * For TCP this is because of a matched tcp-request content rule.
                      * For HTTP this is because of a matched http-request or tarpit rule.
        
                - name: denied_by_connection_rules
                  type: long
                  description: >
                    Requests denied because of TCP request connection rules.
        
                - name: denied_by_session_rules
                  type: long
                  description: >
                    Requests denied because of TCP request session rules.
        
                - name: queued.current
                  type: long
                  description: >
                    Current queued requests. For backends, this field reports the number
                    of requests queued without a server assigned.
        
                - name: queued.max
                  type: long
                  description: >
                    Maximum value of queued.current.
        
                - name: errors
                  type: long
                  description: >
                    Request errors. Some of the possible causes are:
        
                      * early termination from the client, before the request has been sent
                      * read error from the client
                      * client timeout
                      * client closed connection
                      * various bad requests from the client.
                      * request was tarpitted.
        
                - name: redispatched
                  type: long
                  description: >
                    Number of times a request was redispatched to another server. For
                    servers, this field reports the number of times the server was
                    switched away from.
        
                - name: connection.errors
                  type: long
                  description: >
                    Number of requests that encountered an error trying to
                    connect to a server. For backends, this field reports the sum of
                    the stat for all backend servers, plus any connection errors not
                    associated with a particular server (such as the backend having no
                    active servers).
        
                - name: rate
                  type: group
                  description: >
                  fields:
                    - name: value
                      type: long
                      description: >
                        Number of HTTP requests per second over the last elapsed second.
                    - name: max
                      type: long
                      description: >
                        Maximum number of HTTP requests per second.
        
                - name: total
                  type: long
                  description: >
                    Total number of HTTP requests received.
        
                - name: intercepted
                  type: long
                  description: >
                    Number of intercepted requests.
        
        
            - name: response
              type: group
              fields:
        
                - name: errors
                  type: long
                  description: >
                    Number of response errors. This value includes the number of data
                    transfers aborted by the server (haproxy.stat.server.aborted).
                    Some other errors are:
        
                    * write errors on the client socket (won't be counted for the server stat)
                    * failure applying filters to the response
        
        
                - name: time.avg
                  type: long
                  description: >
                    Average response time in ms over the last 1024 requests (0 for TCP).
        
                - name: denied
                  type: integer
                  description: >
                    Responses denied because of security concerns. For HTTP this is
                    because of a matched http-request rule, or "option checkcache".
        
                - name: http
                  type: group
                  description: >
        
                  fields:
                    - name: 1xx
                      type: long
                      description: >
                        HTTP responses with 1xx code.
        
                    - name: 2xx
                      type: long
                      description: >
                        HTTP responses with 2xx code.
        
                    - name: 3xx
                      type: long
                      description: >
                        HTTP responses with 3xx code.
        
                    - name: 4xx
                      type: long
                      description: >
                        HTTP responses with 4xx code.
        
                    - name: 5xx
                      type: long
                      description: >
                        HTTP responses with 5xx code.
        
                    - name: other
                      type: long
                      description: >
                        HTTP responses with other codes (protocol error).
        
        
            - name: header
              type: group
              fields:
        
                - name: rewrite
                  type: group
                  fields:
        
                    - name: failed
                      type: group
                      fields:
        
                        - name: total
                          type: long
                          description: >
                            Number of failed header rewrite warnings.
        
        
            - name: session
              type: group
              fields:
        
                - name: current
                  type: long
                  description: >
                    Number of current sessions.
        
                - name: max
                  type: long
                  description: >
                    Maximum number of sessions.
        
                - name: limit
                  type: long
                  description: >
                    Configured session limit.
        
                - name: total
                  type: long
                  description: >
                    Number of all sessions.
        
                - name: rate
                  type: group
                  fields:
                    - name: value
                      type: integer
                      description: >
                        Number of sessions per second over the last elapsed second.
        
                    - name: limit
                      type: integer
                      description: >
                        Configured limit on new sessions per second.
        
                    - name: max
                      type: integer
                      description: >
                        Maximum number of new sessions per second.
        
        
            - name: check
              type: group
              description: >
        
              fields:
                - name: status
                  type: keyword
                  description: >
                    Status of the last health check. One of:
        
                      UNK     -> unknown
                      INI     -> initializing
                      SOCKERR -> socket error
                      L4OK    -> check passed on layer 4, no upper layers testing enabled
                      L4TOUT  -> layer 1-4 timeout
                      L4CON   -> layer 1-4 connection problem, for example
                                "Connection refused" (tcp rst) or "No route to host" (icmp)
                      L6OK    -> check passed on layer 6
                      L6TOUT  -> layer 6 (SSL) timeout
                      L6RSP   -> layer 6 invalid response - protocol error
                      L7OK    -> check passed on layer 7
                      L7OKC   -> check conditionally passed on layer 7, for example 404 with
                                disable-on-404
                      L7TOUT  -> layer 7 (HTTP/SMTP) timeout
                      L7RSP   -> layer 7 invalid response - protocol error
                      L7STS   -> layer 7 response error, for example HTTP 5xx
        
                - name: code
                  type: long
                  description: >
                    Layer 5-7 code, if available.
        
                - name: duration
                  type: long
                  description: >
                    Time in ms that it took to finish the last health check.
        
                - name: health.last
                  type: keyword
                  description: >
                    The result of the last health check.
        
                - name: health.fail
                  type: long
                  description: >
                    Number of failed checks.
        
                - name: agent.last
                  type: integer
                  description: >
        
                - name: failed
                  type: long
                  description: >
                    Number of checks that failed while the server was up.
        
                - name: down
                  type: long
                  description: >
                    Number of UP->DOWN transitions. For backends, this value is the
                    number of transitions to the whole backend being down, rather than
                    the sum of the transitions for each server.
        
            - name: client.aborted
              type: integer
              description: >
                Number of data transfers aborted by the client.
        
        
            - name: server
              type: group
              description: >
              fields:
        
                - name: id
                  type: integer
                  description: >
                    Server ID (unique inside a proxy).
        
                - name: aborted
                  type: integer
                  description: >
                    Number of data transfers aborted by the server. This value is
                    included in haproxy.stat.response.errors.
        
                - name: active
                  type: integer
                  description: >
                    Number of backend servers that are active, meaning that they are
                    healthy and can receive requests from the load balancer.
        
                - name: backup
                  type: integer
                  description: >
                    Number of backend servers that are backup servers.
        
        
            - name: compressor
              type: group
              description: >
        
              fields:
                - name: in.bytes
                  type: long
                  format: bytes
                  description: >
                    Number of HTTP response bytes fed to the compressor.
        
                - name: out.bytes
                  type: integer
                  format: bytes
                  description: >
                    Number of HTTP response bytes emitted by the compressor.
        
                - name: bypassed.bytes
                  type: long
                  format: bytes
                  description: >
                    Number of bytes that bypassed the HTTP compressor (CPU/BW limit).
        
                - name: response.bytes
                  type: long
                  format: bytes
                  description: >
                    Number of HTTP responses that were compressed.
        
            - name: proxy
              type: group
              description: >
        
              fields:
                - name: id
                  type: integer
                  description: >
                    Unique proxy ID.
        
                - name: name
                  type: keyword
                  description: >
                    Proxy name.
        
                - name: mode
                  type: keyword
                  description: >
                    Proxy mode (tcp, http, health, unknown).
        
        
            - name: queue
              type: group
              description: >
        
              fields:
                - name: limit
                  type: integer
                  description: >
                    Configured queue limit (maxqueue) for the server, or nothing if the
                    value of maxqueue is 0 (meaning no limit).
        
                - name: time.avg
                  type: integer
                  description: >
                    The average queue time in ms over the last 1024 requests.
        
        
            - name: agent
              type: group
              description: >
        
              fields:
                - name: status
                  type: keyword
                  description: >
                    Status of the last health check. One of:
        
                      UNK     -> unknown
                      INI     -> initializing
                      SOCKERR -> socket error
                      L4OK    -> check passed on layer 4, no upper layers enabled
                      L4TOUT  -> layer 1-4 timeout
                      L4CON   -> layer 1-4 connection problem, for example
                                "Connection refused" (tcp rst) or "No route to host" (icmp)
                      L7OK    -> agent reported "up"
                      L7STS   -> agent reported "fail", "stop" or "down"
        
                - name: description
                  type: keyword
                  description: >
                    Human readable version of agent.status.
        
                - name: code
                  type: integer
                  description: >
                    Value reported by agent.
        
                - name: rise
                  type: integer
                  description: >
                    Rise value of agent.
        
                - name: fall
                  type: integer
                  description: >
                    Fall value of agent.
        
                - name: health
                  type: integer
                  description: >
                    Health parameter of agent. Between 0 and `agent.rise`+`agent.fall`-1.
        
                - name: duration
                  type: integer
                  description: >
                    Duration of the last check in ms.
        
                - name: check
                  type: group
                  fields:
        
                    - name: rise
                      type: integer
                      description: >
                        Rise value of server.
        
                    - name: fall
                      type: integer
                      description: >
                        Fall value of server.
        
                    - name: health
                      type: integer
                      description: >
                        Health parameter of server. Between 0 and `agent.check.rise`+`agent.check.fall`-1.
        
                    - name: description
                      type: keyword
                      description: >
                        Human readable version of check.
        
        
            - name: source
              type: group
              fields:
        
                - name: address
                  type: text
                  description: >
                    Address of the source.
        
        
        
- key: http
  title: "HTTP"
  description: >
    HTTP module
  release: ga
  settings: ["ssl", "http"]
  fields:
    - name: http
      type: group
      description: >
      fields:
        - name: request
          type: group
          description: >
              HTTP request information
          fields:
            - name: headers
              type: object
              description: >
                The HTTP headers sent
        - name: response
          type: group
          description: >
              HTTP response information
          fields:
            - name: headers
              type: object
              description: >
                The HTTP headers received
            - name: code
              type: keyword
              description: >
                The HTTP status code
              example: 404
            - name: phrase
              type: keyword
              example: Not found
              description: >
                The HTTP status phrase
        - name: json
          type: group
          description: >
            json metricset
          release: ga
          fields:
        - name: server
          type: group
          description: >
            server
          release: ga
          fields:
- key: jolokia
  title: "Jolokia"
  description: >
    Jolokia module
  short_config: false
  release: ga
  settings: ["ssl", "http"]
  fields:
    - name: jolokia
      type: group
      description: >
          jolokia contains metrics exposed via jolokia agent
      fields:
        - key: jmx
          type: group
          description: >
            Jolokia jmx metricset
          release: ga
          fields:
- key: kafka
  title: "Kafka"
  description: >
    Kafka module
  short_config: false
  release: ga
  fields:
    - name: kafka
      type: group
      description: >
      fields:
        - name: broker
          type: group
          description: >
            Broker Consumer Group Information have been read from (Broker handling
            the consumer group).
          fields:
            - name: id
              type: long
              description: >
                Broker id

            - name: address
              type: keyword
              description: >
                Broker advertised address

        - name: topic.name
          type: keyword
          description: >
            Topic name

        - name: topic.error.code
          type: long
          description: >
            Topic error code.

        - name: partition.id
          type: long
          description: >
            Partition id.

        - name: partition.topic_id
          type: keyword
          description:
            Unique id of the partition in the topic.

        - name: partition.topic_broker_id
          type: keyword
          description:
            Unique id of the partition in the topic and the broker.
        - name: broker
          type: group
          description: Broker metrics from Kafka Broker JMX
          release: beta
          fields:
            - name: mbean
              description: Mbean that this event is related to
              type: keyword
            - name: request.channel.queue.size
              description: The size of the request queue
              type: long
            - name: request.produce.failed_per_second
              description: The rate of failed produce requests per second
              type: float
            - name: request.fetch.failed_per_second
              description: The rate of client fetch request failures per second
              type: float
            - name: request.produce.failed
              description: The number of failed produce requests
              type: float
            - name: request.fetch.failed
              description: The number of client fetch request failures
              type: float
            - name: replication.leader_elections
              description: The leader election rate
              type: float
            - name: replication.unclean_leader_elections
              description: The unclean leader election rate
              type: float
            - name: session.zookeeper.disconnect
              description: The ZooKeeper closed sessions per second
              type: float
            - name: session.zookeeper.expire
              description: The ZooKeeper expired sessions per second
              type: float
            - name: session.zookeeper.readonly
              description: The ZooKeeper readonly sessions per second
              type: float
            - name: session.zookeeper.sync
              description: The ZooKeeper client connections per second
              type: float
            - name: log.flush_rate
              description: The log flush rate
              type: float
            - name: topic.net.in.bytes_per_sec
              description: The incoming byte rate per topic
              type: float
            - name: topic.net.out.bytes_per_sec
              description: The outgoing byte rate per topic
              type: float
            - name: topic.net.rejected.bytes_per_sec
              description: The rejected byte rate per topic
              type: float
            - name: topic.messages_in
              description: The incoming message rate per topic
              type: float
            - name: net.in.bytes_per_sec
              description: The incoming byte rate
              type: float
            - name: net.out.bytes_per_sec
              description: The outgoing byte rate
              type: float
            - name: net.rejected.bytes_per_sec
              description: The rejected byte rate
              type: float
            - name: messages_in
              description: The incoming message rate
              type: float
        - name: consumer
          type: group
          description: Consumer metrics from Kafka Consumer JMX
          release: beta
          fields:
            - name: mbean
              description: Mbean that this event is related to
              type: keyword
            - name: fetch_rate
              description: The minimum rate at which the consumer sends fetch requests to a broker
              type: float
            - name: bytes_consumed
              description: The average number of bytes consumed for a specific topic per second
              type: float
            - name: records_consumed
              description: The average number of records consumed per second for a specific topic
              type: float
            - name: in.bytes_per_sec
              description: The rate of bytes coming in to the consumer
              type: float
            - name: max_lag
              description: The maximum consumer lag
              type: float
            - name: zookeeper_commits
              description: The rate of offset commits to ZooKeeper
              type: float
            - name: kafka_commits
              description: The rate of offset commits to Kafka
              type: float
            - name: messages_in
              description: The rate of consumer message consumption
              type: float
        - name: consumergroup
          type: group
          description: >
            consumergroup
          release: ga
          fields:
            - name: broker
              type: group
              deprecated: 6.5
              description: >
                Broker Consumer Group Information have been read from (Broker handling
                the consumer group).
              fields:
                - name: id
                  type: long
                  description: >
                    Broker id
        
                - name: address
                  type: keyword
                  description: >
                    Broker address
        
            - name: id
              type: keyword
              description: Consumer Group ID
        
            - name: topic
              type: keyword
              deprecated: 6.5
              description: Topic name
        
            - name: partition
              type: long
              deprecated: 6.5
              description: Partition ID
        
            - name: offset
              type: long
              description: consumer offset into partition being read
        
            - name: meta
              type: keyword
              description: custom consumer meta data string
        
            - name: consumer_lag
              type: long
              description: consumer lag for partition/topic calculated as the difference between the partition offset and consumer offset
        
            - name: error.code
              type: long
              description: >
                kafka consumer/partition error code.
        
            - name: client
              type: group
              description: >
                Assigned client reading events from partition
              fields:
                - name: id
                  type: keyword
                  description: Client ID (kafka setting client.id)
        
                - name: host
                  type: keyword
                  description: Client host
        
                - name: member_id
                  type: keyword
                  description: internal consumer group member ID
        - name: partition
          type: group
          description: >
            partition
          release: ga
          fields:
            - name: offset
              type: group
              description: >
                Available offsets of the given partition.
              fields:
                - name: newest
                  type: long
                  description: >
                    Newest offset of the partition.
                - name: oldest
                  type: long
                  description: >
                    Oldest offset of the partition.
        
            - name: partition
              type: group
              description: >
                Partition data.
              fields:
                - name: id
                  type: long
                  deprecated: 6.5
                  description: >
                    Partition id.
        
                - name: leader
                  type: long
                  description: >
                    Leader id (broker).
                - name: replica
                  type: long
                  description: >
                    Replica id (broker).
        
                - name: insync_replica
                  type: boolean
                  description: >
                    Indicates if replica is included in the in-sync replicate set (ISR).
        
                - name: is_leader
                  type: boolean
                  description: >
                    Indicates if replica is the leader
        
                - name: error.code
                  type: long
                  description: >
                    Error code from fetching partition.
        
            - name: topic.error.code
              type: long
              deprecated: 6.5
              description: >
                topic error code.
            - name: topic.name
              type: keyword
              deprecated: 6.5
              description: >
                Topic name
        
            - name: broker.id
              type: long
              deprecated: 6.5
              description: >
                Broker id
            - name: broker.address
              type: keyword
              deprecated: 6.5
              description: >
                Broker address
        
        
        - name: producer
          type: group
          description: Producer metrics from Kafka Producer JMX
          release: beta
          fields:
            - name: mbean
              description: Mbean that this event is related to
              type: keyword
            - name: available_buffer_bytes
              description: The total amount of buffer memory
              type: float
            - name: batch_size_avg
              description: The average number of bytes sent
              type: float
            - name: batch_size_max
              description: The maximum number of bytes sent
              type: long
            - name: record_send_rate
              description: The average number of records sent per second
              type: float
            - name: record_retry_rate
              description: The average number of retried record sends per second
              type: float
            - name: record_error_rate
              description: The average number of retried record sends per second
              type: float
            - name: records_per_request
              description: The average number of records sent per second
              type: float
            - name: record_size_avg
              description: The average record size
              type: float
            - name: record_size_max
              description: The maximum record size
              type: long
            - name: request_rate
              description: The number of producer requests per second
              type: float
            - name: response_rate
              description: The number of producer responses per second
              type: float
            - name: io_wait
              description: The producer I/O wait time
              type: float
            - name: out.bytes_per_sec
              description: The rate of bytes going out for the producer
              type: float
            - name: message_rate
              description: The producer message rate
              type: float
- key: kibana
  title: "Kibana"
  description: >
    Kibana module
  short_config: false
  release: ga
  settings: ["ssl", "http"]
  fields:
    - name: kibana
      type: group
      description: >
      fields:
        - name: stats
          type: group
          description: >
            Kibana stats and run-time metrics.
          release: ga
          fields:
            - name: uuid
              type: alias
              path: service.id
              migration: true
              description: >
                Kibana instance UUID
            - name: name
              type: keyword
              description: >
                Kibana instance name
            - name: index
              type: keyword
              description: >
                Name of Kibana's internal index
            - name: host.name
              type: keyword
              description: >
                Kibana instance hostname
            - name: transport_address
              type: alias
              path: service.address
              migration: true
              description: >
                Kibana server's hostname and port
            - name: version
              type: alias
              description: >
                Kibana version
              path: service.version
              migration: true
            - name: snapshot
              type: boolean
              description: >
                Whether the Kibana build is a snapshot build
            - name: status
              type: keyword
              description: >
                Kibana instance's health status
            - name: concurrent_connections
              type: long
              description: >
                Number of client connections made to the server. Note that browsers can send multiple simultaneous connections to request multiple server assets at once, and they can re-use established connections.
            - name: process
              type: group
              description: >
                Process metrics
              fields:
              - name: event_loop_delay.ms
                type: scaled_float
                description: >
                  Event loop delay in milliseconds
              - name: memory.heap
                type: group
                description: >
                  Process heap metrics
                fields:
                - name: total.bytes
                  type: long
                  format: bytes
                  description: >
                    Total heap allocated to process in bytes
                - name: used.bytes
                  type: long
                  format: bytes
                  description: >
                    Heap used by process in bytes
                - name: size_limit.bytes
                  type: long
                  format: bytes
                  description: >
                    Max. old space size allocated to Node.js process, in bytes
                - name: uptime.ms
                  type: long
                  description: >
                    Uptime of process in milliseconds
            - name: request
              type: group
              description: >
                  Request count metrics
              fields:
                - name: disconnects
                  type: long
                  description: >
                    Number of requests that were disconnected
                - name: total
                  type: long
                  description: >
                    Total number of requests
            - name: response_time
              type: group
              description: >
                Response times metrics
              fields:
                - name: avg.ms
                  type: long
                  description: >
                    Average response time in milliseconds
                - name: max.ms
                  type: long
                  description: >
                    Maximum response time in milliseconds
        - name: status
          type: group
          description: >
            Status fields
          release: ga
          fields:
            - name: name
              type: keyword
              description: >
                Kibana instance name.
            - name: uuid
              type: alias
              path: service.id
              migration: true
              description: >
                Kibana instance uuid.
            - name: version.number
              type: alias
              description: >
                Kibana version number.
              path: service.version
              migration: true
            - name: status.overall.state
              type: keyword
              description: >
                Kibana overall state.
            - name: metrics
              type: group
              description: >
                Metrics fields
              fields:
                - name: concurrent_connections
                  type: long
                  description: >
                    Current concurrent connections.
                - name: requests
                  type: group
                  description: >
                    Request statistics.
                  fields:
                    - name: disconnects
                      type: long
                      description: >
                        Total number of disconnected connections.
                    - name: total
                      type: long
                      description: >
                        Total number of connections.
- key: kubernetes
  title: "Kubernetes"
  description: >
    Kubernetes metrics
  release: ga
  settings: ["ssl", "http"]
  short_config: false
  fields:
    - name: kubernetes
      type: group
      description: >
        Information and statistics of pods managed by kubernetes.
      fields:
        - name: apiserver
          type: group
          description: >
            Kubernetes API server metrics
          release: ga
          fields:
            - name: request.client
              type: keyword
              description: >
                Client executing requests
            - name: request.resource
              type: keyword
              description: >
                Requested resource
            - name: request.subresource
              type: keyword
              description: >
                Requested subresource
            - name: request.scope
              type: keyword
              description: >
                Request scope (cluster, namespace, resource)
            - name: request.verb
              type: keyword
              description: >
                HTTP verb
            - name: request.code
              type: keyword
              description: >
                HTTP code
            - name: request.content_type
              type: keyword
              description: >
                Request HTTP content type
            - name: request.dry_run
              type: keyword
              description: >
                Wether the request uses dry run
            - name: request.kind
              type: keyword
              description: >
                Kind of request
            - name: request.component
              type: keyword
              description: >
                Component handling the request
            - name: request.group
              type: keyword
              description: >
                API group for the resource
            - name: request.version
              type: keyword
              description: >
                version for the group
            - name: request.handler
              type: keyword
              description: >
                Request handler
            - name: request.method
              type: keyword
              description: >
                HTTP method
            - name: request.host
              type: keyword
              description: >
                Request host
            - name: process
              type: group
              fields:
                - name: cpu.sec
                  type: double
                  description: CPU seconds
                - name: memory.resident.bytes
                  type: long
                  format: bytes
                  description: Bytes in resident memory
                - name: memory.virtual.bytes
                  type: long
                  format: bytes
                  description: Bytes in virtual memory
                - name: fds.open.count
                  type: long
                  description: Number of open file descriptors
                - name: started.sec
                  type: double
                  description: Seconds since the process started
            - name: http
              type: group
              fields:
                - name: request.duration.us.percentile.*
                  type: object
                  object_type: double
                  description: Request duration microseconds percentiles
                - name: request.duration.us.sum
                  type: double
                  description: Request duration microseconds cumulative sum
                - name: request.duration.us.count
                  type: long
                  description: Request count for duration
                - name: request.size.bytes.percentile.*
                  type: object
                  object_type: long
                  description: Request size percentiles
                - name: request.size.bytes.sum
                  type: long
                  format: bytes
                  description: Request size cumulative sum
                - name: request.size.bytes.count
                  type: long
                  description: Request count for size
                - name: response.size.bytes.percentile.*
                  type: object
                  object_type: long
                  description: Response size percentiles
                - name: response.size.bytes.sum
                  type: long
                  format: bytes
                  description: Response size cumulative sum
                - name: response.size.bytes.count
                  type: long
                  description: Response count
                - name: request.count
                  type: long
                  description: Request count for response
            - name: client.request.count
              type: long
              description: Number of requests as client
            - name: request
              type: group
              fields:
                - name: count
                  type: long
                  description: Number of requests
                - name: latency.sum
                  type: long
                  description: Requests latency, sum of latencies in microseconds
                - name: latency.count
                  type: long
                  description: Request latency, number of requests
                - name: latency.bucket.*
                  type: object
                  object_type: long
                  description: Request latency histogram buckets
                - name: duration.us.sum
                  type: long
                  description: Request duration, sum in microseconds
                - name: duration.us.count
                  type: long
                  description: Request duration, number of operations
                - name: duration.us.bucket.*
                  type: object
                  object_type: long
                  description: Request duration, histogram buckets
                - name: current.count
                  type: long
                  description: Inflight requests
                - name: longrunning.count
                  type: long
                  description: Number of requests active long running requests
            - name: etcd.object.count
              type: long
              description: Number of kubernetes objects at etcd
            - name: audit.event.count
              type: long
              description: Number of audit events
            - name: audit.rejected.count
              type: long
              description: Number of audit rejected events
        - name: container
          type: group
          description: >
            kubernetes container metrics
          release: ga
          fields:
            - name: start_time
              type: date
              description: >
                Start time
            - name: cpu
              type: group
              description: >
                CPU usage metrics
              fields:
                - name: usage
                  type: group
                  fields:
                    - name: core
                      type: group
                      fields:
                        - name: ns
                          type: long
                          description: >
                            Container CPU Core usage nanoseconds
                    - name: nanocores
                      type: long
                      description: >
                        CPU used nanocores
                    - name: node.pct
                      type: scaled_float
                      format: percent
                      description: >
                        CPU usage as a percentage of the total node allocatable CPU
                    - name: limit.pct
                      type: scaled_float
                      format: percent
                      description: >
                        CPU usage as a percentage of the defined limit for the container (or total node allocatable CPU if unlimited)
            - name: logs
              type: group
              description: >
                Logs info
              fields:
                - name: available
                  type: group
                  fields:
                    - name: bytes
                      type: long
                      format: bytes
                      description: >
                        Logs available capacity in bytes
                - name: capacity
                  type: group
                  fields:
                    - name: bytes
                      type: long
                      format: bytes
                      description: >
                        Logs total capacity in bytes
                - name: used
                  type: group
                  fields:
                    - name: bytes
                      type: long
                      format: bytes
                      description: >
                        Logs used capacity in bytes
                - name: inodes
                  type: group
                  fields:
                    - name: count
                      type: long
                      description: >
                        Total available inodes
                    - name: free
                      type: long
                      description: >
                        Total free inodes
                    - name: used
                      type: long
                      description: >
                        Total used inodes
            - name: memory
              type: group
              fields:
                - name: available
                  type: group
                  fields:
                    - name: bytes
                      type: long
                      format: bytes
                      description: >
                        Total available memory
                - name: usage
                  type: group
                  fields:
                    - name: bytes
                      type: long
                      format: bytes
                      description: >
                        Total memory usage
                    - name: node.pct
                      type: scaled_float
                      format: percent
                      description: >
                        Memory usage as a percentage of the total node allocatable memory
                    - name: limit.pct
                      type: scaled_float
                      format: percent
                      description: >
                        Memory usage as a percentage of the defined limit for the container (or total node allocatable memory if unlimited)
                - name: rss
                  type: group
                  fields:
                    - name: bytes
                      type: long
                      format: bytes
                      description: >
                        RSS memory usage
                - name: workingset
                  type: group
                  fields:
                    - name: bytes
                      type: long
                      format: bytes
                      description: >
                        Working set memory usage
                - name: pagefaults
                  type: long
                  description: >
                    Number of page faults
                - name: majorpagefaults
                  type: long
                  description: >
                    Number of major page faults
            - name: rootfs
              type: group
              fields:
                - name: capacity
                  type: group
                  fields:
                    - name: bytes
                      type: long
                      format: bytes
                      description: >
                        Root filesystem total capacity in bytes
                - name: available
                  type: group
                  fields:
                    - name: bytes
                      type: long
                      format: bytes
                      description: >
                        Root filesystem total available in bytes
                - name: used
                  type: group
                  fields:
                    - name: bytes
                      type: long
                      format: bytes
                      description: >
                        Root filesystem total used in bytes
                - name: inodes
                  type: group
                  fields:
                    - name: used
                      type: long
                      description: >
                        Used inodes
        - name: controllermanager
          type: group
          description: >
            Controller manager metrics
          release: beta
          fields:
            - name: handler
              type: keyword
              description: >
                Request handler
            - name: code
              type: keyword
              description: >
                HTTP code
            - name: method
              type: keyword
              description: >
                HTTP method
            - name: host
              type: keyword
              description: >
                Request host
            - name: name
              type: keyword
              description: >
                Name for the resource
            - name: zone
              type: keyword
              description: >
                Infrastructure zone
            - name: process
              type: group
              fields:
                - name: cpu.sec
                  type: double
                  description: CPU seconds
                - name: memory.resident.bytes
                  type: long
                  format: bytes
                  description: Bytes in resident memory
                - name: memory.virtual.bytes
                  type: long
                  format: bytes
                  description: Bytes in virtual memory
                - name: fds.open.count
                  type: long
                  description: Number of open file descriptors
                - name: started.sec
                  type: double
                  description: Seconds since the process started
            - name: http
              type: group
              fields:
                - name: request.duration.us.percentile.*
                  type: object
                  object_type: double
                  description: Request duration microseconds percentiles
                - name: request.duration.us.sum
                  type: double
                  description: Request duration microseconds cumulative sum
                - name: request.duration.us.count
                  type: long
                  description: Request count for duration
                - name: request.size.bytes.percentile.*
                  type: object
                  object_type: long
                  description: Request size percentiles
                - name: request.size.bytes.sum
                  type: long
                  format: bytes
                  description: Request size cumulative sum
                - name: request.size.bytes.count
                  type: long
                  description: Request count for size
                - name: response.size.bytes.percentile.*
                  type: object
                  object_type: long
                  description: Response size percentiles
                - name: response.size.bytes.sum
                  type: long
                  format: bytes
                  description: Response size cumulative sum
                - name: response.size.bytes.count
                  type: long
                  description: Response count
                - name: request.count
                  type: long
                  description: Request count for response
            - name: client.request.count
              type: long
              description: >
                Number of requests as client
            - name: workqueue
              type: group
              fields:
                - name: longestrunning.sec
                  type: double
                  description: Longest running processors
                - name: unfinished.sec
                  type: double
                  description: Unfinished processors
                - name: adds.count
                  type: long
                  description: Workqueue add count
                - name: depth.count
                  type: long
                  description: Workqueue depth count
                - name: retries.count
                  type: long
                  description: Workqueue number of retries
            - name: node.collector
              type: group
              fields:
                - name: eviction.count
                  type: long
                  description: Number of node evictions
                - name: unhealthy.count
                  type: long
                  description: Number of unhealthy nodes
                - name: count
                  type: long
                  description: Number of nodes
                - name: health.pct
                  type: long
                  description: Percentage of healthy nodes
            - name: leader.is_master
              type: boolean
              description: >
                Whether the node is master
        
        - name: event
          type: group
          description: >
            The Kubernetes events metricset collects events that are generated by objects running
            inside of Kubernetes
          release: ga
          fields:
          - name: count
            type: long
            description: >
              Count field records the number of times the particular event has occurred
          - name: timestamp
            type: group
            fields:
            - name: first_occurrence
              type: date
              description: >
                Timestamp of first occurrence of event
            - name: last_occurrence
              type: date
              description: >
                Timestamp of last occurrence of event
          - name: message
            type: text
            description: >
              Message recorded for the given event
            copy_to: message
          - name: reason
            type: keyword
            description: >
              Reason recorded for the given event
          - name: type
            type: keyword
            description: >
              Type of the given event
          - name: source
            type: group
            description: >
              The component reporting this event
            fields:
            - name: component
              type: keyword
              description: >
                Component from which the event is generated
            - name: host
              type: keyword
              description: >
                Node name on which the event is generated
          - name: metadata
            type: group
            description: >
              Metadata associated with the given event
            fields:
            - name: timestamp
              type: group
              fields:
              - name: created
                type: date
                description: >
                  Timestamp of creation of the given event
            - name: generate_name
              type: keyword
              description: >
                Generate name of the event
            - name: name
              type: keyword
              description: >
                Name of the event
            - name: namespace
              type: keyword
              description: >
                Namespace in which event was generated
            - name: resource_version
              type: keyword
              description: >
                Version of the event resource
            - name: uid
              type: keyword
              description: >
                Unique identifier to the event object
            - name: self_link
              type: keyword
              description: >
                URL representing the event
          - name: involved_object
            type: group
            description: >
              Metadata associated with the given involved object
            fields:
            - name: api_version
              type: keyword
              description: >
                API version of the object
            - name: kind
              type: keyword
              description: >
                API kind of the object
            - name: name
              type: keyword
              description: >
                name of the object
            - name: resource_version
              type: keyword
              description: >
                resource version of the object
            - name: uid
              type: keyword
              description: >
                UUID version of the object
        - name: node
          type: group
          description: >
            kubernetes node metrics
          release: ga
          fields:
            - name: start_time
              type: date
              description: >
                Start time
            - name: cpu
              type: group
              description: >
                CPU usage metrics
              fields:
                - name: usage
                  type: group
                  fields:
                    - name: core
                      type: group
                      fields:
                        - name: ns
                          type: long
                          description: >
                            Node CPU Core usage nanoseconds
                    - name: nanocores
                      type: long
                      description: >
                        CPU used nanocores
            - name: memory
              type: group
              fields:
                - name: available
                  type: group
                  fields:
                    - name: bytes
                      type: long
                      format: bytes
                      description: >
                        Total available memory
                - name: usage
                  type: group
                  fields:
                    - name: bytes
                      type: long
                      format: bytes
                      description: >
                        Total memory usage
                - name: rss
                  type: group
                  fields:
                    - name: bytes
                      type: long
                      format: bytes
                      description: >
                        RSS memory usage
                - name: workingset
                  type: group
                  fields:
                    - name: bytes
                      type: long
                      format: bytes
                      description: >
                        Working set memory usage
                - name: pagefaults
                  type: long
                  description: >
                    Number of page faults
                - name: majorpagefaults
                  type: long
                  description: >
                    Number of major page faults
            - name: network
              type: group
              fields:
                - name: rx
                  type: group
                  fields:
                    - name: bytes
                      type: long
                      format: bytes
                      description: >
                        Received bytes
                    - name: errors
                      type: long
                      description: >
                        Rx errors
                - name: tx
                  type: group
                  fields:
                    - name: bytes
                      type: long
                      format: bytes
                      description: >
                        Transmitted bytes
                    - name: errors
                      type: long
                      description: >
                        Tx errors
            - name: fs
              type: group
              fields:
                - name: capacity
                  type: group
                  fields:
                    - name: bytes
                      type: long
                      format: bytes
                      description: >
                        Filesystem total capacity in bytes
                - name: available
                  type: group
                  fields:
                    - name: bytes
                      type: long
                      format: bytes
                      description: >
                        Filesystem total available in bytes
                - name: used
                  type: group
                  fields:
                    - name: bytes
                      type: long
                      format: bytes
                      description: >
                        Filesystem total used in bytes
                - name: inodes
                  type: group
                  fields:
                    - name: used
                      type: long
                      description: >
                        Number of used inodes
                    - name: count
                      type: long
                      description: >
                        Number of inodes
                    - name: free
                      type: long
                      description: >
                        Number of free inodes
            - name: runtime
              type: group
              fields:
                - name: imagefs
                  type: group
                  fields:
                    - name: capacity
                      type: group
                      fields:
                        - name: bytes
                          type: long
                          format: bytes
                          description: >
                            Image filesystem total capacity in bytes
                    - name: available
                      type: group
                      fields:
                        - name: bytes
                          type: long
                          format: bytes
                          description: >
                            Image filesystem total available in bytes
                    - name: used
                      type: group
                      fields:
                        - name: bytes
                          type: long
                          format: bytes
                          description: >
                            Image filesystem total used in bytes
        - name: pod
          type: group
          description: >
            kubernetes pod metrics
          release: ga
          fields:
            - name: start_time
              type: date
              description: >
                Start time
            - name: network
              type: group
              fields:
                - name: rx
                  type: group
                  fields:
                    - name: bytes
                      type: long
                      format: bytes
                      description: >
                        Received bytes
                    - name: errors
                      type: long
                      description: >
                        Rx errors
                - name: tx
                  type: group
                  fields:
                    - name: bytes
                      type: long
                      format: bytes
                      description: >
                        Transmitted bytes
                    - name: errors
                      type: long
                      description: >
                        Tx errors
            - name: cpu
              type: group
              description: >
                CPU usage metrics
              fields:
                - name: usage
                  type: group
                  fields:
                    - name: nanocores
                      type: long
                      description: >
                        CPU used nanocores
                    - name: node.pct
                      type: scaled_float
                      format: percent
                      description: >
                        CPU usage as a percentage of the total node CPU
                    - name: limit.pct
                      type: scaled_float
                      format: percent
                      description: >
                        CPU usage as a percentage of the defined limit for the pod containers (or total node CPU if one or more containers of the pod are unlimited)
            - name: memory
              type: group
              fields:
                - name: usage
                  type: group
                  fields:
                    - name: bytes
                      type: long
                      format: bytes
                      description: >
                        Total memory usage
                    - name: node.pct
                      type: scaled_float
                      format: percent
                      description: >
                        Memory usage as a percentage of the total node allocatable memory
                    - name: limit.pct
                      type: scaled_float
                      format: percent
                      description: >
                        Memory usage as a percentage of the defined limit for the pod containers (or total node allocatable memory if unlimited)
                - name: available
                  type: group
                  fields:
                    - name: bytes
                      type: long
                      format: bytes
                      description: >
                        Total memory available
                - name: working_set
                  type: group
                  fields:
                    - name: bytes
                      type: long
                      format: bytes
                      description: >
                        Total working set memory
                - name: rss
                  type: group
                  fields:
                    - name: bytes
                      type: long
                      format: bytes
                      description: >
                        Total resident set size memory
                - name: page_faults
                  type: long
                  description: >
                    Total page faults
                - name: major_page_faults
                  type: long
                  description: >
                    Total major page faults
        - name: proxy
          type: group
          description: >
            Kubernetes proxy server metrics
          release: beta
          fields:
          - name: handler
            type: keyword
            description: >
              Request handler
          - name: code
            type: keyword
            description: >
              HTTP code
          - name: method
            type: keyword
            description: >
              HTTP method
          - name: host
            type: keyword
            description: >
              Request host
          - name: process
            type: group
            fields:
              - name: cpu.sec
                type: double
                description: CPU seconds
              - name: memory.resident.bytes
                type: long
                format: bytes
                description: Bytes in resident memory
              - name: memory.virtual.bytes
                type: long
                format: bytes
                description: Bytes in virtual memory
              - name: fds.open.count
                type: long
                description: Number of open file descriptors
              - name: started.sec
                type: double
                description: Seconds since the process started
          - name: http
            type: group
            fields:
              - name: request.duration.us.percentile.*
                type: object
                object_type: double
                description: Request duration microseconds percentiles
              - name: request.duration.us.sum
                type: double
                description: Request duration microseconds cumulative sum
              - name: request.duration.us.count
                type: long
                description: Request count for duration
              - name: request.size.bytes.percentile.*
                type: object
                object_type: long
                description: Request size percentiles
              - name: request.size.bytes.sum
                type: long
                format: bytes
                description: Request size cumulative sum
              - name: request.size.bytes.count
                type: long
                description: Request count for size
              - name: response.size.bytes.percentile.*
                type: object
                object_type: long
                description: Response size percentiles
              - name: response.size.bytes.sum
                type: long
                format: bytes
                description: Response size cumulative sum
              - name: response.size.bytes.count
                type: long
                description: Response count
              - name: request.count
                type: long
                description: Request count
          - name: client.request.count
            type: long
            description: >
              Number of requests as client
          - name: sync
            type: group
            description: >
              kubeproxy proxy sync metrics
            fields:
              - name: rules.duration.us.sum
                type: long
                description: SyncProxyRules duration, sum of durations in microseconds
              - name: rules.duration.us.count
                type: long
                description: SyncProxyRules duration, number of operations
              - name: rules.duration.us.bucket.*
                type: object
                object_type: long
                description: SyncProxyRules duration, histogram buckets
              - name: networkprogramming.duration.us.sum
                type: long
                description: Network programming duration, sum in microseconds
              - name: networkprogramming.duration.us.count
                type: long
                description: Network programming duration, number of operations
              - name: networkprogramming.duration.us.bucket.*
                type: object
                object_type: long
                description: Network programming duration, histogram buckets
        
        - name: scheduler
          type: group
          description: >
            Kubernetes scheduler metrics
          release: beta
          fields:
          - name: handler
            type: keyword
            description: >
              Request handler
          - name: code
            type: keyword
            description: >
              HTTP code
          - name: method
            type: keyword
            description: >
              HTTP method
          - name: host
            type: keyword
            description: >
              Request host
          - name: name
            type: keyword
            description: >
              Name for the resource
          - name: result
            type: keyword
            description: >
              Schedule attempt result
          - name: operation
            type: keyword
            description: >
              Scheduling operation
          - name: process
            type: group
            fields:
              - name: cpu.sec
                type: double
                description: CPU seconds
              - name: memory.resident.bytes
                type: long
                format: bytes
                description: Bytes in resident memory
              - name: memory.virtual.bytes
                type: long
                format: bytes
                description: Bytes in virtual memory
              - name: fds.open.count
                type: long
                description: Number of open file descriptors
              - name: started.sec
                type: double
                description: Seconds since the process started
          - name: http
            type: group
            fields:
              - name: request.duration.us.percentile.*
                type: object
                object_type: double
                description: Request duration microseconds percentiles
              - name: request.duration.us.sum
                type: double
                description: Request duration microseconds cumulative sum
              - name: request.duration.us.count
                type: long
                description: Request count for duration
              - name: request.size.bytes.percentile.*
                type: object
                object_type: long
                description: Request size percentiles
              - name: request.size.bytes.sum
                type: long
                format: bytes
                description: Request size cumulative sum
              - name: request.size.bytes.count
                type: long
                description: Request count for size
              - name: response.size.bytes.percentile.*
                type: object
                object_type: long
                description: Response size percentiles
              - name: response.size.bytes.sum
                type: long
                format: bytes
                description: Response size cumulative sum
              - name: response.size.bytes.count
                type: long
                description: Response count
              - name: request.count
                type: long
                description: Request count
          - name: client.request.count
            type: long
            description: >
              Number of requests as client
          - name: leader.is_master
            type: boolean
            description: >
              Whether the node is master
        
          - name: scheduling
            type: group
            fields:
              - name: e2e.duration.us.bucket.*
                type: object
                object_type: long
                description: End to end scheduling duration microseconds
              - name: e2e.duration.us.sum
                type: long
                description: End to end scheduling duration microseconds sum
              - name: e2e.duration.us.count
                type: long
                description: End to end scheduling count
              - name: pod.preemption.victims.bucket.*
                type: long
                description: Pod preemption victims
              - name: pod.preemption.victims.sum
                type: long
                description: Pod preemption victims sum
              - name: pod.preemption.victims.count
                type: long
                description: Pod preemption victims count
              - name: pod.attempts.count
                type: long
                description: Pod attempts count
              - name: duration.seconds.percentile.*
                type: object
                object_type: double
                description: Scheduling duration percentiles
              - name: duration.seconds.sum
                type: double
                description: Scheduling duration cumulative sum
              - name: duration.seconds.count
                type: long
                description: Scheduling count
        
        - name: container
          type: group
          description: >
            kubernetes container metrics
          release: ga
          fields:
            - name: id
              type: keyword
              description:
                Container id
            - name: status
              type: group
              fields:
                - name: phase
                  type: keyword
                  description: >
                        Container phase (running, waiting, terminated)
                - name: ready
                  type: boolean
                  description: >
                    Container ready status
                - name: restarts
                  type: integer
                  description: >
                    Container restarts count
                - name: reason
                  type: keyword
                  description: >
                    Waiting (ContainerCreating, CrashLoopBackoff, ErrImagePull, ImagePullBackoff)
                    or termination (Completed, ContainerCannotRun, Error, OOMKilled) reason.
            - name: cpu
              type: group
              fields:
                - name: limit.cores
                  type: float
                  description: >
                    Container CPU cores limit
                - name: request.cores
                  type: float
                  description: >
                    Container CPU requested cores
                - name: limit.nanocores
                  type: long
                  deprecated: 6.4
                  description: >
                    Container CPU nanocores limit
                - name: request.nanocores
                  deprecated: 6.4
                  type: long
                  description: >
                    Container CPU requested nanocores
            - name: memory
              type: group
              fields:
                - name: limit.bytes
                  type: long
                  format: bytes
                  description: >
                    Container memory limit in bytes
                - name: request.bytes
                  type: long
                  format: bytes
                  description: >
                    Container requested memory in bytes
        - name: cronjob
          type: group
          description: >
            kubernetes cronjob metrics
          release: beta
          fields:
            - name: name
              type: keyword
              description: Cronjob name
            - name: schedule
              type: keyword
              description: Cronjob schedule
            - name: concurrency
              type: keyword
              description: Concurrency policy
            - name: active.count
              type: long
              description: Number of active pods for the cronjob
            - name: is_suspended
              type: boolean
              description: Whether the cronjob is suspended
            - name: created.sec
              type: double
              description: Epoch seconds since the cronjob was created
            - name: last_schedule.sec
              type: double
              description: Epoch seconds for last cronjob run
            - name: next_schedule.sec
              type: double
              description: Epoch seconds for next cronjob run
            - name: deadline.sec
              type: long
              description: Deadline seconds after schedule for considering failed
        
        
        
        
              
              
        
        
        - name: daemonset
          type: group
          description: >
            Kubernetes DaemonSet metrics
          release: ga
          fields:
            - name: name
              type: keyword
            - name: replicas
              type: group
              description: >
                Kubernetes DaemonSet replica metrics
              fields:
                - name: available
                  type: long
                  description: >
                    The number of available replicas per DaemonSet
                - name: desired
                  type: long
                  description: >
                    The desired number of replicas per DaemonSet
                - name: ready
                  type: long
                  description: >
                    The number of ready replicas per DaemonSet
                - name: unavailable
                  type: long
                  description: >
                    The number of unavailable replicas per DaemonSet
        - name: deployment
          type: group
          description: >
            kubernetes deployment metrics
          release: ga
          fields:
            - name: paused
              type: boolean
              description: >
                Kubernetes deployment paused status
            - name: replicas
              type: group
              description: >
                Kubernetes deployment replicas info
              fields:
                - name: desired
                  type: integer
                  description: >
                    Deployment number of desired replicas (spec)
                - name: available
                  type: integer
                  description: >
                    Deployment available replicas
                - name: unavailable
                  type: integer
                  description: >
                    Deployment unavailable replicas
                - name: updated
                  type: integer
                  description: >
                    Deployment updated replicas
        - name: node
          type: group
          description: >
            kubernetes node metrics
          release: ga
          fields:
            - name: status
              type: group
              fields:
                - name: ready
                  type: keyword
                  description: >
                    Node ready status (true, false or unknown)
                - name: unschedulable
                  type: boolean
                  description: >
                    Node unschedulable status
            - name: cpu
              type: group
              fields:
                - name: allocatable.cores
                  type: float
                  description: >
                    Node CPU allocatable cores
                - name: capacity.cores
                  type: long
                  description: >
                    Node CPU capacity cores
            - name: memory
              type: group
              fields:
                - name: allocatable.bytes
                  type: long
                  format: bytes
                  description: >
                    Node allocatable memory in bytes
                - name: capacity.bytes
                  type: long
                  format: bytes
                  description: >
                    Node memory capacity in bytes
            - name: pod
              type: group
              fields:
                - name: allocatable.total
                  type: long
                  description: >
                    Node allocatable pods
                - name: capacity.total
                  type: long
                  description: >
                    Node pod capacity
        - name: persistentvolume
          type: group
          description: >
            kubernetes persistent volume metrics from kube-state-metrics
          release: ga
          fields:
            - name: name
              type: keyword
              description: Volume name.
            - name: capacity.bytes
              type: long
              description: Volume capacity
            - name: phase
              type: keyword
              description: Volume phase according to kubernetes
            - name: storage_class
              type: keyword
              description: Storage class for the volume
              
              
        
        - name: persistentvolumeclaim
          type: group
          description: >
            kubernetes persistent volume clame metrics from kube-state-metrics
          release: ga
          fields:
            - name: name
              type: keyword
              description: PVC name.
            - name: volume_name
              type: keyword
              description: Binded volume name.
            - name: request_storage.bytes
              type: long
              description: Requested capacity.
            - name: phase
              type: keyword
              description: PVC phase.
            - name: access_mode
              type: keyword
              description: Access mode.
            - name: storage_class
              type: keyword
              description: Storage class for the PVC.
              
        - name: pod
          type: group
          description: >
            kubernetes pod metrics
          release: ga
          fields:
            - name: ip
              type: ip
              description: >
                Kubernetes pod IP
            - name: host_ip
              type: ip
              description: >
                Kubernetes pod host IP
            - name: status
              type: group
              description: >
                Kubernetes pod status metrics
              fields:
                - name: phase
                  type: keyword
                  description: >
                    Kubernetes pod phase (Running, Pending...)
                - name: ready
                  type: keyword
                  description: >
                    Kubernetes pod ready status (true, false or unknown)
                - name: scheduled
                  type: keyword
                  description: >
                    Kubernetes pod scheduled status (true, false, unknown)
        - name: replicaset
          type: group
          description: >
            kubernetes replica set metrics
          release: ga
          fields:
            - name: replicas
              type: group
              description: >
                Kubernetes replica set paused status
              fields:
                - name: available
                  type: long
                  description: >
                    The number of replicas per ReplicaSet
                - name: desired
                  type: long
                  description: >
                    The number of replicas per ReplicaSet
                - name: ready
                  type: long
                  description: >
                    The number of ready replicas per ReplicaSet
                - name: observed
                  type: long
                  description: >
                    The generation observed by the ReplicaSet controller
                - name: labeled
                  type: long
                  description: >
                    The number of fully labeled replicas per ReplicaSet
        - name: resourcequota
          type: group
          description: >
            kubernetes resourcequota metrics
          release: beta
          fields:
            - name: created.sec
              type: double
              description: Epoch seconds since the ResourceQuota was created
            - name: quota
              type: double
              description: Quota informed (hard or used) for the resource
            - name: name
              type: keyword
              description: ResourceQuota name
            - name: type
              type: keyword
              description: Quota information type, `hard` or `used`
            - name: resource
              type: keyword
              description: Resource name the quota applies to
        
              
              
        
        
        - name: service
          type: group
          description: >
            kubernetes service metrics
          release: ga
          fields:
            - name: name
              type: keyword
              description: Service name.
            - name: cluster_ip
              type: keyword
              description: Internal IP for the service.
            - name: external_name
              type: keyword
              description: Service external DNS name
            - name: external_ip
              type: keyword
              description: Service external IP
            - name: load_balancer_ip
              type: keyword
              description: Load Balancer service IP
            - name: type
              type: keyword
              description: Service type
            - name: ingress_ip
              type: keyword
              description: Ingress IP
            - name: ingress_hostname
              type: keyword
              description: Ingress Hostname
            - name: created
              type: date
              description: Service creation date
        - name: statefulset
          type: group
          description: >
            kubernetes stateful set metrics
          release: ga
          fields:
            - name: created
              type: long
              description: >
                The creation timestamp (epoch) for StatefulSet
            - name: replicas
              type: group
              description: >
                Kubernetes stateful set replicas status
              fields:
                - name: observed
                  type: long
                  description: >
                    The number of observed replicas per StatefulSet
                - name: desired
                  type: long
                  description: >
                    The number of desired replicas per StatefulSet
            - name: generation
              type: group
              description: >
                Kubernetes stateful set generation information
              fields:
                - name: observed
                  type: long
                  description: >
                    The observed generation per StatefulSet
                - name: desired
                  type: long
                  description: >
                    The desired generation per StatefulSet
        - name: storageclass
          type: group
          description: >
            kubernetes storage class metrics
          release: ga
          fields:
            - name: name
              type: keyword
              description: Storage class name.
            - name: provisioner
              type: keyword
              description: Volume provisioner for the storage class.
            - name: reclaim_policy
              type: keyword
              description: Reclaim policy for dynamically created volumes
            - name: volume_binding_mode
              type: keyword
              description: Mode for default provisioning and binding
            - name: created
              type: date
              description: Storage class creation date
        - name: system
          type: group
          description: >
            kubernetes system containers metrics
          release: ga
          fields:
            - name: container
              type: keyword
              description: >
                Container name
            - name: start_time
              type: date
              description: >
                Start time
            - name: cpu
              type: group
              description: >
                CPU usage metrics
              fields:
                - name: usage
                  type: group
                  fields:
                    - name: core
                      type: group
                      fields:
                        - name: ns
                          type: long
                          description: >
                            CPU Core usage nanoseconds
                    - name: nanocores
                      type: long
                      description: >
                        CPU used nanocores
            - name: memory
              type: group
              fields:
                - name: usage
                  type: group
                  fields:
                    - name: bytes
                      type: long
                      format: bytes
                      description: >
                        Total memory usage
                - name: rss
                  type: group
                  fields:
                    - name: bytes
                      type: long
                      format: bytes
                      description: >
                        RSS memory usage
                - name: workingset
                  type: group
                  fields:
                    - name: bytes
                      type: long
                      format: bytes
                      description: >
                        Working set memory usage
                - name: pagefaults
                  type: long
                  description: >
                    Number of page faults
                - name: majorpagefaults
                  type: long
                  description: >
                    Number of major page faults
        - name: volume
          type: group
          description: >
            kubernetes volume metrics
          release: ga
          fields:
            - name: name
              type: keyword
              description: >
                Volume name
            - name: fs
              type: group
              fields:
                - name: capacity
                  type: group
                  fields:
                    - name: bytes
                      type: long
                      format: bytes
                      description: >
                        Filesystem total capacity in bytes
                - name: available
                  type: group
                  fields:
                    - name: bytes
                      type: long
                      format: bytes
                      description: >
                        Filesystem total available in bytes
                - name: used
                  type: group
                  fields:
                    - name: bytes
                      type: long
                      format: bytes
                      description: >
                        Filesystem total used in bytes
                - name: inodes
                  type: group
                  fields:
                    - name: used
                      type: long
                      description: >
                        Used inodes
                    - name: free
                      type: long
                      description: >
                        Free inodes
                    - name: count
                      type: long
                      description: >
                        Total inodes
- key: kvm
  title: "KVM"
  release: beta
  description: >
    kvm module
  fields:
    - name: kvm.id
      type: long
      description: >
        Domain id
    - name: kvm.name
      type: keyword
      description: >
        Domain name
    - name: kvm
      type: group
      description: >
      fields:
        - name: dommemstat
          type: group
          description: >
            dommemstat
          release: beta
          fields:
              - name: stat
                type: group
                description: >
                  Memory stat
                fields:
                  - name: name
                    type: keyword
                    description: >
                      Memory stat name
                  - name: value
                    type: long
                    description: >
                      Memory stat value
              - name: id
                type: long
                description: >
                  Domain id
              - name: name
                type: keyword
                description: >
                  Domain name
        - name: status
          type: group
          description: >
            status
          release: beta
          fields:
            - name: state
              type: keyword
              description: >
                Domain state
- key: linux
  title: "linux"
  release: beta
  description: >
    linux module
  fields:
    - name: linux
      type: group
      description: >
        linux system metrics
      fields:
        - name: conntrack
          type: group
          release: beta
          description: >
            conntrack
          fields:
            - name: summary
              type: group
              description: >
                summary of nf_conntrack statistics, summed across CPU cores
              fields:
                - name: drop
                  type: long
                  description: >
                    packets dropped due to conntrack failiure
                - name: early_drop
                  type: long
                  description: >
                    conntrack entries dropped to make room for new ones
                - name: entries
                  type: long
                  description: >
                    entries in the conntrack table
                - name: found
                  type: long
                  description: >
                    successfully searched entries
                - name: ignore
                  type: long
                  description: >
                    packets seen already connected to a conntrack entry
                - name: insert_failed
                  type: long
                  description: >
                    Number of entries where list insert insert failed 
                - name: invalid
                  type: long
                  description: > 
                    packets seen that cannot be tracked
                - name: search_restart
                  type: long
                  description: >
                    table lookups which had to be restarted due to table resizes
        - name: iostat
          type: group
          release: beta
          description: >
            iostat
          fields:
            - name: read.request.merges_per_sec
              type: float
              description: >
                  The number of read requests merged per second that were queued to the device.
            - name: write.request.merges_per_sec
              type: float
              description: >
                  The number of write requests merged per second that were queued to the device.
            - name: read.request.per_sec
              type: float
              description: >
                  The number of read requests that were issued to the device per second
            - name: write.request.per_sec
              type: float
              description: >
                  The number of write requests that were issued to the device per second
            - name: read.per_sec.bytes
              type: float
              description: >
                  The number of Bytes read from the device per second.
              format: bytes
            - name: read.await
              type: float
              description: >
                  The average time spent for read requests issued to the device to be served.
            - name: write.per_sec.bytes
              type: float
              description: >
                  The number of Bytes write from the device per second.
              format: bytes
            - name: write.await
              type: float
              description: >
                  The average time spent for write requests issued to the device to be served.
            - name: request.avg_size
              type: float
              description: >
                  The average size (in bytes) of the requests that were issued to the device.
            - name: queue.avg_size
              type: float
              description: >
                  The average queue length of the requests that were issued to the device.
            - name: await
              type: float
              description: >
                  The average time spent for requests issued to the device to be served.
            - name: service_time
              type: float
              description: >
                  The average service time (in milliseconds) for I/O requests that were issued to the device.
            - name: busy
              type: float
              description: >
                  Percentage of CPU time during which I/O requests were issued to the device (bandwidth utilization for the device). Device saturation occurs when this value is close to 100%.
        
        - name: ksm
          type: group
          release: beta
          description: >
            ksm
          fields:
            - name: stats
              type: group
              description: >
                KSM statistics
              fields:
                - name: pages_shared
                  type: long
                  description: >
                    Shared pages in use.
                - name: pages_sharing
                  type: long
                  description: >
                    Sites sharing pages.
                - name: pages_unshared
                  type: long
                  description: >
                    Unique pages.
                - nmae: pages_volatile
                  type: long
                  description: >
                    Pages changing too fast to be shared.
                - name: full_scans
                  type: long
                  description: >
                    Number of times mergable pages have been scanned.
                - name: stable_node_chains
                  type: long
                  description: >
                    Pages that have reached max_page_sharing.
                - name: stable_node_dups
                  type: long
                  description: >
                    Number of duplicated KSM pages.
        - name: memory
          type: group
          release: beta
          description: >
            Linux memory data
          fields:
            - name: page_stats
              type: group
              description: memory page statistics
              fields:
                - name: pgscan_kswapd.pages
                  type: long
                  format: number
                  description: pages scanned by kswapd
                - name: pgscan_direct.pages
                  type: long
                  format: number
                  description: pages scanned directly
                - name: pgfree.pages
                  type: long
                  format: number
                  description: pages freed by the system
                - name: pgsteal_kswapd.pages
                  type: long
                  format: number
                  description: number of pages reclaimed by kswapd
                - name: pgsteal_direct.pages
                  type: long
                  format: number
                  description: number of pages reclaimed directly
                - name: direct_efficiency.pct
                  type: scaled_float
                  format: percent
                  description: direct reclaim efficiency percentage. A lower percentage indicates the system is struggling to reclaim memory.
                - name: kswapd_efficiency.pct
                  type: scaled_float
                  format: percent
                  description: kswapd reclaim efficiency percentage. A lower percentage indicates the system is struggling to reclaim memory.
            - name: hugepages
              type: group
              prefix: "[float]"
              description: This group contains statistics related to huge pages usage on the system.
              fields:
                - name: total
                  type: long
                  format: number
                  description: >
                    Number of huge pages in the pool.
                - name: used.bytes
                  type: long
                  format: bytes
                  description: >
                    Memory used in allocated huge pages.
                - name: used.pct
                  type: long
                  format: percent
                  description: >
                    Percentage of huge pages used.
                - name: free
                  type: long
                  format: number
                  description: >
                    Number of available huge pages in the pool.
                - name: reserved
                  type: long
                  format: number
                  description: >
                    Number of reserved but not allocated huge pages in the pool.
                - name: surplus
                  type: long
                  format: number
                  description: >
                    Number of overcommited huge pages.
                - name: default_size
                  type: long
                  format: bytes
                  description: >
                    Default size for huge pages.
        - name: pageinfo
          type: group
          release: beta
          description: >
            pageinfo
          fields:
            - name: buddy_info
              type: group
              description: >
                Data from /proc/buddyinfo grouping used pages by order
              fields:
                - name: DMA
                  type: group
                  description: >
                    DMA page Data
                  fields:
                    - name: "0"
                      type: long
                      description: >
                        free chunks of 2^0*PAGE_SIZE
                    - name: "1"
                      type: long
                      description: >
                        free chunks of 2^1*PAGE_SIZE
                    - name: "2"
                      type: long
                      description: >
                        free chunks of 2^2*PAGE_SIZE
                    - name: "3"
                      type: long
                      description: >
                        free chunks of 2^3*PAGE_SIZE
                    - name: "4"
                      type: long
                      description: >
                        free chunks of 2^4*PAGE_SIZE
                    - name: "5"
                      type: long
                      description: >
                        free chunks of 2^5*PAGE_SIZE
                    - name: "6"
                      type: long
                      description: >
                        free chunks of 2^6*PAGE_SIZE
                    - name: "7"
                      type: long
                      description: >
                        free chunks of 2^7*PAGE_SIZE
                    - name: "8"
                      type: long
                      description: >
                        free chunks of 2^8*PAGE_SIZE
                    - name: "9"
                      type: long
                      description: >
                        free chunks of 2^9*PAGE_SIZE
                    - name: "10"
                      type: long
                      description: >
                        free chunks of 2^10*PAGE_SIZE
            - name: nodes.*
              type: object
              description: >
                    Raw allocation info from /proc/pagetypeinfo
        
- key: logstash
  title: "Logstash"
  description: >
    Logstash module
  release: ga
  settings: ["ssl", "http"]
  fields:
    - name: logstash
      type: group
      description: >
      fields:
        - name: node
          type: group
          description: >
            node
          release: ga
          fields:
            - name: host
              type: alias
              path: host.hostname
              migration: true
              description: >
                Host name
            - name: version
              type: alias
              path: service.version
              migration: true
              description: >
                Logstash Version
            - name: jvm
              type: group
              description: >
                JVM Info
              fields:
                - name: version
                  type: keyword
                  description: >
                    Version
                - name: pid
                  type: alias
                  path: process.pid
                  migration: true
                  description: >
                    Process ID
        - name: node.stats
          type: group
          description: >
            node_stats metrics.
          release: ga
          fields:
            - name: events
              type: group
              description: >
                Events stats
              fields:
                - name: in
                  type: long
                  description: >
                    Incoming events counter.
                - name: out
                  type: long
                  description: >
                    Outgoing events counter.
                - name: filtered
                  type: long
                  description: >
                    Filtered events counter.
- key: memcached
  title: "Memcached"
  description: >
    Memcached module
  short_config: false
  release: ga
  fields:
    - name: memcached
      type: group
      description: >
      fields:
        - name: stats
          type: group
          description: >
            stats
          release: ga
          fields:
            - name: pid
              type: long
              description: >
                Current process ID of the Memcached task.
        
            - name: uptime.sec
              type: long
              description: >
                Memcached server uptime.
        
            - name: threads
              type: long
              description: >
                Number of threads used by the current Memcached server process.
        
            - name: connections.current
              type: long
              description: >
                Number of open connections to this Memcached server, should be the same
                value on all servers during normal operation.
        
            - name: connections.total
              type: long
              description: >
                Numer of successful connect attempts to this server since it has been started.
        
            - name: get.hits
              type: long
              description: >
                Number of successful "get" commands (cache hits) since startup, divide them
                by the "cmd_get" value to get the cache hitrate.
        
            - name: get.misses
              type: long
              description: >
                Number of failed "get" requests because nothing was cached for this key
                or the cached value was too old.
        
            - name: cmd.get
              type: long
              description: >
                Number of "get" commands received since server startup not counting if they
                were successful or not.
        
            - name: cmd.set
              type: long
              description: >
                Number of "set" commands serviced since startup.
        
            - name: read.bytes
              type: long
              formate: bytes
              description: >
                Total number of bytes received from the network by this server.
        
            - name: written.bytes
              type: long
              formate: bytes
              description: >
                Total number of bytes send to the network by this server.
        
            - name: items.current
              type: long
              description: >
                Number of items currently in this server's cache.
        
            - name: items.total
              type: long
              formate: bytes
              description: >
                Number of items stored ever stored on this server. This is no "maximum item
                count" value but a counted increased by every new item stored in the cache.
        
            - name: evictions
              type: long
              formate: bytes
              description: >
                Number of objects removed from the cache to free up memory for new items
                because Memcached reached it's maximum memory setting (limit_maxbytes).
        
            - name: bytes.current
              type: long
              formate: bytes
              description: >
                Number of bytes currently used for caching items.
        
            - name: bytes.limit
              type: long
              formate: bytes
              description: >
                Number of bytes this server is allowed to use for storage.
- key: mongodb
  title: "MongoDB"
  description: >
    Metrics collected from MongoDB servers.
  short_config: false
  release: ga
  settings: ["ssl"]
  fields:
    - name: mongodb
      type: group
      description: >
        MongoDB metrics.
      fields:
        - name: collstats
          type: group
          description: >
            MongoDB collection statistics metrics.
          release: ga
          fields:
            - name: db
              type: keyword
              description: >
                Database name.
        
            - name: collection
              type: keyword
              description: >
                Collection name.
        
            - name: name
              type: keyword
              description: >
                Combination of database and collection name.
        
            - name: total.time.us
              type: long
              description: >
                Total waiting time for locks in microseconds.
            - name: total.count
              type: long
              description: >
                Total number of lock wait events.
        
            - name: lock
              type: group
              fields:
                - name: read.time.us
                  type: long
                  description: >
                    Time waiting for read locks in microseconds.
                - name: read.count
                  type: long
                  description: >
                    Number of read lock wait events.
        
                - name: write.time.us
                  type: long
                  description: >
                    Time waiting for write locks in microseconds.
                - name: write.count
                  type: long
                  description: >
                    Number of write lock wait events.
        
            - name: queries.time.us
              type: long
              description: >
                Time running queries in microseconds.
            - name: queries.count
              type: long
              description: >
                Number of queries executed.
        
            - name: getmore.time.us
              type: long
              description: >
                Time asking for more cursor rows in microseconds.
            - name: getmore.count
              type: long
              description: >
                Number of times a cursor asked for more data.
        
            - name: insert.time.us
              type: long
              description: >
                Time inserting new documents in microseconds.
            - name: insert.count
              type: long
              description: >
                Number of document insert events.
        
            - name: update.time.us
              type: long
              description: >
                Time updating documents in microseconds.
            - name: update.count
              type: long
              description: >
                Number of document update events.
        
            - name: remove.time.us
              type: long
              description: >
                Time deleting documents in microseconds.
            - name: remove.count
              type: long
              description: >
                Number of document delete events.
        
            - name: commands.time.us
              type: long
              description: >
                Time executing database commands in microseconds.
            - name: commands.count
              type: long
              description: >
                Number of database commands executed.
        - name: dbstats
          type: group
          description: >
            dbstats provides an overview of a particular mongo database. This document
            is most concerned with data volumes of a database.
          release: ga
          fields:
            - name: avg_obj_size.bytes
              type: long
              format: bytes
        
            - name: collections
              type: integer
        
            - name: data_size.bytes
              type: long
              format: bytes
        
            - name: db
              type: keyword
        
            - name: file_size.bytes
              type: long
              format: bytes
        
            - name: index_size.bytes
              type: long
              format: bytes
        
            - name: indexes
              type: long
        
            - name: num_extents
              type: long
        
            - name: objects
              type: long
        
            - name: storage_size.bytes
              type: long
              format: bytes
        
            - name: ns_size_mb.mb
              type: long
        
            - name: data_file_version
              type: group
              fields:
                - name: major
                  type: long
        
                - name: minor
                  type: long
        
            - name: extent_free_list
              type: group
              fields:
                - name: num
                  type: long
        
                - name: size.bytes
                  type: long
                  format: bytes
        - name: metrics
          type: group
          release: ga
          description: >
            Statistics that reflect the current use and state of a running `mongod` instance
            for more information, take a look at https://docs.mongodb.com/manual/reference/command/serverStatus/#serverstatus.metrics
          fields:
            - name: commands
              type: group
              description: >
                Reports on the use of database commands.
                The fields in metrics.commands are the names of database commands and each value is a document
                that reports the total number of commands executed as well as the number of failed executions.
        
                metrics.commands.<command>.failed shows the number of times <command> failed on this mongod.
                metrics.commands.<command>.total shows the number of times <command> executed on this mongod.
              fields:
                - name: is_self
                  type: group
                  fields:
                    - name: failed
                      type: long
                    - name: total
                      type: long
                - name: aggregate
                  type: group
                  fields:
                    - name: failed
                      type: long
                    - name: total
                      type: long
                - name: build_info
                  type: group
                  fields:
                    - name: failed
                      type: long
                    - name: total
                      type: long
                - name: coll_stats
                  type: group
                  fields:
                    - name: failed
                      type: long
                    - name: total
                      type: long
                - name: connection_pool_stats
                  type: group
                  fields:
                    - name: failed
                      type: long
                    - name: total
                      type: long
                - name: count
                  type: group
                  fields:
                    - name: failed
                      type: long
                    - name: total
                      type: long
                - name: db_stats
                  type: group
                  fields:
                    - name: failed
                      type: long
                    - name: total
                      type: long
                - name: distinct
                  type: group
                  fields:
                    - name: failed
                      type: long
                    - name: total
                      type: long
                - name: find
                  type: group
                  fields:
                    - name: failed
                      type: long
                    - name: total
                      type: long
                - name: get_cmd_line_opts
                  type: group
                  fields:
                    - name: failed
                      type: long
                    - name: total
                      type: long
                - name: get_last_error
                  type: group
                  fields:
                    - name: failed
                      type: long
                    - name: total
                      type: long
                - name: get_log
                  type: group
                  fields:
                    - name: failed
                      type: long
                    - name: total
                      type: long
                - name: get_more
                  type: group
                  fields:
                    - name: failed
                      type: long
                    - name: total
                      type: long
                - name: get_parameter
                  type: group
                  fields:
                    - name: failed
                      type: long
                    - name: total
                      type: long
                - name: host_info
                  type: group
                  fields:
                    - name: failed
                      type: long
                    - name: total
                      type: long
                - name: insert
                  type: group
                  fields:
                    - name: failed
                      type: long
                    - name: total
                      type: long
                - name: is_master
                  type: group
                  fields:
                    - name: failed
                      type: long
                    - name: total
                      type: long
                - name: last_collections
                  type: group
                  fields:
                    - name: failed
                      type: long
                    - name: total
                      type: long
                - name: last_commands
                  type: group
                  fields:
                    - name: failed
                      type: long
                    - name: total
                      type: long
                - name: list_databased
                  type: group
                  fields:
                    - name: failed
                      type: long
                    - name: total
                      type: long
                - name: list_indexes
                  type: group
                  fields:
                    - name: failed
                      type: long
                    - name: total
                      type: long
                - name: ping
                  type: group
                  fields:
                    - name: failed
                      type: long
                    - name: total
                      type: long
                - name: profile
                  type: group
                  fields:
                    - name: failed
                      type: long
                    - name: total
                      type: long
                - name: replset_get_rbid
                  type: group
                  fields:
                    - name: failed
                      type: long
                    - name: total
                      type: long
                - name: replset_get_status
                  type: group
                  fields:
                    - name: failed
                      type: long
                    - name: total
                      type: long
                - name: replset_heartbeat
                  type: group
                  fields:
                    - name: failed
                      type: long
                    - name: total
                      type: long
                - name: replset_update_position
                  type: group
                  fields:
                    - name: failed
                      type: long
                    - name: total
                      type: long
                - name: server_status
                  type: group
                  fields:
                    - name: failed
                      type: long
                    - name: total
                      type: long
                - name: update
                  type: group
                  fields:
                    - name: failed
                      type: long
                    - name: total
                      type: long
                - name: whatsmyuri
                  type: group
                  fields:
                    - name: failed
                      type: long
                    - name: total
                      type: long
        
            - name: cursor
              type: group
              description: >
                Contains data regarding cursor state and use.
              fields:
                - name: timed_out
                  type: long
                  description: >
                    The total number of cursors that have timed out since the server process started.
                - name: open
                  type: group
                  description: >
                    Contains data regarding open cursors.
                  fields:
                    - name: no_timeout
                      type: long
                      description: >
                        The number of open cursors with the option DBQuery.Option.noTimeout set to prevent timeout.
                    - name: pinned
                      type: long
                      description: >
                        The number of `pinned` open cursors.
                    - name: total
                      type: long
                      description: >
                        The number of cursors that MongoDB is maintaining for clients.
        
            - name: document
              type: group
              description: >
                Reflects document access and modification patterns.
              fields:
                - name: deleted
                  type: long
                  description: >
                    The total number of documents deleted.
                - name: inserted
                  type: long
                  description: >
                    The total number of documents inserted.
                - name: returned
                  type: long
                  description: >
                    The total number of documents returned by queries.
                - name: updated
                  type: long
                  description: >
                    The total number of documents updated.
        
            - name: get_last_error
              type: group
              description: >
                  Returns the error status of the preceding write operation on the current connection.
              fields:
                - name: write_wait.ms
                  type: long
                  description: >
                    The total amount of time in milliseconds that the mongod has spent performing getLastError operations
                    with write concern (i.e. w) greater than 1.
                - name: write_wait.count
                  type: long
                  description: >
                    The total number of getLastError operations with a specified write concern (i.e. w) greater than 1.
                - name: write_timeouts
                  type: long
                  description: >
                    The number of times that write concern operations have timed out as a result of the wtimeout threshold to getLastError.
        
            - name: operation
              type: group
              description: >
                Holds counters for several types of update and query operations that MongoDB handles using special operation types.
              fields:
                - name: scan_and_order
                  type: long
                  description: >
                    The total number of queries that return sorted numbers that cannot perform the sort operation using an index.
                - name: write_conflicts
                  type: long
                  description: >
                    The total number of queries that encountered write conflicts.
        
            - name: query_executor
              type: group
              description: >
                Reports data from the query execution system.
              fields:
                - name: scanned_indexes.count
                  type: long
                  description: >
                    The total number of index items scanned during queries and query-plan evaluation.
                - name: scanned_documents.count
                  type: long
                  description: >
                    The total number of documents scanned during queries and query-plan evaluation.
        
            - name: replication
              type: group
              description: >
                Reports metrics related to the replication process.
                metrics.replication appears on all mongod instances, even those that aren't members of replica sets.
              fields:
                - name: executor
                  type: group
                  description: >
                    Reports on various statistics for the replication executor.
                  fields:
                    - name: counters
                      type: group
                      fields:
                        - name: event_created
                          type: long
                        - name: event_wait
                          type: long
                        - name: cancels
                          type: long
                        - name: waits
                          type: long
                        - name: scheduled
                          type: group
                          fields:
                            - name: netcmd
                              type: long
                            - name: dbwork
                              type: long
                            - name: exclusive
                              type: long
                            - name: work_at
                              type: long
                            - name: work
                              type: long
                            - name: failures
                              type: long
                    - name: queues
                      type: group
                      fields:
                        - name: in_progress
                          type: group
                          fields:
                            - name: network
                              type: long
                            - name: dbwork
                              type: long
                            - name: exclusive
                              type: long
                        - name: sleepers
                          type: long
                        - name: ready
                          type: long
                        - name: free
                          type: long
                    - name: unsignaled_events
                      type: long
                    - name: event_waiters
                      type: long
                    - name: shutting_down
                      type: boolean
                    - name: network_interface
                      type: keyword
                - name: apply
                  type: group
                  description: >
                    Reports on the application of operations from the replication oplog.
                  fields:
                    - name: attempts_to_become_secondary
                      type: long
                    - name: batches
                      type: group
                      description: >
                        Reports on the oplog application process on secondaries members of replica sets.
                      fields:
                        - name: count
                          type: long
                          description: >
                            The total number of batches applied across all databases.
                        - name: time.ms
                          type: long
                          description: >
                            The total amount of time in milliseconds the mongod has spent applying operations from the oplog.
                    - name: ops
                      type: long
                      description: >
                        The total number of oplog operations applied.
                - name: buffer
                  type: group
                  description: >
                    MongoDB buffers oplog operations from the replication sync source buffer before applying oplog entries in a batch.
                    metrics.replication.buffer provides a way to track the oplog buffer.
                  fields:
                    - name: count
                      type: long
                      description: >
                        The current number of operations in the oplog buffer.
                    - name: max_size.bytes
                      type: long
                      description: >
                        The maximum size of the buffer. This value is a constant setting in the mongod, and is not configurable.
                    - name: size.bytes
                      type: long
                      description: >
                        The current size of the contents of the oplog buffer.
                - name: initial_sync
                  type: group
                  description: >
                    Report initial sync status
                  fields:
                    - name: completed
                      type: long
                    - name: failed_attempts
                      type: long
                    - name: failures
                      type: long
                - name: network
                  type: group
                  description: >
                    Reports network use by the replication process.
                  fields:
                    - name: bytes
                      type: long
                      description: >
                        The total amount of data read from the replication sync source.
                    - name: getmores
                      type: group
                      description: >
                        Reports on the getmore operations, which are requests for additional results from the oplog cursor
                        as part of the oplog replication process.
                      fields:
                        - name: count
                          type: long
                          description: >
                            The total number of getmore operations
                        - name: time.ms
                          type: long
                          description: >
                            The total amount of time required to collect data from getmore operations.
                    - name: ops
                      type: long
                      description: >
                        The total number of operations read from the replication source.
                    - name: reders_created
                      type: long
                      description: >
                        The total number of oplog query processes created.
                - name: preload
                  type: group
                  description: >
                    Reports on the `pre-fetch` stage, where MongoDB loads documents and indexes into RAM to improve replication throughput.
                  fields:
                    - name: docs
                      type: group
                      description: >
                        Reports on the documents loaded into memory during the pre-fetch stage.
                      fields:
                        - name: count
                          type: long
                          description: >
                            The total number of documents loaded during the pre-fetch stage of replication.
                        - name: time.ms
                          type: long
                          decsription: >
                            The total amount of time spent loading documents as part of the pre-fetch stage of replication.
                    - name: indexes
                      type: group
                      description: >
                        Reports on the index items loaded into memory during the pre-fetch stage of replication.
                      fields:
                        - name: count
                          type: long
                          description: >
                            The total number of index entries loaded by members before updating documents as part of the pre-fetch stage of replication.
                        - name: time.ms
                          type: long
                          description: >
                            The total amount of time, in milliseconds, spent loading index entries as part of the pre-fetch stage of replication.
        
            - name: storage.free_list.search
              type: group
              fields:
                - name: bucket_exhausted
                  type: long
                  description: >
                    The number of times that mongod has checked the free list without finding a suitably large record allocation.
                - name: requests
                  type: long
                  description: >
                    The number of times mongod has searched for available record allocations.
                - name: scanned
                  type: long
                  description: >
                    The number of available record allocations mongod has searched.
        
            - name: ttl
              type: group
              description: >
                Reports on the operation of the resource use of the ttl index process.
              fields:
                - name: deleted_documents.count
                  type: long
                  description: >
                    The total number of documents deleted from collections with a ttl index.
                - name: passes.count
                  type: long
                  description: >
                    The number of times the background process removes documents from collections with a ttl index.
        - name: replstatus
          type: group
          release: ga
          description: >
            replstatus provides an overview of replica set status.
          fields:
            - name: oplog
              type: group
              description: >
                oplog provides an overview of replication oplog status, which is retrieved from db.getReplicationInfo().
              fields:
                - name: size.allocated
                  type: long
                  format: bytes
                  description: >
                    The total amount of space used by the replstatus in bytes.
                - name: size.used
                  type: long
                  format: bytes
                  description: >
                    total amount of space allocated to the replstatus in bytes.
        
                - name: first.timestamp
                  type: long
                  description: >
                    Timestamp of the first (i.e. earliest) operation in the replstatus
        
                - name: last.timestamp
                  type: long
                  description: >
                    Timestamp of the last (i.e. latest) operation in the replstatus
        
                - name: window
                  type: long
                  description: >
                    The difference between the first and last operation in the replstatus.
        
            - name: set_name
              type: keyword
              description: >
                The name of the replica set.
        
            - name: server_date
              type: date
              description: >
                Reflects the current time according to the server that processed the replSetGetStatus command.
        
            - name: optimes
              type: group
              fields:
                - name: last_committed
                  type: long
                  description: >
                    Information, from the viewpoint of this member, regarding the most recent operation that has been written to a majority of replica set members.
                - name: applied
                  type: long
                  description: >
                    Information, from the viewpoint of this member, regarding the most recent operation that has been applied to this member of the replica set.
                - name: durable
                  type: long
                  description: >
                    Information, from the viewpoint of this member, regarding the most recent operation that has been written to the journal of this member of the replica set.
        
            - name: lag
              type: group
              description: >
                Delay between a write operation on the primary and its copy to a secondary
              fields:
                - name: max
                  type: long
                  format: duration
                  description: >
                    Difference between optime of primary and slowest secondary
                - name: min
                  type: long
                  format: duration
                  description: >
                    Difference between optime of primary and fastest secondary
        
            - name: headroom
              type: group
              description: >
                Difference between the primary's oplog window and the replication lag of the secondary
              fields:
                - name: max
                  type: long
                  format: duration
                  description: >
                    Difference between primary's oplog window and the replication lag of the fastest secondary
                - name: min
                  type: long
                  format: duration
                  description: >
                    Difference between primary's oplog window and the replication lag of the slowest secondary
        
            - name: members
              type: group
              description: >
                Provides information about members of replica set grouped by their state
              fields:
                - name: primary.host
                  type: keyword
                  description: >
                    Host address of the primary
                - name: primary.optime
                  type: keyword
                  description: >
                    Optime of primary
                - name: secondary.hosts
                  type: keyword
                  description: >
                    List of secondary hosts
                - name: secondary.optimes
                  type: keyword
                  description: >
                    Optimes of secondaries
                - name: secondary.count
                  type: long
                  descriprtion: >
                    Count of secondaries
                - name: recovering.hosts
                  type: keyword
                  description: >
                    List of recovering members hosts
                - name: recovering.count
                  type: long
                  description: >
                    Count of members in the `recovering` state
                - name: unknown.hosts
                  type: keyword
                  description: >
                    List of members' hosts in the `unknown` state
                - name: unknown.count
                  type: long
                  description: >
                    Count of members with `unknown` state
                - name: startup2.hosts
                  type: keyword
                  description: >
                    List of initializing members hosts
                - name: startup2.count
                  type: long
                  description: >
                    Count of members in the `startup2` state
                - name: arbiter.hosts
                  type: keyword
                  description: >
                    List of arbiters hosts
                - name: arbiter.count
                  type: long
                  description: >
                    Count of arbiters
                - name: down.hosts
                  type: keyword
                  description: >
                    List of `down` members hosts
                - name: down.count
                  type: long
                  description: >
                    Count of `down` members
                - name: rollback.hosts
                  type: keyword
                  description: >
                    List of members in the `rollback` state
                - name: rollback.count
                  type: long
                  description: >
                    Count of members in the `rollback` state
                - name: unhealthy.hosts
                  type: keyword
                  description: >
                    List of members' hosts with healthy = false
                - name: unhealthy.count
                  type: long
                  description: >
                    Count of unhealthy members
        - name: status
          type: group
          description: >
            MongoDB server status metrics.
          release: ga
          fields:
            - name: version
              type: alias
              path: service.version
              description: >
                Instance version.
            - name: process
              type: alias
              path: process.name
              description: >
                The current MongoDB process. Possible values are mongos or mongod.
            - name: uptime.ms
              type: long
              description: >
                Instance uptime in milliseconds.
            - name: local_time
              type: date
              description: >
                Local time as reported by the MongoDB instance.
        
            - name: asserts.regular
              type: long
              description: >
                Number of regular assertions produced by the server.
            - name: asserts.warning
              type: long
              description: >
                Number of warning assertions produced by the server.
            - name: asserts.msg
              type: long
              description: >
                Number of msg assertions produced by the server.
            - name: asserts.user
              type: long
              description: >
                Number of user assertions produced by the server.
            - name: asserts.rollovers
              type: long
              description: >
                Number of rollovers assertions produced by the server.
        
            - name: connections
              type: group
              description: >
                Data regarding the current status of incoming connections and
                availability of the database server.
              fields:
                - name: current
                  type: long
                  description: >
                    The number of connections to the database server from clients. This
                    number includes the current shell session. Consider the value of
                    `available` to add more context to this datum.
                - name: available
                  type: long
                  description: >
                     The number of unused available incoming connections the database
                     can provide.
                - name: total_created
                  type: long
                  description: >
                    A count of all incoming connections created to the server. This
                    number includes connections that have since closed.
        
            - name: extra_info
              type: group
              description: >
                Platform specific data.
              fields:
                - name: heap_usage.bytes
                  type: long
                  format: bytes
                  description: >
                    The total size in bytes of heap space used by the database process.
                    Only available on Unix/Linux.
                - name: page_faults
                  type: long
                  description: >
                    The total number of page faults that require disk operations. Page
                    faults refer to operations that require the database server to
                    access data that isn't available in active memory.
        
            - name: global_lock
              type: group
              description: >
                Reports on lock state of the database.
              fields:
                  - name: total_time.us
                    type: long
                    description: >
                      The time, in microseconds, since the database last started and created the globalLock.
                      This is roughly equivalent to total server uptime.
                  - name: current_queue
                    type: group
                    description: >
                      The number of operations queued because of a lock.
                    fields:
                      - name: total
                        type: long
                        description: >
                          The total number of operations queued waiting for the lock (i.e., the sum of current_queue.readers and current_queue.writers).
                      - name: readers
                        type: long
                        description: >
                          The number of operations that are currently queued and waiting for the read lock.
                      - name: writers
                        type: long
                        description: >
                          The number of operations that are currently queued and waiting for the write lock.
                  - name: active_clients
                    type: group
                    description: >
                      The number of connected clients and the read and write operations performed by these clients.
                    fields:
                      - name: total
                        type: long
                        description: >
                          Total number of the active client connections performing read or write operations.
                      - name: readers
                        type: long
                        description: >
                          The number of the active client connections performing read operations.
                      - name: writers
                        type: long
                        description: >
                          The number of the active client connections performing write operations.
            - name: locks
              type: group
              description: >
                A document that reports for each lock <type>, data on lock <mode>s.
                The possible lock <type>s are global, database, collection, metadata and oplog.
                The possible <mode>s are r, w, R and W which respresent shared, exclusive, intent shared and intent exclusive.
        
                locks.<type>.acquire.count.<mode> shows the number of times the lock was acquired in the specified mode.
                locks.<type>.wait.count.<mode> shows the number of times the locks.acquireCount lock acquisitions encountered waits
                because the locks were held in a conflicting mode.
                locks.<type>.wait.us.<mode> shows the cumulative wait time in microseconds for the lock acquisitions.
                locks.<type>.deadlock.count.<mode> shows the number of times the lock acquisitions encountered deadlocks.
              fields:
                - name: global
                  type: group
                  fields:
                    - name: acquire.count.r
                      type: long
                    - name: acquire.count.w
                      type: long
                    - name: acquire.count.R
                      type: long
                    - name: acquire.count.W
                      type: long
                    - name: wait.count.r
                      type: long
                    - name: wait.count.w
                      type: long
                    - name: wait.count.R
                      type: long
                    - name: wait.count.W
                      type: long
                    - name: wait.us.r
                      type: long
                    - name: wait.us.w
                      type: long
                    - name: wait.us.R
                      type: long
                    - name: wait.us.W
                      type: long
                    - name: deadlock.count.r
                      type: long
                    - name: deadlock.count.w
                      type: long
                    - name: deadlock.count.R
                      type: long
                    - name: deadlock.count.W
                      type: long
                - name: database
                  type: group
                  fields:
                    - name: acquire.count.r
                      type: long
                    - name: acquire.count.w
                      type: long
                    - name: acquire.count.R
                      type: long
                    - name: acquire.count.W
                      type: long
                    - name: wait.count.r
                      type: long
                    - name: wait.count.w
                      type: long
                    - name: wait.count.R
                      type: long
                    - name: wait.count.W
                      type: long
                    - name: wait.us.r
                      type: long
                    - name: wait.us.w
                      type: long
                    - name: wait.us.R
                      type: long
                    - name: wait.us.W
                      type: long
                    - name: deadlock.count.r
                      type: long
                    - name: deadlock.count.w
                      type: long
                    - name: deadlock.count.R
                      type: long
                    - name: deadlock.count.W
                      type: long
                - name: collection
                  type: group
                  fields:
                    - name: acquire.count.r
                      type: long
                    - name: acquire.count.w
                      type: long
                    - name: acquire.count.R
                      type: long
                    - name: acquire.count.W
                      type: long
                    - name: wait.count.r
                      type: long
                    - name: wait.count.w
                      type: long
                    - name: wait.count.R
                      type: long
                    - name: wait.count.W
                      type: long
                    - name: wait.us.r
                      type: long
                    - name: wait.us.w
                      type: long
                    - name: wait.us.R
                      type: long
                    - name: wait.us.W
                      type: long
                    - name: deadlock.count.r
                      type: long
                    - name: deadlock.count.w
                      type: long
                    - name: deadlock.count.R
                      type: long
                    - name: deadlock.count.W
                      type: long
                - name: meta_data
                  type: group
                  fields:
                    - name: acquire.count.r
                      type: long
                    - name: acquire.count.w
                      type: long
                    - name: acquire.count.R
                      type: long
                    - name: acquire.count.W
                      type: long
                    - name: wait.count.r
                      type: long
                    - name: wait.count.w
                      type: long
                    - name: wait.count.R
                      type: long
                    - name: wait.count.W
                      type: long
                    - name: wait.us.r
                      type: long
                    - name: wait.us.w
                      type: long
                    - name: wait.us.R
                      type: long
                    - name: wait.us.W
                      type: long
                    - name: deadlock.count.r
                      type: long
                    - name: deadlock.count.w
                      type: long
                    - name: deadlock.count.R
                      type: long
                    - name: deadlock.count.W
                      type: long
                - name: oplog
                  type: group
                  fields:
                    - name: acquire.count.r
                      type: long
                    - name: acquire.count.w
                      type: long
                    - name: acquire.count.R
                      type: long
                    - name: acquire.count.W
                      type: long
                    - name: wait.count.r
                      type: long
                    - name: wait.count.w
                      type: long
                    - name: wait.count.R
                      type: long
                    - name: wait.count.W
                      type: long
                    - name: wait.us.r
                      type: long
                    - name: wait.us.w
                      type: long
                    - name: wait.us.R
                      type: long
                    - name: wait.us.W
                      type: long
                    - name: deadlock.count.r
                      type: long
                    - name: deadlock.count.w
                      type: long
                    - name: deadlock.count.R
                      type: long
                    - name: deadlock.count.W
                      type: long
        
            - name: network
              type: group
              description: >
                Platform specific data.
              fields:
                - name: in.bytes
                  type: long
                  format: bytes
                  description: >
                    The amount of network traffic, in bytes, received by this database.
                - name: out.bytes
                  type: long
                  format: bytes
                  description: >
                    The amount of network traffic, in bytes, sent from this database.
                - name: requests
                  type: long
                  description: >
                    The total number of requests received by the server.
        
            - name: ops.latencies
              type: group
              description: >
                Operation latencies for the database as a whole.
                Only mongod instances report this metric.
              fields:
                - name: reads.latency
                  type: long
                  description: >
                    Total combined latency in microseconds.
                - name: reads.count
                  type: long
                  description: >
                    Total number of read operations performed on the collection since startup.
                - name: writes.latency
                  type: long
                  description: >
                    Total combined latency in microseconds.
                - name: writes.count
                  type: long
                  description: >
                    Total number of write operations performed on the collection since startup.
                - name: commands.latency
                  type: long
                  description: >
                    Total combined latency in microseconds.
                - name: commands.count
                  type: long
                  description: >
                    Total number of commands performed on the collection since startup.
        
            - name: ops.counters
              type: group
              description: >
                An overview of database operations by type.
              fields:
                - name: insert
                  type: long
                  description: >
                    The total number of insert operations received since the mongod
                    instance last started.
                - name: query
                  type: long
                  description: >
                    The total number of queries received since the mongod instance last
                    started.
                - name: update
                  type: long
                  description: >
                    The total number of update operations received since the mongod
                    instance last started.
                - name: delete
                  type: long
                  description: >
                    The total number of delete operations received since the mongod
                    instance last started.
                - name: getmore
                  type: long
                  description: >
                    The total number of getmore operations received since the mongod
                    instance last started.
                - name: command
                  type: long
                  description: >
                    The total number of commands issued to the database since the mongod
                    instance last started.
        
            - name: ops.replicated
              type: group
              description: >
                An overview of database replication operations by type.
              fields:
                - name: insert
                  type: long
                  description: >
                    The total number of replicated insert operations received since the
                    mongod instance last started.
                - name: query
                  type: long
                  description: >
                    The total number of replicated queries received since the mongod
                    instance last started.
                - name: update
                  type: long
                  description: >
                    The total number of replicated update operations received since the
                    mongod instance last started.
                - name: delete
                  type: long
                  description: >
                    The total number of replicated delete operations received since the
                    mongod instance last started.
                - name: getmore
                  type: long
                  description: >
                    The total number of replicated getmore operations received since the
                    mongod instance last started.
                - name: command
                  type: long
                  description: >
                    The total number of replicated commands issued to the database since
                    the mongod instance last started.
        
            - name: memory
              type: group
              description: >
                Data about the current memory usage of the mongod server.
              fields:
                - name: bits
                  type: long
                  description: >
                    Either 64 or 32, depending on which target architecture was specified
                    during the mongod compilation process.
                - name: resident.mb
                  type: long
                  description: >
                    The amount of RAM, in megabytes (MB), currently used by the database
                    process.
                - name: virtual.mb
                  type: long
                  description: >
                   The amount, in megabytes (MB), of virtual memory used by the mongod
                   process.
                - name: mapped.mb
                  type: long
                  description: >
                    The amount of mapped memory, in megabytes (MB), used by the database.
                    Because MongoDB uses memory-mapped files, this value is likely to be
                    to be roughly equivalent to the total size of your database or
                    databases.
                - name: mapped_with_journal.mb
                  type: long
                  description: >
                    The amount of mapped memory, in megabytes (MB), including the memory
                    used for journaling.
            - name: write_backs_queued
              type: boolean
              description: >
                True when there are operations from a mongos instance queued for retrying.
            - name: storage_engine.name
              type: keyword
              description: >
                A string that represents the name of the current storage engine.
        
            - name: wired_tiger
              type: group
              description: >
                Statistics about the WiredTiger storage engine.
              fields:
                - name: concurrent_transactions
                  type: group
                  description: >
                    Statistics about the transactions currently in progress.
                  fields:
                    - name: write.out
                      type: long
                      description: >
                        Number of concurrent write transaction in progress.
                    - name: write.available
                      type: long
                      description: >
                        Number of concurrent write tickets available.
                    - name: write.total_tickets
                      type: long
                      description: >
                        Number of total write tickets.
                    - name: read.out
                      type: long
                      description: >
                        Number of concurrent read transaction in progress.
                    - name: read.available
                      type: long
                      description: >
                        Number of concurrent read tickets available.
                    - name: read.total_tickets
                      type: long
                      description: >
                        Number of total read tickets.
                - name: cache
                  type: group
                  description: >
                    Statistics about the cache and page evictions from the cache.
                  fields:
                    - name: maximum.bytes
                      type: long
                      format: bytes
                      description: >
                        Maximum cache size.
                    - name: used.bytes
                      type: long
                      format: bytes
                      description: >
                        Size in byte of the data currently in cache.
                    - name: dirty.bytes
                      type: long
                      format: bytes
                      description: >
                        Size in bytes of the dirty data in the cache.
                    - name: pages.read
                      type: long
                      description: >
                        Number of pages read into the cache.
                    - name: pages.write
                      type: long
                      description: >
                        Number of pages written from the cache.
                    - name: pages.evicted
                      type: long
                      description: >
                        Number of pages evicted from the cache.
                - name: log
                  type: group
                  description: >
                    Statistics about the write ahead log used by WiredTiger.
                  fields:
                    - name: size.bytes
                      type: long
                      format: bytes
                      description: >
                        Total log size in bytes.
                    - name: write.bytes
                      type: long
                      format: bytes
                      description: >
                        Number of bytes written into the log.
                    - name: max_file_size.bytes
                      type: long
                      format: bytes
                      description: >
                        Maximum file size.
                    - name: flushes
                      type: long
                      description: >
                        Number of flush operations.
                    - name: writes
                      type: long
                      description: >
                        Number of write operations.
                    - name: scans
                      type: long
                      description: >
                        Number of scan operations.
                    - name: syncs
                      type: long
                      description: >
                        Number of sync operations.
        
            - name: background_flushing
              type: group
              description: >
                Data about the process MongoDB uses to write data to disk. This data is
                only available for instances that use the MMAPv1 storage engine.
              fields:
                - name: flushes
                  type: long
                  description: >
                     A counter that collects the number of times the database has
                     flushed all writes to disk.
                - name: total.ms
                  type: long
                  description: >
                    The total number of milliseconds (ms) that the mongod processes have
                    spent writing (i.e. flushing) data to disk. Because this is an
                    absolute value, consider the value of `flushes` and `average_ms` to
                    provide better context for this datum.
                - name: average.ms
                  type: long
                  description: >
                    The average time spent flushing to disk per flush event.
                - name: last.ms
                  type: long
                  description: >
                    The amount of time, in milliseconds, that the last flush operation
                    took to complete.
                - name: last_finished
                  type: date
                  description: >
                    A timestamp of the last completed flush operation.
        
            - name: journaling
              type: group
              description: >
                Data about the journaling-related operations and performance. Journaling
                information only appears for mongod instances that use the MMAPv1
                storage engine and have journaling enabled.
              fields:
                - name: commits
                  type: long
                  description: >
                    The number of transactions written to the journal during the last
                    journal group commit interval.
                - name: journaled.mb
                  type: long
                  description: >
                    The amount of data in megabytes (MB) written to journal during the
                    last journal group commit interval.
                - name: write_to_data_files.mb
                  type: long
                  description: >
                    The amount of data in megabytes (MB) written from journal to the
                    data files during the last journal group commit interval.
                - name: compression
                  type: long
                  description: >
                    The compression ratio of the data written to the journal.
                - name: commits_in_write_lock
                  type: long
                  description: >
                    Count of the commits that occurred while a write lock was held.
                    Commits in a write lock indicate a MongoDB node under a heavy write
                    load and call for further diagnosis.
                - name: early_commits
                  type: long
                  description: >
                    The number of times MongoDB requested a commit before the scheduled
                    journal group commit interval.
                - name: times
                  type: group
                  description: >
                    Information about the performance of the mongod instance during the
                    various phases of journaling in the last journal group commit
                    interval.
                  fields:
                    - name: dt.ms
                      type: long
                      description: >
                        The amount of time over which MongoDB collected the times data.
                        Use this field to provide context to the other times field values.
                    - name: prep_log_buffer.ms
                      type: long
                      description: >
                        The amount of time spent preparing to write to the journal.
                        Smaller values indicate better journal performance.
                    - name: write_to_journal.ms
                      type: long
                      description: >
                        The amount of time spent actually writing to the journal. File
                        system speeds and device interfaces can affect performance.
                    - name: write_to_data_files.ms
                      type: long
                      description: >
                        The amount of time spent writing to data files after journaling.
                        File system speeds and device interfaces can affect performance.
                    - name: remap_private_view.ms
                      type: long
                      description: >
                        The amount of time spent remapping copy-on-write memory mapped
                        views. Smaller values indicate better journal performance.
                    - name: commits.ms
                      type: long
                      description: >
                        The amount of time spent for commits.
                    - name: commits_in_write_lock.ms
                      type: long
                      description: >
                        The amount of time spent for commits that occurred while a write
                        lock was held.
        
- key: munin
  title: "Munin"
  description: >
    Munin node metrics exporter
  release: ga
  fields:
    - name: munin.metrics.*
      type: object
      object_type: double
      object_type_mapping_type: '*'
      description: >
        Metrics exposed by a plugin of a munin node agent.
    - name: munin.plugin.name
      type: keyword
      description: >
        Name of the plugin collecting these metrics.
    - name: munin
      type: group
      fields:
        - release: ga
- key: mysql
  title: "MySQL"
  description: >
    MySQL server status metrics collected from MySQL.
  short_config: false
  release: ga
  fields:
    - name: mysql
      type: group
      description: >
        `mysql` contains the metrics that were obtained from MySQL
        query.
      fields:
        - name: galera_status
          type: group
          release: beta
          description: >
            `galera_status` contains the metrics that were obtained by the status SQL query on Galera.
          fields:
            - name: apply
              type: group
              description: >
                Apply status fields.
              fields:
                - name: oooe
                  type: double
                  description: >
                    How often applier started write-set applying out-of-order (parallelization efficiency).
        
                - name: oool
                  type: double
                  description: >
                    How often write-set was so slow to apply that write-set with higher seqno's were applied earlier.
                    Values closer to 0 refer to a greater gap between slow and fast write-sets.
        
                - name: window
                  type: double
                  description: >
                    Average distance between highest and lowest concurrently applied seqno.
        
            - name: cert
              type: group
              description: >
                Certification status fields.
              fields:
                - name: deps_distance
                  type: double
                  description: >
                    Average distance between highest and lowest seqno value that can be possibly applied in parallel (potential degree of parallelization).
        
                - name: index_size
                  type: long
                  description: >
                    The number of entries in the certification index.
        
                - name: interval
                  type: double
                  description: >
                    Average number of transactions received while a transaction replicates.
        
            - name: cluster
              type: group
              description: >
                Cluster status fields.
              fields:
                - name: conf_id
                  type: long
                  description: >
                    Total number of cluster membership changes happened.
        
                - name: size
                  type: long
                  description: >
                    Current number of members in the cluster.
        
                - name: status
                  type: keyword
                  description: >
                    Status of this cluster component. That is, whether the node is part of a PRIMARY or NON_PRIMARY component.
        
            - name: commit
              type: group
              description: >
                Commit status fields.
              fields:
                - name: oooe
                  type: double
                  description: >
                    How often a transaction was committed out of order.
        
                - name: window
                  type: long
                  description: >
                    Average distance between highest and lowest concurrently committed seqno.
        
            - name: connected
              type: keyword
              description: >
                If the value is OFF, the node has not yet connected to any of the cluster components.
                This may be due to misconfiguration. Check the error log for proper diagnostics.
        
            - name: evs
              type: group
              description: >
                 Evs Fields.
              fields:
                - name: evict
                  type: keyword
                  description: >
                    Lists the UUID's of all nodes evicted from the cluster.
                    Evicted nodes cannot rejoin the cluster until you restart their mysqld processes.
        
                - name: state
                  type: keyword
                  description: >
                    Shows the internal state of the EVS Protocol.
        
            - name: flow_ctl
              type: group
              description: >
                Flow Control fields.
              fields:
                - name: paused
                  type: double
                  description: >
                    The fraction of time since the last FLUSH STATUS command that replication was paused due to flow control.
                    In other words, how much the slave lag is slowing down the cluster.
        
                - name: paused_ns
                  type: long
                  description: >
                    The total time spent in a paused state measured in nanoseconds.
        
                - name: recv
                  type: long
                  description: >
                    Returns the number of FC_PAUSE events the node has received, including those the node has sent.
                    Unlike most status variables, the counter for this one does not reset every time you run the query.
        
                - name: sent
                  type: long
                  description: >
                    Returns the number of FC_PAUSE events the node has sent.
                    Unlike most status variables, the counter for this one does not reset every time you run the query.
        
            - name: last_committed
              type: long
              description: >
                The sequence number, or seqno, of the last committed transaction.
        
            - name: local
              type: group
              description: >
                Node specific Cluster status fields.
              fields:
                - name: bf_aborts
                  type: long
                  description: >
                    Total number of local transactions that were aborted by slave transactions while in execution.
        
                - name: cert_failures
                  type: long
                  description: >
                    Total number of local transactions that failed certification test.
        
                - name: commits
                  type: long
                  description: >
                    Total number of local transactions committed.
        
                - name: recv
                  type: group
                  description: >
                    Node specific recv fields.
                  fields:
                    - name: queue
                      type: long
                      description: >
                        Current (instantaneous) length of the recv queue.
        
                    - name: queue_avg
                      type: double
                      description: >
                        Recv queue length averaged over interval since the last FLUSH STATUS command.
                        Values considerably larger than 0.0 mean that the node cannot apply write-sets as fast
                        as they are received and will generate a lot of replication throttling.
        
                    - name: queue_max
                      type: long
                      description: >
                        The maximum length of the recv queue since the last FLUSH STATUS command.
        
                    - name: queue_min
                      type: long
                      description: >
                        The minimum length of the recv queue since the last FLUSH STATUS command.
        
                - name: replays
                  type: long
                  description: >
                    Total number of transaction replays due to asymmetric lock granularity.
        
                - name: send
                  type: group
                  description: >
                    Node specific sent fields.
                  fields:
                    - name: queue
                      type: long
                      description: >
                        Current (instantaneous) length of the send queue.
        
                    - name: queue_avg
                      type: double
                      description: >
                        Send queue length averaged over time since the last FLUSH STATUS command.
                        Values considerably larger than 0.0 indicate replication throttling or network throughput issue.
        
                    - name: queue_max
                      type: long
                      description: >
                        The maximum length of the send queue since the last FLUSH STATUS command.
        
                    - name: queue_min
                      type: long
                      description: >
                        The minimum length of the send queue since the last FLUSH STATUS command.
        
                - name: state
                  type: keyword
                  description: >
                    Internal Galera Cluster FSM state number.
        
            - name: ready
              type: keyword
              description: >
                Whether the server is ready to accept queries.
        
            - name: received
              type: group
              description: >
                Write-Set receive status fields.
              fields:
                - name: count
                  type: long
                  description: >
                     Total number of write-sets received from other nodes.
        
                - name: bytes
                  type: long
                  description: >
                    Total size of write-sets received from other nodes.
        
            - name: repl
              type: group
              description: >
                Replication status fields.
              fields:
                - name: data_bytes
                  type: long
                  description: >
                    Total size of data replicated.
        
                - name: keys
                  type: long
                  description: >
                    Total number of keys replicated.
        
                - name: keys_bytes
                  type: long
                  description: >
                    Total size of keys replicated.
        
                - name: other_bytes
                  type: long
                  description: >
                    Total size of other bits replicated.
        
                - name: count
                  type: long
                  description: >
                    Total number of write-sets replicated (sent to other nodes).
        
                - name: bytes
                  type: long
                  description: >
                    Total size of write-sets replicated.
        - name: performance
          type: group
          description: >
            `performance` contains metrics related to the performance of a MySQL instance
          release: beta
          fields:
            - name: events_statements
              description: Records statement events summarized by schema and digest
              type: group
              fields:
                - name: 'max.timer.wait'
                  type: long
                  description: Maximum wait time of the summarized events that are timed
                - name: 'last.seen'
                  type: date
                  description: Time at which the digest was most recently seen
                - name: 'quantile.95'
                  type: long
                  description: The 95th percentile of the statement latency, in picoseconds
                - name: digest
                  type: text
                  description: Performance schema digest
                - name: 'count.star'
                  type: long
                  description: Number of summarized events
                - name: 'avg.timer.wait'
                  type: long
                  description: Average wait time of the summarized events that are timed
            - name: table_io_waits
              type: group
              description: Records table I/O waits by index
              fields:
                - name: object
                  type: group
                  fields:
                    - name: schema
                      type: keyword
                      description: Schema name
                    - name: name
                      type: keyword
                      description: Table name
                - name: index.name
                  type: keyword
                  description: >
                    Name of the index that was used when the table I/O wait event was recorded. PRIMARY indicates that table I/O
                    used the primary index. NULL means that table I/O used no index. Inserts are counted against INDEX_NAME = NULL
                - name: count.fetch
                  type: long
                  description: Number of all fetch operations > 0
        - name: query
          type: group
          release: beta
          description: >
            `query` metricset fetches custom queries from the user to a MySQL instance.
          fields:
        - name: status
          type: group
          description: >
            `status` contains the metrics that were obtained by the status SQL query.
          release: ga
          fields:
            - name: aborted
              type: group
              description: >
                Aborted status fields.
              fields:
                - name: clients
                  type: long
                  description: >
                    The number of connections that were aborted because the client died without closing the connection properly.
        
                - name: connects
                  type: long
                  description: >
                    The number of failed attempts to connect to the MySQL server.
        
            - name: connection
              type: group
              description: >
              fields:
                - name: errors
                  type: group
                  description: >
                  fields:
                    - name: peer_address
                      type: long
                      description: The number of errors that occurred while searching for connecting client IP addresses.
                    - name: accept
                      type: long
                      description: The number of errors that occurred during calls to accept() on the listening port.
                    - name: internal
                      type: long
                      description: >
                        The number of connections refused due to internal errors in the server, such as failure to start a new
                        thread or an out-of-memory condition.
                    - name: max
                      type: long
                      description: The number of connections refused because the server max_connections limit was reached.
                        thread or an out-of-memory condition.
                    - name: tcpwrap
                      type: long
                      description: The number of connections refused by the libwrap library.
                    - name: select
                      type: long
                      description: >
                        The number of errors that occurred during calls to select() or poll() on the listening port.
                        (Failure of this operation does not necessarily means a client connection was rejected.)
        
            - name: cache
              type: group
              description: >
              fields:
                - name: ssl
                  type: group
                  description: SSL session cache hits and misses.
                  fields:
                    - name: hits
                      type: long
                      description: The number of SSL session cache hits.
                    - name: misses
                      type: long
                      description: The number of SSL session cache misses.
                    - name: size
                      type: long
                      description: The SSL session cache size.
                - name: table
                  type: group
                  description: >
                  fields:
                    - name: open_cache
                      type: group
                      description: >
                      fields:
                        - name: hits
                          type: long
                          description: The number of hits for open tables cache lookups.
                        - name: misses
                          type: long
                          description: The number of misses for open tables cache lookups.
                        - name: overflows
                          type: long
                          description: >
                            Number of times, after a table is opened or closed, a cache instance has an unused entry and the
                            size of the instance is larger than table_open_cache / table_open_cache_instances
        
            - name: binlog
              type: group
              description: >
              fields:
                - name: cache.disk_use
                  type: long
                  description: >
        
                - name: cache.use
                  type: long
                  description: >
        
            - name: bytes
              type: group
              description: >
                Bytes stats.
              fields:
                - name: received
                  format: bytes
                  type: long
                  description: >
                    The number of bytes received from all clients.
        
                - name: sent
                  type: long
                  format: bytes
                  description: >
                    The number of bytes sent to all clients.
        
            - name: threads
              type: group
              description: >
                Threads stats.
              fields:
                - name: cached
                  type: long
                  description: >
                    The number of cached threads.
        
                - name: created
                  type: long
                  description: >
                    The number of created threads.
        
                - name: connected
                  type: long
                  description: >
                    The number of connected threads.
        
                - name: running
                  type: long
                  description: >
                    The number of running threads.
        
            - name: connections
              type: long
              description: >
        
            - name: created
              type: group
              description: >
              fields:
                - name: tmp.disk_tables
                  type: long
                  description: >
        
                - name: tmp.files
                  type: long
                  description: >
        
                - name: tmp.tables
                  type: long
                  description: >
        
            - name: delayed
              type: group
              description: >
              fields:
                - name: errors
                  type: long
                  description: >
        
                - name: insert_threads
                  type: long
                  description: >
        
                - name: writes
                  type: long
                  description: >
        
            - name: flush_commands
              type: long
              description: >
        
            - name: max_used_connections
              type: long
              description: >
        
            - name: open
              type: group
              description: >
              fields:
                - name: files
                  type: long
                  description: >
        
                - name: streams
                  type: long
                  description: >
        
                - name: tables
                  type: long
                  description: >
        
            - name: opened_tables
              type: long
              description: >
        
            - name: command
              type: group
              description: >
              fields:
                - name: delete
                  type: long
                  description: >
                    The number of DELETE queries since startup.
        
                - name: insert
                  type: long
                  description: >
                    The number of INSERT queries since startup.
        
                - name: select
                  type: long
                  description: >
                    The number of SELECT queries since startup.
        
                - name: update
                  type: long
                  description: >
                    The number of UPDATE queries since startup.
        
            - name: queries
              type: long
              description: >
                The number of statements executed by the server. This variable includes statements executed within stored programs, unlike the Questions variable. It does not count COM_PING or COM_STATISTICS commands.
        
            - name: questions
              type: long
              description: >
                The number of statements executed by the server. This includes only statements sent to the server by clients and not statements executed within stored programs, unlike the Queries variable. This variable does not count COM_PING, COM_STATISTICS, COM_STMT_PREPARE, COM_STMT_CLOSE, or COM_STMT_RESET commands.
        
            - name: handler
              type: group
              description: >
              fields:
                - name: commit
                  type: long
                  description: >
                    The number of internal COMMIT statements.
        
                - name: delete
                  type: long
                  description: >
                    The number of times that rows have been deleted from tables.
        
                - name: external_lock
                  type: long
                  description: >
                    The server increments this variable for each call to its external_lock() function, which generally occurs at the beginning and end of access to a table instance.
        
                - name: mrr_init
                  type: long
                  description: >
                    The number of times the server uses a storage engine's own Multi-Range Read implementation for table access.
        
                - name: prepare
                  type: long
                  description: >
                    A counter for the prepare phase of two-phase commit operations.
        
                - name: read
                  type: group
                  description: >
                  fields:
                    - name: first
                      type: long
                      description: >
                        The number of times the first entry in an index was read.
        
                    - name: key
                      type: long
                      description: >
                        The number of requests to read a row based on a key.
        
                    - name: last
                      type: long
                      description: >
                        The number of requests to read the last key in an index.
        
                    - name: next
                      type: long
                      description: >
                        The number of requests to read the next row in key order.
        
                    - name: prev
                      type: long
                      description: >
                        The number of requests to read the previous row in key order.
        
                    - name: rnd
                      type: long
                      description: >
                        The number of requests to read a row based on a fixed position.
        
                    - name: rnd_next
                      type: long
                      description: >
                        The number of requests to read the next row in the data file.
        
                - name: rollback
                  type: long
                  description: >
                    The number of requests for a storage engine to perform a rollback operation.
        
                - name: savepoint
                  type: long
                  description: >
                    The number of requests for a storage engine to place a savepoint.
        
                - name: savepoint_rollback
                  type: long
                  description: >
                    The number of requests for a storage engine to roll back to a savepoint.
        
                - name: update
                  type: long
                  description: >
                    The number of requests to update a row in a table.
        
                - name: write
                  type: long
                  description: >
                    The number of requests to insert a row in a table.
        
            - name: innodb
              type: group
              description: >
              fields:
              - name: rows
                type: group
                description: >
                fields:
                  - name: reads
                    type: long
                    description: The number of rows reads into InnoDB tables.
                  - name: inserted
                    type: long
                    description: The number of rows inserted into InnoDB tables.
                  - name: deleted
                    type: long
                    description: The number of rows deleted into InnoDB tables.
                  - name: updated
                    type: long
                    description: The number of rows updated into InnoDB tables.
              - name: buffer_pool
                type: group
                description: >
                fields:
                  - name: dump_status
                    type: long
                    description: >
                      The progress of an operation to record the pages held in the InnoDB buffer pool, triggered by the setting of innodb_buffer_pool_dump_at_shutdown or innodb_buffer_pool_dump_now.
        
                  - name: load_status
                    type: long
                    description: >
                      The progress of an operation to warm up the InnoDB buffer pool by reading in a set of pages corresponding to an earlier point in time, triggered by the setting of innodb_buffer_pool_load_at_startup or innodb_buffer_pool_load_now.
        
                  - name: bytes
                    type: group
                    description: >
                    fields:
                      - name: data
                        type: long
                        description: >
                          The total number of bytes in the InnoDB buffer pool containing data.
        
                      - name: dirty
                        type: long
                        description: >
                          The total current number of bytes held in dirty pages in the InnoDB buffer pool.
        
                  - name: pages
                    type: group
                    description: >
                    fields:
                      - name: data
                        type: long
                        description: >
                          he number of pages in the InnoDB buffer pool containing data.
        
                      - name: dirty
                        type: long
                        description: >
                          The current number of dirty pages in the InnoDB buffer pool.
        
                      - name: flushed
                        type: long
                        description: >
                          The number of requests to flush pages from the InnoDB buffer pool.
        
                      - name: free
                        type: long
                        description: >
                          The number of free pages in the InnoDB buffer pool.
        
                      - name: latched
                        type: long
                        description: >
                          The number of latched pages in the InnoDB buffer pool.
        
                      - name: misc
                        type: long
                        description: >
                          The number of pages in the InnoDB buffer pool that are busy because they have been allocated for administrative overhead, such as row locks or the adaptive hash index.
        
                      - name: total
                        type: long
                        description: >
                          The total size of the InnoDB buffer pool, in pages.
        
                  - name: read
                    type: group
                    description: >
                    fields:
                      - name: ahead
                        type: long
                        description: >
                          The number of pages read into the InnoDB buffer pool by the read-ahead background thread.
        
                      - name: ahead_evicted
                        type: long
                        description: >
                          The number of pages read into the InnoDB buffer pool by the read-ahead background thread that were subsequently evicted without having been accessed by queries.
        
                      - name: ahead_rnd
                        type: long
                        description: >
                          The number of "random" read-aheads initiated by InnoDB.
        
                      - name: requests
                        type: long
                        description: >
                          The number of logical read requests.
        
                  - name: pool
                    type: group
                    description: >
                    fields:
                      - name: reads
                        type: long
                        description: >
                          The number of logical reads that InnoDB could not satisfy from the buffer pool, and had to read directly from disk.
        
                      - name: resize_status
                        type: long
                        description: >
                          The status of an operation to resize the InnoDB buffer pool dynamically, triggered by setting the innodb_buffer_pool_size parameter dynamically.
        
                      - name: wait_free
                        type: long
                        description: >
                          Normally, writes to the InnoDB buffer pool happen in the background. When InnoDB needs to read or create a page and no clean pages are available, InnoDB flushes some dirty pages first and waits for that operation to finish. This counter counts instances of these waits.
        
                  - name: write_requests
                    type: long
                    description: >
                      The number of writes done to the InnoDB buffer pool.
- key: nats
  title: "NATS"
  description: >
    nats Module
  release: ga
  settings: ["ssl", "http"]
  fields:
    - name: nats
      type: group
      description: >
        `nats` contains statistics that were read from Nats
      fields:
        - name: server.id
          type: keyword
          description: >
            The server ID
        - name: server.time
          type: date
          description: >
            Server time of metric creation
        - name: connections
          type: group
          description: >
            Contains nats connection related metrics
          release: ga
          fields:
            - name: total
              type: integer
              description: >
                The number of currently active clients
        - name: routes
          type: group
          description: >
            Contains nats route related metrics
          release: ga
          fields:
            - name: total
              type: integer
              description: >
                The number of registered routes
        - name: stats
          type: group
          description: >
            Contains nats var related metrics
          release: ga
          fields:
            - name: uptime
              type: long
              format: duration
              description: >
                The period the server is up (sec)
            - name: mem.bytes
              type: long
              format: bytes
              description: >
                The current memory usage of NATS process
            - name: cores
              type: integer
              description: >
                The number of logical cores the NATS process runs on
            - name: cpu
              type: scaled_float
              format: percent
              description: >
                The current cpu usage of NATs process
            - name: total_connections
              type: long
              description: >
                The number of totally created clients
            - name: remotes
              type: integer
              description: >
                The number of registered remotes
            - name: in
              type: group
              description: >
                The amount of incoming data
              fields:
                - name: messages
                  type: long
                  description: >
                    The amount of incoming messages
                - name: bytes
                  type: long
                  format: bytes
                  description: >
                    The amount of incoming bytes
            - name: out
              type: group
              description: >
                The amount of outgoing data
              fields:
                - name: messages
                  type: long
                  description: >
                    The amount of outgoing messages
                - name: bytes
                  type: long
                  format: bytes
                  description: >
                    The amount of outgoing bytes
            - name: slow_consumers
              type: long
              description: >
                The number of slow consumers currently on NATS
            - name: http
              type: group
              description: >
                The http metrics of NATS server
              fields:
                - name: req_stats
                  type: group
                  description: >
                    The requests statistics
                  fields:
                    - name: uri
                      type: group
                      description: >
                        The request distribution on monitoring URIS
                      fields:
                        - name: routez
                          type: long
                          description: >
                            The number of hits on routez monitoring uri
                        - name: connz
                          type: long
                          description: >
                            The number of hits on connz monitoring uri
                        - name: varz
                          type: long
                          description: >
                            The number of hits on varz monitoring uri
                        - name: subsz
                          type: long
                          description: >
                            The number of hits on subsz monitoring uri
                        - name: root
                          type: long
                          description: >
                            The number of hits on root monitoring uri
        - name: subscriptions
          type: group
          description: >
            Contains nats subscriptions related metrics
          release: ga
          fields:
            - name: total
              type: integer
              description: >
                The number of active subscriptions
            - name: inserts
              type: long
              description: >
                The number of insert operations in subscriptions list
            - name: removes
              type: long
              description: >
                The number of remove operations in subscriptions list
            - name: matches
              type: long
              description: >
                The number of times a match is found for a subscription
            - name: cache.size
              type: integer
              description: >
                The number of result sets in the cache
            - name: cache.hit_rate
              type: scaled_float
              format: percent
              description: >
                The rate matches are being retrieved from cache
            - name: cache.fanout.max
              type: integer
              description: >
                The maximum fanout served by cache
            - name: cache.fanout.avg
              type: double
              description: >
                The average fanout served by cache
- key: nginx
  title: "Nginx"
  description: >
    Nginx server status metrics collected from various modules.
  short_config: false
  release: ga
  settings: ["ssl", "http"]
  fields:
    - name: nginx
      type: group
      description: >
        `nginx` contains the metrics that were scraped from nginx.
      fields:
        - name: stubstatus
          type: group
          description: >
            `stubstatus` contains the metrics that were scraped from the ngx_http_stub_status_module status page.
          release: ga
          fields:
            - name: hostname
              type: keyword
              description: >
                Nginx hostname.
            - name: active
              type: long
              description: >
                The current number of active client connections including Waiting connections.
            - name: accepts
              type: long
              description: >
                The total number of accepted client connections.
            - name: handled
              type: long
              description: >
                The total number of handled client connections.
            - name: dropped
              type: long
              description: >
                The total number of dropped client connections.
            - name: requests
              type: long
              description: >
                The total number of client requests.
            - name: current
              type: long
              description: >
                The current number of client requests.
            - name: reading
              type: long
              description: >
                The current number of connections where Nginx is reading the request header.
            - name: writing
              type: long
              description: >
                The current number of connections where Nginx is writing the response back to the client.
            - name: waiting
              type: long
              description: >
                The current number of idle client connections waiting for a request.
- key: php_fpm
  title: "PHP_FPM"
  description: >
    PHP-FPM server status metrics collected from PHP-FPM.
  short_config: false
  release: ga
  settings: ["ssl", "http"]
  fields:
    - name: php_fpm
      type: group
      description: >
        `php_fpm` contains the metrics that were obtained from PHP-FPM status
        page call.
      fields:
        - name: pool
          type: group
          description: >
            `pool` contains the metrics that were obtained from the PHP-FPM process pool.
          fields:
            - name: name
              type: keyword
              description: >
                The name of the pool.
        - name: pool
          type: group
          description: >
            `pool` contains the metrics that were obtained from the PHP-FPM process
            pool.
          release: ga
          fields:
            - name: process_manager
              type: keyword
              description: >
                Static, dynamic or ondemand.
            - name: connections
              type: group
              description: >
                Connection state specific statistics.
              fields:
              - name: accepted
                type: long
                description: >
                  The number of incoming requests that the PHP-FPM server has accepted;
                  when a connection is accepted it is removed from the listen queue.
              - name: queued
                type: long
                description: >
                  The current number of connections that have been initiated, but not
                  yet accepted. If this value is non-zero it typically means that all
                  the available server processes are currently busy, and there are no
                  processes available to serve the next request. Raising
                  `pm.max_children` (provided the server can handle it) should help
                  keep this number low. This property follows from the fact that
                  PHP-FPM listens via a socket (TCP or file based), and thus inherits
                  some of the characteristics of sockets.
              - name: max_listen_queue
                type: long
                description: >
                  The maximum number of requests in the queue of pending
                  connections since FPM has started.
              - name: listen_queue_len
                type: long
                description: >
                  The size of the socket queue of pending connections.
            - name: processes
              type: group
              description: >
                Process state specific statistics.
              fields:
              - name: idle
                type: long
                description: >
                  The number of servers in the `waiting to process` state (i.e. not
                  currently serving a page). This value should fall between the
                  `pm.min_spare_servers` and `pm.max_spare_servers` values when the
                  process manager is `dynamic`.
              - name: active
                type: long
                description: >
                  The number of servers current processing a page - the minimum is `1`
                  (so even on a fully idle server, the result will be not read `0`).
              - name: total
                type: long
                description: >
                  The number of idle + active processes.
              - name: max_active
                type: long
                description: >
                  The maximum number of active processes since FPM has started.
              - name: max_children_reached
                type: long
                description: >
                  Number of times, the process limit has been reached,
                  when pm tries to start more children (works only for
                  pm 'dynamic' and 'ondemand').
            - name: slow_requests
              type: long
              description: >
                The number of times a request execution time has exceeded
                `request_slowlog_timeout`.
            - name: start_since
              type: long
              description: >
                Number of seconds since FPM has started.
            - name: start_time
              type: date
              description: >
                The date and time FPM has started.
        - name: process
          type: group
          description: >
            process contains the metrics that were obtained from the PHP-FPM process.
          release: ga
          fields:
          - name: pid
            type: alias
            path: process.pid
            migration: true
            description: >
              The PID of the process
          - name: state
            type: keyword
            description: >
              The state of the process (Idle, Running, etc)
          - name: start_time
            type: date
            description: >
              The date and time the process has started
          - name: start_since
            type: integer
            description: >
              The number of seconds since the process has started
          - name: requests
            type: integer
            description: >
              The number of requests the process has served
          - name: request_duration
            type: integer
            description: >
              The duration in microseconds (1 million in a second) of the current request (my own definition)
          - name: request_method
            type: alias
            path: http.request.method
            migration: true
            description: >
              The request method (GET, POST, etc) (of the current request)
          - name: request_uri
            type: alias
            path: url.original
            migration: true
            description: >
              The request URI with the query string (of the current request)
          - name: content_length
            type: alias
            path: http.response.body.bytes
            migration: true
            description: >
              The content length of the request (only with POST) (of the current request)
          - name: user
            type: alias
            path: user.name
            migration: true
            description: >
              The user (PHP_AUTH_USER) (or - if not set) (for the current request)
          - name: script
            type: keyword
            description: >
              The main script called (or - if not set) (for the current request)
          - name: last_request_cpu
            type: long
            description: >
              The CPU percentage the last request consumed. It's always 0 if the process is not in Idle state because CPU calculation is done when the request processing has terminated
          - name: last_request_memory
            type: integer
            description: >
              The max amount of memory the last request consumed. It's always 0 if the process is not in Idle state because memory calculation is done when the request processing has terminated
- key: postgresql
  title: "PostgreSQL"
  description: >
    Metrics collected from PostgreSQL servers.
  short_config: false
  release: ga
  fields:
    - name: postgresql
      type: group
      description: >
        PostgreSQL metrics.
      fields:
        - name: activity
          type: group
          description: >
            One document per server process, showing information related to the current
            activity of that process, such as state and current query. Collected by
            querying pg_stat_activity.
          release: ga
          fields:
            - name: database.oid
              type: long
              description: >
                OID of the database this backend is connected to.
            - name: database.name
              type: keyword
              description: >
                Name of the database this backend is connected to.
            - name: pid
              type: long
              description: >
                Process ID of this backend.
            - name: user.id
              type: long
              description: >
                OID of the user logged into this backend.
            - name: user.name
              description: >
                Name of the user logged into this backend.
            - name: application_name
              description: >
                Name of the application that is connected to this backend.
            - name: client.address
              description: >
                IP address of the client connected to this backend.
            - name: client.hostname
              description: >
                Host name of the connected client, as reported by a reverse DNS lookup of client_addr.
            - name: client.port
              type: long
              description: >
                TCP port number that the client is using for communication with this
                backend, or -1 if a Unix socket is used.
            - name: backend_start
              type: date
              description: >
                Time when this process was started, i.e., when the client connected to
                the server.
            - name: transaction_start
              type: date
              description: >
                Time when this process' current transaction was started.
            - name: query_start
              type: date
              description: >
                Time when the currently active query was started, or if state is not
                active, when the last query was started.
            - name: state_change
              type: date
              description: >
                Time when the state was last changed.
            - name: waiting
              type: boolean
              description: >
                True if this backend is currently waiting on a lock.
            - name: state
              description: >
                Current overall state of this backend. Possible values are:
        
                  * active: The backend is executing a query.
                  * idle: The backend is waiting for a new client command.
                  * idle in transaction: The backend is in a transaction, but is not
                    currently executing a query.
                  * idle in transaction (aborted): This state is similar to idle in
                    transaction, except one of the statements in the transaction caused
                    an error.
                  * fastpath function call: The backend is executing a fast-path function.
                  * disabled: This state is reported if track_activities is disabled in this backend.
            - name: query
              description: >
                Text of this backend's most recent query. If state is active this field
                shows the currently executing query. In all other states, it shows the
                last query that was executed.
        
        - name: bgwriter
          type: group
          description: >
            Statistics about the background writer process's activity. Collected using the
            pg_stat_bgwriter query.
          release: ga
          fields:
            - name: checkpoints.scheduled
              type: long
              description: >
                Number of scheduled checkpoints that have been performed.
            - name: checkpoints.requested
              type: long
              description: >
                Number of requested checkpoints that have been performed.
            - name: checkpoints.times.write.ms
              type: float
              description: >
                Total amount of time that has been spent in the portion of checkpoint
                processing where files are written to disk, in milliseconds.
            - name: checkpoints.times.sync.ms
              type: float
              description: >
                Total amount of time that has been spent in the portion of checkpoint
                processing where files are synchronized to disk, in milliseconds.
            - name: buffers.checkpoints
              type: long
              description: >
                Number of buffers written during checkpoints.
            - name: buffers.clean
              type: long
              description: >
                Number of buffers written by the background writer.
            - name: buffers.clean_full
              type: long
              description: >
                Number of times the background writer stopped a cleaning scan because it
                had written too many buffers.
            - name: buffers.backend
              type: long
              description: >
                Number of buffers written directly by a backend.
            - name: buffers.backend_fsync
              type: long
              description: >
                Number of times a backend had to execute its own fsync call (normally
                the background writer handles those even when the backend does its own
                write)
            - name: buffers.allocated
              type: long
              description: >
                Number of buffers allocated.
            - name: stats_reset
              type: date
              description: >
                Time at which these statistics were last reset.
        - name: database
          type: group
          description: >
            One row per database, showing database-wide statistics. Collected by querying
            pg_stat_database
          release: ga
          fields:
            - name: oid
              type: long
              description: >
                OID of the database this backend is connected to.
            - name: name
              type: keyword
              description: >
                Name of the database this backend is connected to.
            - name: number_of_backends
              type: long
              description: >
                Number of backends currently connected to this database.
            - name: transactions.commit
              type: long
              description: >
                Number of transactions in this database that have been committed.
            - name: transactions.rollback
              type: long
              description: >
                Number of transactions in this database that have been rolled back.
            - name: blocks.read
              type: long
              description: >
                Number of disk blocks read in this database.
            - name: blocks.hit
              type: long
              description: >
                Number of times disk blocks were found already in the buffer cache, so
                that a read was not necessary (this only includes hits in the PostgreSQL
                buffer cache, not the operating system's file system cache).
            - name: blocks.time.read.ms
              type: long
              description: >
                Time spent reading data file blocks by backends in this database, in
                milliseconds.
            - name: blocks.time.write.ms
              type: long
              description: >
                Time spent writing data file blocks by backends in this database, in
                milliseconds.
            - name: rows.returned
              type: long
              description: >
                Number of rows returned by queries in this database.
            - name: rows.fetched
              type: long
              description: >
                Number of rows fetched by queries in this database.
            - name: rows.inserted
              type: long
              description: >
                Number of rows inserted by queries in this database.
            - name: rows.updated
              type: long
              description: >
                Number of rows updated by queries in this database.
            - name: rows.deleted
              type: long
              description: >
                Number of rows deleted by queries in this database.
            - name: conflicts
              type: long
              description: >
                Number of queries canceled due to conflicts with recovery in this
                database.
            - name: temporary.files
              type: long
              description: >
                Number of temporary files created by queries in this database. All
                temporary files are counted, regardless of why the temporary file was
                created (e.g., sorting or hashing), and regardless of the log_temp_files
                setting.
            - name: temporary.bytes
              type: long
              description: >
                Total amount of data written to temporary files by queries in this
                database. All temporary files are counted, regardless of why the
                temporary file was created, and regardless of the log_temp_files
                setting.
            - name: deadlocks
              type: long
              description: >
                Number of deadlocks detected in this database.
            - name: stats_reset
              type: date
              description: >
                Time at which these statistics were last reset.
        
        - name: statement
          type: group
          description: >
            One document per query per user per database, showing information related
            invocation of that query, such as cpu usage and total time. Collected by
            querying pg_stat_statements.
          release: ga
          fields:
            - name: user.id
              type: long
              description: >
                OID of the user logged into the backend that ran the query.
            - name: database.oid
              type: long
              description: >
                OID of the database the query was run on.
            - name: query.id
              type: long
              description: >
                ID of the statement.
            - name: query.text
              description: >
                Query text
            - name: query.calls
              type: long
              description: >
                Number of times the query has been run.
            - name: query.rows
              type: long
              description: >
                Total number of rows returned by query.
            - name: query.time.total.ms
              type: float
              description: >
                Total number of milliseconds spent running query.
            - name: query.time.min.ms
              type: float
              description: >
                Minimum number of milliseconds spent running query.
            - name: query.time.max.ms
              type: float
              description: >
                Maximum number of milliseconds spent running query.
            - name: query.time.mean.ms
              type: long
              description: >
                Mean number of milliseconds spent running query.
            - name: query.time.stddev.ms
              type: long
              description: >
                Population standard deviation of time spent running query, in milliseconds.
            - name: query.memory.shared.hit
              type: long
              description: >
                Total number of shared block cache hits by the query.
            - name: query.memory.shared.read
              type: long
              description: >
                Total number of shared block cache read by the query.
            - name: query.memory.shared.dirtied
              type: long
              description: >
                Total number of shared block cache dirtied by the query.
            - name: query.memory.shared.written
              type: long
              description: >
                Total number of shared block cache written by the query.
            - name: query.memory.local.hit
              type: long
              description: >
                Total number of local block cache hits by the query.
            - name: query.memory.local.read
              type: long
              description: >
                Total number of local block cache read by the query.
            - name: query.memory.local.dirtied
              type: long
              description: >
                Total number of local block cache dirtied by the query.
            - name: query.memory.local.written
              type: long
              description: >
                Total number of local block cache written by the query.
            - name: query.memory.temp.read
              type: long
              description: >
                Total number of temp block cache read by the query.
            - name: query.memory.temp.written
              type: long
              description: >
                Total number of temp block cache written by the query.
- key: prometheus
  title: "Prometheus"
  description: >
    Stats scraped from a Prometheus endpoint.
  short_config: false
  release: ga
  settings: ["ssl", "http"]
  fields:
    - name: prometheus
      type: group
      fields:
        # Order is important here, labels will match first, the rest are double
        - name: labels.*
          type: object
          object_type: keyword
          description: >
            Prometheus metric labels
        - name: metrics.*
          type: object
          object_type: double
          object_type_mapping_type: "*"
          description: >
            Prometheus metric
        - name: query.*
          type: object
          object_type: double
          object_type_mapping_type: "*"
          description: >
            Prometheus value resulted from PromQL
        - release: ga
        - name: query
          type: group
          description: >
            query metricset
          release: ga
          fields:
        - name: remote_write
          type: group
          description: >
            remote write metrics from Prometheus server
          release: ga
          fields:
- key: rabbitmq
  title: "RabbitMQ"
  description: >
    RabbitMQ module
  release: ga
  settings: ["ssl", "http"]
  fields:
    - name: rabbitmq
      type: group
      description: >
      fields:
        - name: vhost
          type: keyword
          description: >
            Virtual host name with non-ASCII characters escaped as in C.
        - name: connection
          type: group
          description: >
            connection
          release: ga
          fields:
            - name: name
              type: keyword
              description: >
                The name of the connection with non-ASCII characters escaped as in C.
            - name: vhost
              type: alias
              path: rabbitmq.vhost
              migration: true
              description: >
                Virtual host name with non-ASCII characters escaped as in C.
            - name: user
              type: alias
              path: user.name
              migration: true
              description: >
                User name.
            - name: node
              type: alias
              path: rabbitmq.node.name
              migration: true
              description: >
                Node name.
            - name: channels
              type: long
              description: >
                The number of channels on the connection.
            - name: channel_max
              type: long
              description: >
                The maximum number of channels allowed on the connection.
            - name: frame_max
              type: long
              description: >
                Maximum permissible size of a frame (in bytes) to negotiate with clients.
              format: bytes
            - name: type
              type: keyword
              description: >
                Type of the connection.
            - name: host
              type: keyword
              description: >
                Server hostname obtained via reverse DNS, or its IP address if reverse DNS failed or was disabled.
            - name: peer.host
              type: keyword
              description: >
                Peer hostname obtained via reverse DNS, or its IP address if reverse DNS failed or was not enabled.
            - name: port
              type: long
              description: >
                Server port.
            - name: peer.port
              type: long
              description: >
                Peer port.
            - name: packet_count.sent
              type: long
              description: >
                Number of packets sent on the connection.
            - name: packet_count.received
              type: long
              description: >
                Number of packets received on the connection.
            - name: packet_count.pending
              type: long
              description: >
                Number of packets pending on the connection.
            - name: octet_count.sent
              type: long
              description: >
                Number of octets sent on the connection.
            - name: octet_count.received
              type: long
              description: >
                Number of octets received on the connection.
            - name: client_provided.name
              type: keyword
              description: >
                User specified connection name.
        - name: exchange
          type: group
          description: >
            exchange
          release: ga
          fields:
            - name: name
              type: keyword
              description: >
                The name of the queue with non-ASCII characters escaped as in C.
            - name: vhost
              type: alias
              path: rabbitmq.vhost
              migration: true
              description: >
                Virtual host name with non-ASCII characters escaped as in C.
            - name: durable
              type: boolean
              description: >
                Whether or not the queue survives server restarts.
            - name: auto_delete
              type: boolean
              description: >
                Whether the queue will be deleted automatically when no longer used.
            - name: internal
              type: boolean
              description: >
                Whether the exchange is internal, i.e. cannot be directly published to by a client.
            - name: user
              type: alias
              path: user.name
              migration: true
              description: >
                User who created the exchange.
        
            - name: messages.publish_in.count
              type: long
              description: >
                 Count of messages published "in" to an exchange, i.e. not taking account of routing.
            - name: messages.publish_in.details.rate
              type: float
              description: >
                  How much the exchange publish-in count has changed per second in the most recent sampling interval.
            - name: messages.publish_out.count
              type: long
              description: >
                 Count of messages published "out" of an exchange, i.e. taking account of routing.
            - name: messages.publish_out.details.rate
              type: float
              description: >
                  How much the exchange publish-out count has changed per second in the most recent sampling interval.
        - name: node
          type: group
          description: >
            node
          release: ga
          fields:
            - name: disk.free.bytes
              type: long
              description: >
                Disk free space in bytes.
              format: bytes
            - name: disk.free.limit.bytes
              type: long
              description: >
                Point at which the disk alarm will go off.
              format: bytes
            - name: fd.total
              type: long
              description: >
                File descriptors available.
            - name: fd.used
              type: long
              description: >
                Used file descriptors.
            - name: gc.num.count
              type: long
              description: >
                Number of GC operations.
            - name: gc.reclaimed.bytes
              type: long
              description: >
                GC bytes reclaimed.
              format: bytes
            - name: io.file_handle.open_attempt.avg.ms
              type: long
              description: >
                File handle open avg time
            - name: io.file_handle.open_attempt.count
              type: long
              description: >
                File handle open attempts
            - name: io.read.avg.ms
              type: long
              description: >
                File handle read avg time
            - name: io.read.bytes
              type: long
              description: >
                Data read in bytes
              format: bytes
            - name: io.read.count
              type: long
              description: >
                Data read operations
            - name: io.reopen.count
              type: long
              description: >
                Data reopen operations
            - name: io.seek.avg.ms
              type: long
              description: >
                Data seek avg time
            - name: io.seek.count
              type: long
              description: >
                Data seek operations
            - name: io.sync.avg.ms
              type: long
              description: >
                Data sync avg time
            - name: io.sync.count
              type: long
              description: >
                Data sync operations
            - name: io.write.avg.ms
              type: long
              description: >
                Data write avg time
            - name: io.write.bytes
              type: long
              description: >
                Data write in bytes
              format: bytes
            - name: io.write.count
              type: long
              description: >
                Data write operations
            - name: mem.limit.bytes
              type: long
              description: >
                Point at which the memory alarm will go off.
              format: bytes
            - name: mem.used.bytes
              type: long
              description: >
                Memory used in bytes.
            - name: mnesia.disk.tx.count
              type: long
              description: >
                Number of Mnesia transactions which have been performed that required writes to disk.
            - name: mnesia.ram.tx.count
              type: long
              description: >
                Number of Mnesia transactions which have been performed that did not require writes to disk.
            - name: msg.store_read.count
              type: long
              description: >
                Number of messages which have been read from the message store.
            - name: msg.store_write.count
              type: long
              description: >
                Number of messages which have been written to the message store.
            - name: name
              type: keyword
              description:
                Node name
            - name: proc.total
              type: long
              description: >
                Maximum number of Erlang processes.
            - name: proc.used
              type: long
              description: >
                Number of Erlang processes in use.
            - name: processors
              type: long
              description: >
                Number of cores detected and usable by Erlang.
            - name: queue.index.journal_write.count
              type: long
              description: >
                Number of records written to the queue index journal.
            - name: queue.index.read.count
              type: long
              description: >
                Number of records read from the queue index.
            - name: queue.index.write.count
              type: long
              description: >
                Number of records written to the queue index.
            - name: run.queue
              type: long
              description: >
                Average number of Erlang processes waiting to run.
            - name: socket.total
              type: long
              description: >
                File descriptors available for use as sockets.
            - name: socket.used
              type: long
              description: >
                File descriptors used as sockets.
            - name: type
              type: keyword
              description: >
                Node type.
            - name: uptime
              type: long
              description: >
                Node uptime.
        - name: queue
          type: group
          description: >
            queue
          release: ga
          fields:
            - name: name
              type: keyword
              description: >
                The name of the queue with non-ASCII characters escaped as in C.
            - name: vhost
              type: alias
              path: rabbitmq.vhost
              migration: true
              description: >
                Virtual host name with non-ASCII characters escaped as in C.
            - name: durable
              type: boolean
              description: >
                Whether or not the queue survives server restarts.
            - name: auto_delete
              type: boolean
              description: >
                Whether the queue will be deleted automatically when no longer used.
            - name: exclusive
              type: boolean
              description: >
                Whether the queue is exclusive (i.e. has owner_pid).
            - name: node
              type: alias
              path: rabbitmq.node.name
              migration: true
              description: >
                Node name.
            - name: state
              type: keyword
              description: >
                The state of the queue. Normally 'running', but may be "{syncing, MsgCount}" if the queue is synchronising. Queues which are located on cluster nodes that are currently down will be shown with a status of 'down'.
            - name: arguments.max_priority
              type: long
              description: >
                Maximum number of priority levels for the queue to support.
            - name: consumers.count
              type: long
              description: >
                Number of consumers.
            - name: consumers.utilisation.pct
              type: long
              format: percent
              description: >
                Fraction of the time (between 0.0 and 1.0) that the queue is able to immediately deliver messages to consumers. This can be less than 1.0 if consumers are limited by network congestion or prefetch count.
            - name: messages.total.count
              type: long
              description: >
                Sum of ready and unacknowledged messages (queue depth).
            - name: messages.total.details.rate
              type: float
              description: >
                How much the queue depth has changed per second in the most recent sampling interval.
            - name: messages.ready.count
              type: long
              description: >
                Number of messages ready to be delivered to clients.
            - name: messages.ready.details.rate
              type: float
              description: >
                How much the count of messages ready has changed per second in the most recent sampling interval.
            - name: messages.unacknowledged.count
              type: long
              description: >
                Number of messages delivered to clients but not yet acknowledged.
            - name: messages.unacknowledged.details.rate
              type: float
              description: >
                How much the count of unacknowledged messages has changed per second in the most recent sampling interval.
            - name: messages.persistent.count
              type: long
              description: >
                Total number of persistent messages in the queue (will always be 0 for transient queues).
            - name: memory.bytes
              type: long
              format: bytes
              description: >
                Bytes of memory consumed by the Erlang process associated with the queue, including stack, heap and internal structures.
            - name: disk.reads.count
              type: long
              description: >
                Total number of times messages have been read from disk by this queue since it started.
            - name: disk.writes.count
              type: long
              description: >
                Total number of times messages have been written to disk by this queue since it started.
- key: redis
  title: "Redis"
  description: >
    Redis metrics collected from Redis.
  release: ga
  fields:
    - name: redis
      type: group
      description: >
        `redis` contains the information and statistics from Redis.
      fields:
        - name: info
          type: group
          description: >
            `info` contains the information and statistics returned by the `INFO` command.
          release: ga
          fields:
            - name: clients
              type: group
              description: >
                Redis client stats.
              fields:
                - name: connected
                  type: long
                  description: >
                    Number of client connections (excluding connections from slaves).
                - name: longest_output_list
                  type: long
                  deprecated: "6.5.0"
                  description: >
                    Longest output list among current client connections (replaced by max_output_buffer).
                - name: max_output_buffer
                  type: long
                  description: >
                    Longest output list among current client connections.
                - name: biggest_input_buf
                  type: long
                  deprecated: "6.5.0"
                  description: >
                    Biggest input buffer among current client connections (replaced by max_input_buffer).
                - name: max_input_buffer
                  type: long
                  description: >
                    Biggest input buffer among current client connections (on redis 5.0).
                - name: blocked
                  type: long
                  description: >
                    Number of clients pending on a blocking call (BLPOP, BRPOP, BRPOPLPUSH).
        
            - name: cluster
              type: group
              description: >
                Redis cluster information.
              fields:
                - name: enabled
                  type: boolean
                  description: >
                    Indicates that the Redis cluster is enabled.
        
            - name: cpu
              type: group
              description: >
                Redis CPU stats
              fields:
                - name: used.sys
                  type: scaled_float
                  description: >
                    System CPU consumed by the Redis server.
                - name: used.sys_children
                  type: scaled_float
                  description: >
                    User CPU consumed by the Redis server.
                - name: used.user
                  type: scaled_float
                  description: >
                    System CPU consumed by the background processes.
                - name: used.user_children
                  type: scaled_float
                  description: >
                    User CPU consumed by the background processes.
        
            - name: memory
              type: group
              description: >
                Redis memory stats.
              fields:
                - name: used.value
                  type: long
                  format: bytes
                  description: >
                    Total number of bytes allocated by Redis.
                - name: used.rss
                  type: long
                  format: bytes
                  description: >
                    Number of bytes that Redis allocated as seen by the operating system (a.k.a resident set size).
                - name: used.peak
                  type: long
                  format: bytes
                  description: >
                    Peak memory consumed by Redis.
                - name: used.lua
                  type: long
                  format: bytes
                  description: >
                    Used memory by the Lua engine.        
                - name: used.dataset
                  type: long
                  format: bytes
                  description: >
                    The size in bytes of the dataset 
        
                - name: max.value
                  type: long
                  format: bytes
                  description: >
                    Memory limit.
                - name: max.policy
                  type: keyword
                  description: >
                    Eviction policy to use when memory limit is reached.
        
                - name: fragmentation.ratio
                  type: float
                  description: >
                    Ratio between used_memory_rss and used_memory
                - name: fragmentation.bytes
                  type: long
                  format: bytes
                  description: >
                    Bytes between used_memory_rss and used_memory
        
                - name: active_defrag.is_running
                  type: boolean
                  description: >
                    Flag indicating if active defragmentation is active
        
                - name: allocator
                  type: keyword
                  description: >
                    Memory allocator.
        
                - name: allocator_stats
                  type: group
                  fields:
                    - name: allocated
                      type: long
                      format: bytes
                      description: >
                        Allocated memory
                    - name: active
                      type: long
                      format: bytes
                      description: >
                        Active memeory
                    - name: resident
                      type: long
                      format: bytes
                      description: >
                        Resident memory
                    - name: fragmentation.ratio
                      type: float
                      description: >
                        Fragmentation ratio
                    - name: fragmentation.bytes
                      type: long
                      format: bytes
                      description: >
                        Fragmented bytes
                    - name: rss.ratio
                      type: float
                      description: >
                        Resident ratio
                    - name: rss.bytes
                      type: long
                      format: bytes
                      description: >
                        Resident bytes
        
            - name: persistence
              type: group
              description: >
                Redis CPU stats.
              fields:
                - name: loading
                  type: boolean
                  description: >
                    Flag indicating if the load of a dump file is on-going
                  # ToDo move `loading` to `loading.enabled` and add other loading stats beside that (start time, total bytes, loaded bytes, ...)
        
                - name: rdb
                  type: group
                  description: >
                    Provides information about RDB persistence
                  fields:
                    - name: last_save.changes_since
                      type: long
                      description: >
                        Number of changes since the last dump
                    - name: last_save.time
                      type: long
                      description: >
                        Epoch-based timestamp of last successful RDB save
        
                    - name: bgsave.in_progress
                      type: boolean
                      description: >
                        Flag indicating a RDB save is on-going
                    - name: bgsave.last_status
                      type: keyword
                      description: >
                        Status of the last RDB save operation
                    - name: bgsave.last_time.sec
                      type: long
                      format: duration
                      description: >
                        Duration of the last RDB save operation in seconds
                    - name: bgsave.current_time.sec
                      type: long
                      format: duration
                      description: >
                        Duration of the on-going RDB save operation if any
                    
                    - name: copy_on_write.last_size
                      type: long
                      format: bytes
                      description: >
                        The size in bytes of copy-on-write allocations during the last RBD save operation                
        
                - name: aof
                  type: group
                  description: >
                    Provides information about AOF persitence
                  fields:
                    - name: enabled
                      type: boolean
                      description: >
                        Flag indicating AOF logging is activated
        
                    - name: rewrite.in_progress
                      type: boolean
                      description: >
                        Flag indicating a AOF rewrite operation is on-going
                    - name: rewrite.scheduled
                      type: boolean
                      description: >
                        Flag indicating an AOF rewrite operation will be scheduled once the on-going RDB save is complete.
                    - name: rewrite.last_time.sec
                      type: long
                      format: duration
                      description: >
                        Duration of the last AOF rewrite operation in seconds
                    - name: rewrite.current_time.sec
                      type: long
                      format: duration
                      description: >
                        Duration of the on-going AOF rewrite operation if any
                    - name: rewrite.buffer.size
                      type: long
                      format: bytes
                      description: >
                        Size of the AOF rewrite buffer
        
                    - name: bgrewrite.last_status
                      type: keyword
                      description: >
                        Status of the last AOF rewrite operatio
        
                    - name: write.last_status
                      type: keyword
                      description: >
                        Status of the last write operation to the AOF
        
                    - name: copy_on_write.last_size
                      type: long
                      format: bytes
                      description: >
                        The size in bytes of copy-on-write allocations during the last RBD save operation
        
                    - name: buffer.size
                      type: long
                      format: bytes
                      description: >
                        Size of the AOF buffer
                    
                    - name: size.current
                      type: long
                      format: bytes
                      description: >
                        AOF current file size             
                    - name: size.base
                      type: long
                      format: bytes
                      description: >
                        AOF file size on latest startup or rewrite
        
                    - name: fsync.pending
                      type: long
                      description: >
                        Number of fsync pending jobs in background I/O queue
                    - name: fsync.delayed
                      type: long
                      description: >
                        Delayed fsync counter
        
            - name: replication
              type: group
              description: >
                Replication
              fields:
                - name: role
                  type: keyword
                  description: >
                    Role of the instance (can be "master", or "slave").
        
                - name: connected_slaves
                  type: long
                  description: >
                    Number of connected slaves
        
                - name: master_offset
                  type: long
                  deprecated: 6.5
                  description: >
                    The server's current replication offset
                
                - name: backlog.active
                  type: long
                  description: >
                    Flag indicating replication backlog is active
                - name: backlog.size
                  type: long
                  format: bytes
                  description: >
                    Total size in bytes of the replication backlog buffer
                - name: backlog.first_byte_offset
                  type: long
                  description: >
                    The master offset of the replication backlog buffer          
                - name: backlog.histlen
                  type: long
                  description: >
                    Size in bytes of the data in the replication backlog buffer
        
                - name: master.offset
                  type: long
                  description: >
                    The server's current replication offset
                - name: master.second_offset
                  type: long
                  description: >
                    The offset up to which replication IDs are accepted
                - name: master.link_status
                  type: keyword
                  description: >
                    Status of the link (up/down)
                - name: master.last_io_seconds_ago
                  type: long
                  format: duration
                  description: >
                    Number of seconds since the last interaction with master
                - name: master.sync.in_progress
                  type: boolean
                  description: >
                     Indicate the master is syncing to the slave
                - name: master.sync.left_bytes
                  type: long
                  format: bytes
                  description: >
                    Number of bytes left before syncing is complete
                - name: master.sync.last_io_seconds_ago
                  type: long
                  format: duration
                  description: >
                    Number of seconds since last transfer I/O during a SYNC operation
                
                - name: slave.offset
                  type: long
                  description: >
                    The replication offset of the slave instance
                - name: slave.priority
                  type: long
                  description: >
                    The priority of the instance as a candidate for failover
                - name: slave.is_readonly
                  type: boolean
                  description: >
                    Flag indicating if the slave is read-only
        
            - name: server
              type: group
              description: >
                Server info
              fields:
                - name: version
                  type: alias
                  path: service.version
                  migration: true
                  description:
        
                - name: git_sha1
                  type: keyword
                  description:
        
                - name: git_dirty
                  type: keyword
                  description:
        
                - name: build_id
                  type: keyword
                  description:
        
                - name: mode
                  type: keyword
                  description:
        
                - name: os
                  type: alias
                  path: os.full
                  migration: true
                  description:
        
                - name: arch_bits
                  type: keyword
                  description:
        
                - name: multiplexing_api
                  type: keyword
                  description:
        
                - name: gcc_version
                  type: keyword
                  description:
        
                - name: process_id
                  type: alias
                  path: process.pid
                  migration: true
                  description:
        
                - name: run_id
                  type: keyword
                  description:
        
                - name: tcp_port
                  type: long
                  description:
        
                - name: uptime
                  type: long
                  description:
        
                - name: hz
                  type: long
                  description:
        
                - name: lru_clock
                  type: long
                  description:
        
                - name: config_file
                  type: keyword
                  description:
        
            - name: stats
              type: group
              description: >
                Redis stats.
              fields:
                - name: connections.received
                  type: long
                  description:
                    Total number of connections received.
                - name: connections.rejected
                  type: long
                  description:
                    Total number of connections rejected.
        
                - name: commands_processed
                  type: long
                  description:
                    Total number of commands processed.
        
                - name: net.input.bytes
                  type: long
                  description:
                    Total network input in bytes.
                - name: net.output.bytes
                  type: long
                  description:
                    Total network output in bytes.
        
                - name: instantaneous.ops_per_sec
                  type: long
                  description: >
                    Number of commands processed per second
                - name: instantaneous.input_kbps
                  type: scaled_float
                  description: >
                    The network's read rate per second in KB/sec
                - name: instantaneous.output_kbps
                  type: scaled_float
                  description: >
                    The network's write rate per second in KB/sec
        
                - name: sync.full
                  type: long
                  description: >
                    The number of full resyncs with slaves
                - name: sync.partial.ok
                  type: long
                  description: >
                    The number of accepted partial resync requests
                - name: sync.partial.err
                  type: long
                  description: >
                    The number of denied partial resync requests
        
                - name: keys.expired
                  type: long
                  description: >
                    Total number of key expiration events
                - name: keys.evicted
                  type: long
                  description: >
                    Number of evicted keys due to maxmemory limit
                
                - name: keyspace.hits
                  type: long
                  description: >
                    Number of successful lookup of keys in the main dictionary
                - name: keyspace.misses
                  type: long
                  description: >
                    Number of failed lookup of keys in the main dictionary
        
                - name: pubsub.channels
                  type: long
                  description: >
                    Global number of pub/sub channels with client subscriptions
                - name: pubsub.patterns
                  type: long
                  description: >
                    Global number of pub/sub pattern with client subscriptions
        
                - name: latest_fork_usec
                  type: long
                  description: >
                    Duration of the latest fork operation in microseconds
        
                - name: migrate_cached_sockets
                  type: long
                  description: >
                    The number of sockets open for MIGRATE purposes
        
                - name: slave_expires_tracked_keys
                  type: long
                  description: >
                    The number of keys tracked for expiry purposes (applicable only to writable slaves)
        
                - name: active_defrag.hits
                  type: long
                  description: >
                    Number of value reallocations performed by active the defragmentation process
                - name: active_defrag.misses
                  type: long
                  description: >
                    Number of aborted value reallocations started by the active defragmentation process
                - name: active_defrag.key_hits
                  type: long
                  description: >
                    Number of keys that were actively defragmented
                - name: active_defrag.key_misses
                  type: long
                  description: >
                    Number of keys that were skipped by the active defragmentation process
            - name: slowlog.count
              type: long
              description: >
                Count of slow operations
        
        - name: key
          type: group
          description: >
            `key` contains information about keys.
          release: ga
          fields:
            - name: name
              type: keyword
              description: >
                Key name.
        
            - name: id
              type: keyword
              description: >
                Unique id for this key (With the form <keyspace>:<name>).
        
            - name: type
              type: keyword
              description: >
                Key type as shown by `TYPE` command.
        
            - name: length
              type: long
              description: >
                Length of the key (Number of elements for lists, length for strings, cardinality for sets).
        
            - name: expire.ttl
              type: long
              description: >
                Seconds to expire.
        - name: keyspace
          type: group
          description: >
            `keyspace` contains the information about the keyspaces returned by the `INFO` command.
          release: ga
          fields:
            - name: id
              type: keyword
              description: >
                Keyspace identifier.
        
            - name: avg_ttl
              type: long
              description: >
                Average ttl.
        
            - name: keys
              type: long
              description: >
                Number of keys in the keyspace.
        
            - name: expires
              type: long
              description: >
- key: system
  title: "System"
  description: >
    System status metrics, like CPU and memory usage, that are collected from the operating system.
  short_config: true
  release: ga
  fields:
    - name: system
      type: group
      description: >
        `system` contains local system metrics.
      fields:
        - name: core
          type: group
          description: >
            `system-core` contains CPU metrics for a single core of a multi-core system.
          release: ga
          fields:
            - name: id
              type: long
              description: >
                CPU Core number.
        
            # Percentages
            - name: user.pct
              type: scaled_float
              format: percent
              description: >
                The percentage of CPU time spent in user space.
        
            - name: user.ticks
              type: long
              description: >
               The amount of CPU time spent in user space.
        
            - name: system.pct
              type: scaled_float
              format: percent
              description: >
                The percentage of CPU time spent in kernel space.
        
            - name: system.ticks
              type: long
              description: >
                The amount of CPU time spent in kernel space.
        
            - name: nice.pct
              type: scaled_float
              format: percent
              description: >
                The percentage of CPU time spent on low-priority processes.
        
            - name: nice.ticks
              type: long
              description: >
                The amount of CPU time spent on low-priority processes.
        
            - name: idle.pct
              type: scaled_float
              format: percent
              description: >
                The percentage of CPU time spent idle.
        
            - name: idle.ticks
              type: long
              description: >
                The amount of CPU time spent idle.
        
            - name: iowait.pct
              type: scaled_float
              format: percent
              description: >
                The percentage of CPU time spent in wait (on disk).
        
            - name: iowait.ticks
              type: long
              description: >
                The amount of CPU time spent in wait (on disk).
        
            - name: irq.pct
              type: scaled_float
              format: percent
              description: >
                The percentage of CPU time spent servicing and handling hardware interrupts.
        
            - name: irq.ticks
              type: long
              description: >
                The amount of CPU time spent servicing and handling hardware interrupts.
        
            - name: softirq.pct
              type: scaled_float
              format: percent
              description: >
                The percentage of CPU time spent servicing and handling software interrupts.
        
            - name: softirq.ticks
              type: long
              description: >
                The amount of CPU time spent servicing and handling software interrupts.
        
            - name: steal.pct
              type: scaled_float
              format: percent
              description: >
                The percentage of CPU time spent in involuntary wait by the virtual CPU while the hypervisor
                was servicing another processor.
                Available only on Unix.
        
            - name: steal.ticks
              type: long
              description: >
                The amount of CPU time spent in involuntary wait by the virtual CPU while the hypervisor
                was servicing another processor.
                Available only on Unix.
        - name: cpu
          type: group
          description: >
            `cpu` contains local CPU stats.
          release: ga
          fields:
            - name: cores
              type: long
              description: >
                The number of CPU cores present on the host. The non-normalized
                percentages will have a maximum value of `100% * cores`. The
                normalized percentages already take this value into account and have
                a maximum value of 100%.
        
            # Percentages
            - name: user.pct
              type: scaled_float
              format: percent
              description: >
                The percentage of CPU time spent in user space. On multi-core systems,
                you can have percentages that are greater than 100%. For example, if 3
                cores are at 60% use, then the `system.cpu.user.pct` will be 180%.
        
            - name: system.pct
              type: scaled_float
              format: percent
              description: >
                The percentage of CPU time spent in kernel space.
        
            - name: nice.pct
              type: scaled_float
              format: percent
              description: >
                The percentage of CPU time spent on low-priority processes.
        
            - name: idle.pct
              type: scaled_float
              format: percent
              description: >
                The percentage of CPU time spent idle.
        
            - name: iowait.pct
              type: scaled_float
              format: percent
              description: >
                The percentage of CPU time spent in wait (on disk).
        
            - name: irq.pct
              type: scaled_float
              format: percent
              description: >
                The percentage of CPU time spent servicing and handling hardware interrupts.
        
            - name: softirq.pct
              type: scaled_float
              format: percent
              description: >
                The percentage of CPU time spent servicing and handling software interrupts.
        
            - name: steal.pct
              type: scaled_float
              format: percent
              description: >
                The percentage of CPU time spent in involuntary wait by the virtual CPU while the hypervisor
                was servicing another processor.
                Available only on Unix.
        
            - name: total.pct
              type: scaled_float
              format: percent
              description: >
                The percentage of CPU time spent in states other than Idle and IOWait.
        
            # Normalized Percentages
            - name: user.norm.pct
              type: scaled_float
              format: percent
              description: >
                The percentage of CPU time spent in user space.
        
            - name: system.norm.pct
              type: scaled_float
              format: percent
              description: >
                The percentage of CPU time spent in kernel space.
        
            - name: nice.norm.pct
              type: scaled_float
              format: percent
              description: >
                The percentage of CPU time spent on low-priority processes.
        
            - name: idle.norm.pct
              type: scaled_float
              format: percent
              description: >
                The percentage of CPU time spent idle.
        
            - name: iowait.norm.pct
              type: scaled_float
              format: percent
              description: >
                The percentage of CPU time spent in wait (on disk).
        
            - name: irq.norm.pct
              type: scaled_float
              format: percent
              description: >
                The percentage of CPU time spent servicing and handling hardware interrupts.
        
            - name: softirq.norm.pct
              type: scaled_float
              format: percent
              description: >
                The percentage of CPU time spent servicing and handling software interrupts.
        
            - name: steal.norm.pct
              type: scaled_float
              format: percent
              description: >
                The percentage of CPU time spent in involuntary wait by the virtual CPU while the hypervisor
                was servicing another processor.
                Available only on Unix.
        
            - name: total.norm.pct
              type: scaled_float
              format: percent
              description: >
                The percentage of CPU time in states other than Idle and IOWait, normalised by the number of cores.
        
        
            # Ticks
            - name: user.ticks
              type: long
              description: >
               The amount of CPU time spent in user space.
        
            - name: system.ticks
              type: long
              description: >
                The amount of CPU time spent in kernel space.
        
            - name: nice.ticks
              type: long
              description: >
                The amount of CPU time spent on low-priority processes.
        
            - name: idle.ticks
              type: long
              description: >
                The amount of CPU time spent idle.
        
            - name: iowait.ticks
              type: long
              description: >
                The amount of CPU time spent in wait (on disk).
        
            - name: irq.ticks
              type: long
              description: >
                The amount of CPU time spent servicing and handling hardware interrupts.
        
            - name: softirq.ticks
              type: long
              description: >
                The amount of CPU time spent servicing and handling software interrupts.
        
            - name: steal.ticks
              type: long
              description: >
                The amount of CPU time spent in involuntary wait by the virtual CPU while the hypervisor
                was servicing another processor.
                Available only on Unix.
        - name: diskio
          type: group
          description: >
            `disk` contains disk IO metrics collected from the operating system.
          release: ga
          fields:
            - name: name
              type: keyword
              example: sda1
              description: >
                The disk name.
        
            - name: serial_number
              type: keyword
              description: >
                The disk's serial number. This may not be provided by all operating
                systems.
        
            - name: read.count
              type: long
              description: >
                The total number of reads completed successfully.
        
            - name: write.count
              type: long
              description: >
                The total number of writes completed successfully.
        
            - name: read.bytes
              type: long
              format: bytes
              description: >
                The total number of bytes read successfully. On Linux this is
                the number of sectors read multiplied by an assumed sector size of 512.
        
            - name: write.bytes
              type: long
              format: bytes
              description: >
                The total number of bytes written successfully. On Linux this is
                the number of sectors written multiplied by an assumed sector size of
                512.
        
            - name: read.time
              type: long
              description: >
                The total number of milliseconds spent by all reads.
        
            - name: write.time
              type: long
              description: >
                The total number of milliseconds spent by all writes.
        
            - name: io.time
              type: long
              description: >
                The total number of of milliseconds spent doing I/Os.
        
            - name: iostat.read.request.merges_per_sec
              type: float
              description: >
                  The number of read requests merged per second that were queued to the device.
        
            - name: iostat.write.request.merges_per_sec
              type: float
              description: >
                  The number of write requests merged per second that were queued to the device.
        
            - name: iostat.read.request.per_sec
              type: float
              description: >
                  The number of read requests that were issued to the device per second
        
            - name: iostat.write.request.per_sec
              type: float
              description: >
                  The number of write requests that were issued to the device per second
        
            - name: iostat.read.per_sec.bytes
              type: float
              description: >
                  The number of Bytes read from the device per second.
              format: bytes
        
            - name: iostat.read.await
              type: float
              description: >
                  The average time spent for read requests issued to the device to be served.
        
            - name: iostat.write.per_sec.bytes
              type: float
              description: >
                  The number of Bytes write from the device per second.
              format: bytes
        
            - name: iostat.write.await
              type: float
              description: >
                  The average time spent for write requests issued to the device to be served.
        
            - name: iostat.request.avg_size
              type: float
              description: >
                  The average size (in bytes) of the requests that were issued to the device.
        
            - name: iostat.queue.avg_size
              type: float
              description: >
                  The average queue length of the requests that were issued to the device.
        
            - name: iostat.await
              type: float
              description: >
                  The average time spent for requests issued to the device to be served.
        
            - name: iostat.service_time
              type: float
              description: >
                  The average service time (in milliseconds) for I/O requests that were issued to the device.
        
            - name: iostat.busy
              type: float
              description: >
                  Percentage of CPU time during which I/O requests were issued to the device (bandwidth utilization for the device). Device saturation occurs when this value is close to 100%.
        - name: entropy
          type: group
          description: >
            Available system entropy
          release: ga
          fields:
            - name: available_bits
              type: long
              description: >
                The available bits of entropy
            - name: pct
              type: scaled_float
              format: percent
              description: >
                The percentage of available entropy, relative to the pool size of 4096
        - name: filesystem
          type: group
          description: >
            `filesystem` contains local filesystem stats.
          release: ga
          fields:
            - name: available
              type: long
              format: bytes
              description: >
                The disk space available to an unprivileged user in bytes.
            - name: device_name
              type: keyword
              description: >
                The disk name. For example: `/dev/disk1`
            - name: type
              type: keyword
              description: >
                The disk type. For example: `ext4`
            - name: mount_point
              type: keyword
              description: >
                The mounting point. For example: `/`
            - name: files
              type: long
              description: >
                The total number of file nodes in the file system.
            - name: free
              type: long
              format: bytes
              description: >
                The disk space available in bytes.
            - name: free_files
              type: long
              description: >
                The number of free file nodes in the file system.
            - name: total
              type: long
              format: bytes
              description: >
                The total disk space in bytes.
            - name: used.bytes
              type: long
              format: bytes
              description: >
                The used disk space in bytes.
            - name: used.pct
              type: scaled_float
              format: percent
              description: >
                The percentage of used disk space.
        
        
        - name: fsstat
          type: group
          description: >
            `system.fsstat` contains filesystem metrics aggregated from all mounted
            filesystems.
          release: ga
          fields:
            - name: count
              type: long
              description: Number of file systems found.
            - name: total_files
              type: long
              description: Total number of files. Not on Windows.
            - name: total_size
              format: bytes
              type: group
              description: Nested file system docs.
              fields:
                - name: free
                  type: long
                  format: bytes
                  description: >
                    Total free space.
                - name: used
                  type: long
                  format: bytes
                  description: >
                    Total used space.
                - name: total
                  type: long
                  format: bytes
                  description: >
                    Total space (used plus free).
        - name: load
          type: group
          description: >
            CPU load averages.
          release: ga
          fields:
            - name: "1"
              type: scaled_float
              scaling_factor: 100
              description: >
                Load average for the last minute.
            - name: "5"
              type: scaled_float
              scaling_factor: 100
              description: >
                Load average for the last 5 minutes.
            - name: "15"
              type: scaled_float
              scaling_factor: 100
              description: >
                Load average for the last 15 minutes.
        
            - name: "norm.1"
              type: scaled_float
              scaling_factor: 100
              description: >
                Load for the last minute divided by the number of cores.
        
            - name: "norm.5"
              type: scaled_float
              scaling_factor: 100
              description: >
                Load for the last 5 minutes divided by the number of cores.
        
            - name: "norm.15"
              type: scaled_float
              scaling_factor: 100
              description: >
                Load for the last 15 minutes divided by the number of cores.
        
            - name: "cores"
              type: long
              description: >
                The number of CPU cores present on the host.
        - name: memory
          type: group
          description: >
            `memory` contains local memory stats.
          release: ga
          fields:
            - name: total
              type: long
              format: bytes
              description: >
                Total memory.
        
            - name: used.bytes
              type: long
              format: bytes
              description: >
                Used memory.
        
            - name: free
              type: long
              format: bytes
              description: >
                The total amount of free memory in bytes. This value does not include memory consumed by system caches and
                buffers (see system.memory.actual.free).
        
            - name: used.pct
              type: scaled_float
              format: percent
              description: >
                The percentage of used memory.
        
            - name: actual
              type: group
              description: >
                Actual memory used and free.
              fields:
        
                - name: used.bytes
                  type: long
                  format: bytes
                  description: >
                    Actual used memory in bytes. It represents the difference between the total and the available memory. The
                    available memory depends on the OS. For more details, please check `system.actual.free`.
        
                - name: free
                  type: long
                  format: bytes
                  description: >
                    Actual free memory in bytes. It is calculated based on the OS. On Linux this value will be MemAvailable from /proc/meminfo, 
                    or calculated from free memory plus caches and buffers if /proc/meminfo is not available.
                    On OSX it is a sum of free memory and the inactive memory. On Windows, it is equal
                    to `system.memory.free`.
        
                - name: used.pct
                  type: scaled_float
                  format: percent
                  description: >
                    The percentage of actual used memory.
        
            - name: swap
              type: group
              prefix: "[float]"
              description: This group contains statistics related to the swap memory usage on the system.
              fields:
                - name: total
                  type: long
                  format: bytes
                  description: >
                    Total swap memory.
        
                - name: used.bytes
                  type: long
                  format: bytes
                  description: >
                    Used swap memory.
        
                - name: free
                  type: long
                  format: bytes
                  description: >
                    Available swap memory.
        
                - name: out.pages
                  type: long
                  description: count of pages swapped out
        
                - name: in.pages
                  type: long
                  description: count of pages swapped in
        
                - name: readahead.pages
                  type: long
                  description: swap readahead pages
        
                - name: readahead.cached
                  type: long
                  description: swap readahead cache hits
        
                - name: used.pct
                  type: scaled_float
                  format: percent
                  description: >
                    The percentage of used swap memory.
        
            - name: page_stats
              type: group
              description: memory page statistics
              fields:
                - name: pgscan_kswapd.pages
                  type: long
                  format: number
                  description: pages scanned by kswapd
                - name: pgscan_direct.pages
                  type: long
                  format: number
                  description: pages scanned directly
                - name: pgfree.pages
                  type: long
                  format: number
                  description: pages freed by the system
                - name: pgsteal_kswapd.pages
                  type: long
                  format: number
                  description: number of pages reclaimed by kswapd
                - name: pgsteal_direct.pages
                  type: long
                  format: number
                  description: number of pages reclaimed directly
                - name: direct_efficiency.pct
                  type: scaled_float
                  format: percent
                  description: direct reclaim efficiency percentage. A lower percentage indicates the system is struggling to reclaim memory.
                - name: kswapd_efficiency.pct
                  type: scaled_float
                  format: percent
                  description: kswapd reclaim efficiency percentage. A lower percentage indicates the system is struggling to reclaim memory.
        
            - name: hugepages
              type: group
              prefix: "[float]"
              description: This group contains statistics related to huge pages usage on the system.
              fields:
                - name: total
                  type: long
                  format: number
                  description: >
                    Number of huge pages in the pool.
        
                - name: used.bytes
                  type: long
                  format: bytes
                  description: >
                    Memory used in allocated huge pages.
        
                - name: used.pct
                  type: long
                  format: percent
                  description: >
                    Percentage of huge pages used.
        
                - name: free
                  type: long
                  format: number
                  description: >
                    Number of available huge pages in the pool.
        
                - name: reserved
                  type: long
                  format: number
                  description: >
                    Number of reserved but not allocated huge pages in the pool.
        
                - name: surplus
                  type: long
                  format: number
                  description: >
                    Number of overcommited huge pages.
        
                - name: default_size
                  type: long
                  format: bytes
                  description: >
                    Default size for huge pages.
        
                - name: swap.out
                  type: group
                  description: huge pages swapped out
                  fields:
                    - name: pages
                      type: long
                      description: pages swapped out
                    - name: fallback
                      type: long
                      description: Count of huge pages that must be split before swapout
        - name: network
          type: group
          description: >
            `network` contains network IO metrics for a single network interface.
          release: ga
          fields:
            - name: name
              type: keyword
              example: eth0
              description: >
                The network interface name.
        
            - name: out.bytes
              type: long
              format: bytes
              description: >
                The number of bytes sent.
        
            - name: in.bytes
              type: long
              format: bytes
              description: >
                The number of bytes received.
        
            - name: out.packets
              type: long
              description: >
                The number of packets sent.
        
            - name: in.packets
              type: long
              description: >
                The number or packets received.
        
            - name: in.errors
              type: long
              description: >
                The number of errors while receiving.
        
            - name: out.errors
              type: long
              description: >
                The number of errors while sending.
        
            - name: in.dropped
              type: long
              description: >
                The number of incoming packets that were dropped.
        
            - name: out.dropped
              type: long
              description: >
                The number of outgoing packets that were dropped. This value is always
                0 on Darwin and BSD because it is not reported by the operating system.
        - name: network_summary
          type: group
          release: beta
          description: >
            Metrics relating to global network activity
          fields:
            - name: ip.*
              type: object
              description: >
                IP counters
            - name: tcp.*
              type: object
              description: >
                TCP counters
            - name: udp.*
              type: object
              description: >
                UDP counters
            - name: udp_lite.*
              type: object
              description: >
                UDP Lite counters
            - name: icmp.*
              type: object
              description: >
                ICMP counters
        - name: process
          type: group
          description: >
            `process` contains process metadata, CPU metrics, and memory metrics.
          release: ga
          fields:
            - name: name
              type: alias
              path: process.name
              migration: true
            - name: state
              type: keyword
              description: >
                The process state. For example: "running".
            - name: pid
              type: alias
              path: process.pid
              migration: true
            - name: ppid
              type: alias
              path: process.ppid
              migration: true
            - name: pgid
              type: alias
              path: process.pgid
              migration: true
            - name: cmdline
              type: keyword
              description: >
                The full command-line used to start the process, including the
                arguments separated by space.
              ignore_above: 2048
            - name: username
              type: alias
              path: user.name
              migration: true
            - name: cwd
              type: alias
              path: process.working_directory
              migration: true
            - name: env
              type: object
              object_type: keyword
              description: >
                The environment variables used to start the process. The data is
                available on FreeBSD, Linux, and OS X.
            - name: cpu
              type: group
              prefix: "[float]"
              description: CPU-specific statistics per process.
              fields:
                - name: user.ticks
                  type: long
                  description: >
                    The amount of CPU time the process spent in user space.
                - name: total.value
                  type: long
                  description: >
                    The value of CPU usage since starting the process.
                - name: total.pct
                  type: scaled_float
                  format: percent
                  description: >
                    The percentage of CPU time spent by the process since the last update. Its value is similar to the
                    %CPU value of the process displayed by the top command on Unix systems.
                - name: total.norm.pct
                  type: scaled_float
                  format: percent
                  description: >
                    The percentage of CPU time spent by the process since the last event.
                    This value is normalized by the number of CPU cores and it ranges
                    from 0 to 100%.
                - name: system.ticks
                  type: long
                  description: >
                    The amount of CPU time the process spent in kernel space.
                - name: total.ticks
                  type: long
                  description: >
                    The total CPU time spent by the process.
                - name: start_time
                  type: date
                  description: >
                    The time when the process was started.
            - name: memory
              type: group
              description: Memory-specific statistics per process.
              prefix: "[float]"
              fields:
                - name: size
                  type: long
                  format: bytes
                  description: >
                    The total virtual memory the process has. On Windows this represents the Commit Charge (the total amount of memory that the memory manager has committed for a running process) value in bytes for this process.
                - name: rss.bytes
                  type: long
                  format: bytes
                  description: >
                    The Resident Set Size. The amount of memory the process occupied in main memory (RAM). On Windows this represents the current working set size, in bytes.
                - name: rss.pct
                  type: scaled_float
                  format: percent
                  description: >
                    The percentage of memory the process occupied in main memory (RAM).
                - name: share
                  type: long
                  format: bytes
                  description: >
                    The shared memory the process uses.
            - name: fd
              type: group
              description: >
                File descriptor usage metrics. This set of metrics is available for
                Linux and FreeBSD.
              prefix: "[float]"
              fields:
                - name: open
                  type: long
                  description: The number of file descriptors open by the process.
                - name: limit.soft
                  type: long
                  description: >
                    The soft limit on the number of file descriptors opened by the
                    process. The soft limit can be changed by the process at any time.
                - name: limit.hard
                  type: long
                  description: >
                    The hard limit on the number of file descriptors opened by the
                    process. The hard limit can only be raised by root.
            - name: cgroup
              type: group
              description: >
                Metrics and limits from the cgroup of which the task is a member.
                cgroup metrics are reported when the process has membership in a
                non-root cgroup. These metrics are only available on Linux.
              fields:
                - name: id
                  type: keyword
                  description: >
                    The ID common to all cgroups associated with this task.
                    If there isn't a common ID used by all cgroups this field will be
                    absent.
        
                - name: path
                  type: keyword
                  description: >
                    The path to the cgroup relative to the cgroup subsystem's mountpoint.
                    If there isn't a common path used by all cgroups this field will be
                    absent.
        
                - name: cpu
                  type: group
                  description: >
                    The cpu subsystem schedules CPU access for tasks in the cgroup.
                    Access can be controlled by two separate schedulers, CFS and RT.
                    CFS stands for completely fair scheduler which proportionally
                    divides the CPU time between cgroups based on weight. RT stands for
                    real time scheduler which sets a maximum amount of CPU time that
                    processes in the cgroup can consume during a given period.
        
                  fields:
                    - name: id
                      type: keyword
                      description: ID of the cgroup.
        
                    - name: path
                      type: keyword
                      description: >
                        Path to the cgroup relative to the cgroup subsystem's
                        mountpoint.
        
                    - name: cfs.period.us
                      type: long
                      description: >
                        Period of time in microseconds for how regularly a
                        cgroup's access to CPU resources should be reallocated.
        
                    - name: cfs.quota.us
                      type: long
                      description: >
                        Total amount of time in microseconds for which all
                        tasks in a cgroup can run during one period (as defined by
                        cfs.period.us).
        
                    - name: cfs.shares
                      type: long
                      description: >
                        An integer value that specifies a relative share of CPU time
                        available to the tasks in a cgroup. The value specified in the
                        cpu.shares file must be 2 or higher.
        
                    - name: rt.period.us
                      type: long
                      description: >
                        Period of time in microseconds for how regularly a cgroup's
                        access to CPU resources is reallocated.
        
                    - name: rt.runtime.us
                      type: long
                      description: >
                        Period of time in microseconds for the longest continuous period
                        in which the tasks in a cgroup have access to CPU resources.
        
                    - name: stats.periods
                      type: long
                      description: >
                        Number of period intervals (as specified in cpu.cfs.period.us)
                        that have elapsed.
        
                    - name: stats.throttled.periods
                      type: long
                      description: >
                        Number of times tasks in a cgroup have been throttled (that is,
                        not allowed to run because they have exhausted all of the
                        available time as specified by their quota).
        
                    - name: stats.throttled.ns
                      type: long
                      description: >
                        The total time duration (in nanoseconds) for which tasks in a
                        cgroup have been throttled.
        
                - name: cpuacct
                  type: group
                  description: CPU accounting metrics.
                  fields:
                    - name: id
                      type: keyword
                      description: ID of the cgroup.
        
                    - name: path
                      type: keyword
                      description: >
                        Path to the cgroup relative to the cgroup subsystem's
                        mountpoint.
        
                    - name: total.ns
                      type: long
                      description: >
                        Total CPU time in nanoseconds consumed by all tasks in the
                        cgroup.
        
                    - name: stats.user.ns
                      type: long
                      description: CPU time consumed by tasks in user mode.
        
                    - name: stats.system.ns
                      type: long
                      description: CPU time consumed by tasks in user (kernel) mode.
        
                    - name: percpu
                      type: object
                      object_type: long
                      description: >
                        CPU time (in nanoseconds) consumed on each CPU by all tasks in
                        this cgroup.
        
                - name: memory
                  type: group
                  description: Memory limits and metrics.
                  fields:
                    - name: id
                      type: keyword
                      description: ID of the cgroup.
        
                    - name: path
                      type: keyword
                      description: >
                        Path to the cgroup relative to the cgroup subsystem's mountpoint.
        
                    - name: mem.usage.bytes
                      type: long
                      format: bytes
                      description: >
                        Total memory usage by processes in the cgroup (in bytes).
        
                    - name: mem.usage.max.bytes
                      type: long
                      format: bytes
                      description: >
                        The maximum memory used by processes in the cgroup (in bytes).
        
                    - name: mem.limit.bytes
                      type: long
                      format: bytes
                      description: >
                        The maximum amount of user memory in bytes (including file
                        cache) that tasks in the cgroup are allowed to use.
        
                    - name: mem.failures
                      type: long
                      description: >
                        The number of times that the memory limit (mem.limit.bytes) was
                        reached.
        
                    - name: memsw.usage.bytes
                      type: long
                      format: bytes
                      description: >
                        The sum of current memory usage plus swap space used by
                        processes in the cgroup (in bytes).
        
                    - name: memsw.usage.max.bytes
                      type: long
                      format: bytes
                      description: >
                        The maximum amount of memory and swap space used by processes in
                        the cgroup (in bytes).
        
                    - name: memsw.limit.bytes
                      type: long
                      format: bytes
                      description: >
                        The maximum amount for the sum of memory and swap usage
                        that tasks in the cgroup are allowed to use.
        
                    - name: memsw.failures
                      type: long
                      description: >
                        The number of times that the memory plus swap space limit
                        (memsw.limit.bytes) was reached.
        
                    - name: kmem.usage.bytes
                      type: long
                      format: bytes
                      description: >
                        Total kernel memory usage by processes in the cgroup (in bytes).
        
                    - name: kmem.usage.max.bytes
                      type: long
                      format: bytes
                      description: >
                        The maximum kernel memory used by processes in the cgroup (in
                        bytes).
        
                    - name: kmem.limit.bytes
                      type: long
                      format: bytes
                      description: >
                        The maximum amount of kernel memory that tasks in the cgroup are
                        allowed to use.
        
                    - name: kmem.failures
                      type: long
                      description: >
                        The number of times that the memory limit (kmem.limit.bytes) was
                        reached.
        
                    - name: kmem_tcp.usage.bytes
                      type: long
                      format: bytes
                      description: >
                        Total memory usage for TCP buffers in bytes.
        
                    - name: kmem_tcp.usage.max.bytes
                      type: long
                      format: bytes
                      description: >
                        The maximum memory used for TCP buffers by processes in the
                        cgroup (in bytes).
        
                    - name: kmem_tcp.limit.bytes
                      type: long
                      format: bytes
                      description: >
                        The maximum amount of memory for TCP buffers that tasks in the
                        cgroup are allowed to use.
        
                    - name: kmem_tcp.failures
                      type: long
                      description: >
                        The number of times that the memory limit (kmem_tcp.limit.bytes)
                        was reached.
        
                    - name: stats.active_anon.bytes
                      type: long
                      format: bytes
                      description: >
                        Anonymous and swap cache on active least-recently-used (LRU)
                        list, including tmpfs (shmem), in bytes.
        
                    - name: stats.active_file.bytes
                      type: long
                      format: bytes
                      description: File-backed memory on active LRU list, in bytes.
        
                    - name: stats.cache.bytes
                      type: long
                      format: bytes
                      description: Page cache, including tmpfs (shmem), in bytes.
        
                    - name: stats.hierarchical_memory_limit.bytes
                      type: long
                      format: bytes
                      description: >
                        Memory limit for the hierarchy that contains the memory cgroup,
                        in bytes.
        
                    - name: stats.hierarchical_memsw_limit.bytes
                      type: long
                      format: bytes
                      description: >
                        Memory plus swap limit for the hierarchy that contains the
                        memory cgroup, in bytes.
        
                    - name: stats.inactive_anon.bytes
                      type: long
                      format: bytes
                      description: >
                        Anonymous and swap cache on inactive LRU list, including tmpfs
                        (shmem), in bytes
        
                    - name: stats.inactive_file.bytes
                      type: long
                      format: bytes
                      description: >
                        File-backed memory on inactive LRU list, in bytes.
        
                    - name: stats.mapped_file.bytes
                      type: long
                      format: bytes
                      description: >
                        Size of memory-mapped mapped files, including tmpfs (shmem),
                        in bytes.
        
                    - name: stats.page_faults
                      type: long
                      description: >
                        Number of times that a process in the cgroup triggered a page
                        fault.
        
                    - name: stats.major_page_faults
                      type: long
                      description: >
                        Number of times that a process in the cgroup triggered a major
                        fault. "Major" faults happen when the kernel actually has to
                        read the data from disk.
        
                    - name: stats.pages_in
                      type: long
                      description: >
                        Number of pages paged into memory. This is a counter.
        
                    - name: stats.pages_out
                      type: long
                      description: >
                        Number of pages paged out of memory. This is a counter.
        
                    - name: stats.rss.bytes
                      type: long
                      format: bytes
                      description: >
                        Anonymous and swap cache (includes transparent hugepages), not
                        including tmpfs (shmem), in bytes.
        
                    - name: stats.rss_huge.bytes
                      type: long
                      format: bytes
                      description: >
                        Number of bytes of anonymous transparent hugepages.
        
                    - name: stats.swap.bytes
                      type: long
                      format: bytes
                      description: >
                        Swap usage, in bytes.
        
                    - name: stats.unevictable.bytes
                      type: long
                      format: bytes
                      description: >
                        Memory that cannot be reclaimed, in bytes.
        
                - name: blkio
                  type: group
                  description: Block IO metrics.
                  fields:
                    - name: id
                      type: keyword
                      description: ID of the cgroup.
        
                    - name: path
                      type: keyword
                      description: >
                        Path to the cgroup relative to the cgroup subsystems mountpoint.
        
                    - name: total.bytes
                      type: long
                      format: bytes
                      description: >
                        Total number of bytes transferred to and from all block devices
                        by processes in the cgroup.
        
                    - name: total.ios
                      type: long
                      description: >
                        Total number of I/O operations performed on all devices
                        by processes in the cgroup as seen by the throttling policy.
        - name: process.summary
          title: Process Summary
          type: group
          description: >
            Summary metrics for the processes running on the host.
          release: ga
          fields:
            - name: total
              type: long
              description: >
                Total number of processes on this host.
            - name: running
              type: long
              description: >
                Number of running processes on this host.
            - name: idle
              type: long
              description: >
                Number of idle processes on this host.
            - name: sleeping
              type: long
              description: >
                Number of sleeping processes on this host.
            - name: stopped
              type: long
              description: >
                Number of stopped processes on this host.
            - name: zombie
              type: long
              description: >
                Number of zombie processes on this host.
            - name: dead
              type: long
              description: >
                Number of dead processes on this host. It's very unlikely that it will appear but in some special situations it may happen.
            - name: unknown
              type: long
              description: >
                Number of processes for which the state couldn't be retrieved or is unknown.
        - name: raid
          type: group
          description: >
            raid
          release: ga
          fields:
            - name: name
              type: keyword
              description: >
                Name of the device.
            - name: status
              type: keyword
              description: >
                activity-state of the device.
            - name: level
              type: keyword
              description: >
                The raid level of the device
            - name: sync_action
              type: keyword
              description: >
                Current sync action, if the RAID array is redundant 
            - name: disks.active
              type: long
              description: >
                 Number of active disks.
            - name: disks.total
              type: long
              description: >
                Total number of disks the device consists of.
            - name: disks.spare
              type: long
              description: >
                 Number of spared disks.
            - name: disks.failed
              type: long
              description: >
                 Number of failed disks.
            - name: disks.states.*
              type: object
              object_type: keyword
              description: >
                 map of raw disk states
            - name: blocks.total
              type: long
              description: >
                Number of blocks the device holds, in 1024-byte blocks.
            - name: blocks.synced
              type: long
              description: >
                Number of blocks on the device that are in sync, in 1024-byte blocks.
        - name: service
          type: group
          release: beta
          description: >
            metrics for system services
          fields:
            - name: name
              type: keyword
              description: The name of the service
            - name: load_state
              type: keyword
              description: The load state of the service
            - name: state
              type: keyword
              description: The activity state of the service
            - name: sub_state
              type: keyword
              description: The sub-state of the service
            - name: state_since
              type: date
              description: The timestamp of the last state change. If the service is active and running, this is its uptime.
            - name: exec_code
              type: keyword
              description: The SIGCHLD code from the service's main process
            - name: resources
              type: group
              description: system metrics associated with the service
              fields:
                - name: cpu.usage.ns
                  type: long
                  description: CPU usage in nanoseconds
                - name: memory.usage.bytes
                  type: long
                  description: memory usage in bytes
                - name: tasks.count
                  type: long
                  description: number of tasks associated with the service
                - name: network
                  type: group
                  description: network resource usage
                  fields:
                    - name: in.bytes
                      type: long
                      format: bytes
                      description: bytes in
                    - name: in.packets
                      type: long
                      format: bytes
                      description: packets in
                    - name: out.packets
                      type: long
                      description: packets out
                    - name: out.bytes
                      type: long
                      description: bytes out
        
        - name: socket
          type: group
          description: >
            TCP sockets that are active.
          release: ga
          fields:
            - name: direction
              type: alias
              path: network.direction
              migration: true
        
            - name: family
              type: alias
              path: network.type
              migration: true
        
            - name: local.ip
              type: ip
              example: 192.0.2.1 or 2001:0DB8:ABED:8536::1
              description: >
                Local IP address. This can be an IPv4 or IPv6 address.
        
            - name: local.port
              type: long
              example: 22
              description: >
                Local port.
        
            - name: remote.ip
              type: ip
              example: 192.0.2.1 or 2001:0DB8:ABED:8536::1
              description: >
                Remote IP address. This can be an IPv4 or IPv6 address.
        
            - name: remote.port
              type: long
              example: 22
              description: >
                Remote port.
        
            - name: remote.host
              type: keyword
              example: 76-211-117-36.nw.example.com.
              description: >
                PTR record associated with the remote IP. It is obtained via reverse
                IP lookup.
        
            - name: remote.etld_plus_one
              type: keyword
              example: example.com.
              description: >
               The effective top-level domain (eTLD) of the remote host plus one more
               label. For example, the eTLD+1 for "foo.bar.golang.org." is "golang.org.".
               The data for determining the eTLD comes from an embedded copy of the data
               from http://publicsuffix.org.
        
            - name: remote.host_error
              type: keyword
              description: >
                Error describing the cause of the reverse lookup failure.
        
            - name: process.pid
              type: alias
              path: process.pid
              migration: true
        
            - name: process.command
              type: alias
              path: process.name
              migration: true
        
            - name: process.cmdline
              type: keyword
              description: >
                Full command line
        
            - name: process.exe
              type: alias
              path: process.executable
              migration: true
        
            - name: user.id
              type: alias
              path: user.id
              migration: true
        
            - name: user.name
              type: alias
              path: user.full_name
              migration: true
        - name: socket.summary
          title: Socket summary
          type: group
          description: >
            Summary metrics of open sockets in the host system
          release: ga
          fields:
            - name: all
              type: group
              description: >
                All connections
              fields:
                - name: count
                  type: integer
                  description: >
                    All open connections
                - name: listening
                  type: integer
                  description: >
                    All listening ports
            - name: tcp
              type: group
              description: >
                All TCP connections
              fields:
                - name: memory
                  type: integer
                  format: bytes
                  description: >
                    Memory used by TCP sockets in bytes, based on number of allocated pages and system page size. Corresponds to limits set in /proc/sys/net/ipv4/tcp_mem. Only available on Linux. 
                - name: all
                  type: group
                  description: >
                    All TCP connections
                  fields:
                    - name: orphan
                      type: integer
                      description: >
                        A count of all orphaned tcp sockets. Only available on Linux.
                    - name: count
                      type: integer
                      description: >
                        All open TCP connections
                    - name: listening
                      type: integer
                      description: >
                        All TCP listening ports
                    - name: established
                      type: integer
                      description: >
                        Number of established TCP connections
                    - name: close_wait
                      type: integer
                      description: >
                        Number of TCP connections in _close_wait_ state
                    - name: time_wait
                      type: integer
                      description: >
                        Number of TCP connections in _time_wait_ state
            - name: udp
              type: group
              description: >
                All UDP connections
              fields:
                - name: memory
                  type: integer
                  format: bytes
                  description: >
                    Memory used by UDP sockets in bytes, based on number of allocated pages and system page size. Corresponds to limits set in /proc/sys/net/ipv4/udp_mem. Only available on Linux. 
                - name: all
                  type: group
                  description: >
                    All UDP connections
                  fields:
                    - name: count
                      type: integer
                      description: >
                        All open UDP connections
        
        
        
        - name: uptime
          type: group
          description: >
            `uptime` contains the operating system uptime metric.
          release: ga
          fields:
            - name: duration.ms
              type: long
              format: duration
              input_format: milliseconds
              description: >
                The OS uptime in milliseconds.
        - name: users
          type: group
          release: beta
          description: >
            Logged-in user session data
          fields:
            - name: id
              type: keyword
              description: >
                The ID of the session
            - name: seat
              type: keyword
              description: >
                An associated logind seat
            - name: path
              type: keyword
              description: >
                The DBus object path of the session
            - name: type
              type: keyword
              description: >
                The type of the user session
            - name: service
              type: keyword
              description: >
                A session associated with the service
            - name: remote
              type: boolean
              description: >
                A bool indicating a remote session
            - name: state
              type: keyword
              description: >
                The current state of the session
            - name: scope
              type: keyword
              description: >
                The associated systemd scope
            - name: leader
              type: long
              description: >
                The root PID of the session
            - name: remote_host
              type: keyword
              description: >
                  A remote host address for the session
        
        
- key: traefik
  title: "Traefik"
  description: >
    Traefik reverse proxy / load balancer metrics
  release: ga
  settings: ["ssl", "http"]
  fields:
    - name: traefik
      type: group
      description: >
        Traefik reverse proxy / load balancer metrics
      fields:
        - name: health
          type: group
          description: >
            Metrics obtained from Traefik's health API endpoint
          release: ga
          fields:
            - name: uptime.sec
              type: long
              description: >
                Uptime of Traefik instance in seconds
            - name: response
              type: group
              description: >
                Response metrics
              fields:
                - name: count
                  type: long
                  description: >
                    Number of responses
                - name: avg_time.us
                  type: long
                  description: >
                    Average response time in microseconds
                - name: status_codes.*
                  type: object
                  object_type: long
                  description: >
                    Number of responses per status code
- key: uwsgi
  title: "uWSGI"
  description: >
    uwsgi module
  release: ga
  fields:
    - name: uwsgi
      type: group
      description: >
      fields:
        - name: status
          type: group
          release: ga
          description: >
            uwsgi.status metricset fields
          fields:
            - name: total.requests
              type: long
              description: >
                Total requests handled
            - name: total.exceptions
              type: long
              description: >
                Total exceptions
            - name: total.write_errors
              type: long
              description: >
                Total requests write errors
            - name: total.read_errors
              type: long
              description: >
                Total read errors
            - name: total.pid
              type: long
              description: >
                Process id
            - name: worker.id
              type: long
              description: >
                Worker id
            - name: worker.pid
              type: long
              description: >
                Worker process id
            - name: worker.accepting
              type: long
              description: >
                State of worker, 1 if still accepting new requests otherwise 0
            - name: worker.requests
              type: long
              description: >
                Number of requests served by this worker
            - name: worker.delta_requests
              type: long
              description: >
                Number of requests served by this worker after worker is reloaded when reached MAX_REQUESTS
            - name: worker.exceptions
              type: long
              description: >
                Exceptions raised
            - name: worker.harakiri_count
              type: long
              description: >
                Dropped requests by timeout
            - name: worker.signals
              type: long
              description: >
                Emitted signals count
            - name: worker.signal_queue
              type: long
              description: >
                Number of signals waiting to be handled
            - name: worker.status
              type: keyword
              description: >
                Worker status (cheap, pause, sig, busy, idle)
            - name: worker.rss
              type: keyword
              description: >
                Resident Set Size. memory currently used by a process. if always zero try `--memory-report` option of uwsgi
            - name: worker.vsz
              type: long
              description: >
                Virtual Set Size. memory size assigned to a process. if always zero try `--memory-report` option of uwsgi
            - name: worker.running_time
              type: long
              description: >
                Process running time
            - name: worker.respawn_count
              type: long
              description: >
                Respawn count
            - name: worker.tx
              type: long
              description: >
                Transmitted size
            - name: worker.avg_rt
              type: long
              description: >
                Average response time
            - name: core.id
              type: long
              description: >
                worker ID
            - name: core.worker_pid
              type: long
              description: >
                Parent worker PID
            - name: core.requests.total
              type: long
              description: >
                Number of total requests served
            - name: core.requests.static
              type: long
              description: >
                Number of static file serves
            - name: core.requests.routed
              type: long
              description: >
                Routed requests
            - name: core.requests.offloaded
              type: long
              description: >
                Offloaded requests
            - name: core.write_errors
              type: long
              description: >
                Number of failed writes
            - name: core.read_errors
              type: long
              description: >
                Number of failed reads
- key: vsphere
  title: "vSphere"
  description: >
    vSphere module
  release: ga
  fields:
    - name: vsphere
      type: group
      description: >
      fields:
        - name: datastore
          type: group
          description: >
            datastore
          release: ga
          fields:
            - name: name
              type: keyword
              description: >
                Datastore name
            - name: fstype
              type: keyword
              description: >
                Filesystem type
            - name: capacity.total.bytes
              type: long
              description: >
                Total bytes of the datastore
              format: bytes
            - name: capacity.free.bytes
              type: long
              description: >
                Free bytes of the datastore
              format: bytes
            - name: capacity.used.bytes
              type: long
              description: >
                Used bytes of the datastore
              format: bytes
            - name: capacity.used.pct
              type: scaled_float
              description: >
                Used percent of the datastore
              format: percent
        
        - name: host
          type: group
          description: >
            host
          release: ga
          fields:
            - name: name
              type: keyword
              description: >
                Host name
            - name: cpu.used.mhz
              type: long
              description: >
                Used CPU in Mhz
            - name: cpu.total.mhz
              type: long
              description: >
                Total CPU in Mhz
            - name: cpu.free.mhz
              type: long
              description: >
                Free CPU in Mhz
            - name: memory.used.bytes
              type: long
              description: >
                Used Memory in bytes
              format: bytes
            - name: memory.total.bytes
              type: long
              description: >
                Total Memory in bytes
              format: bytes
            - name: memory.free.bytes
              type: long
              description: >
                Free Memory in bytes
              format: bytes
            - name: network_names
              type: keyword
              description: >
                Network names
        - name: virtualmachine
          type: group
          description: >
            virtualmachine
          release: ga
          fields:
            - name: host.id
              type: keyword
              description: >
                Host id
            - name: host.hostname
              type: keyword
              description: >
                Host name of the host
            - name: name
              type: keyword
              description: >
                Virtual Machine name
            - name: os
              type: keyword
              description: >
                Virtual Machine Operating System name
            - name: cpu.used.mhz
              type: long
              description: >
                Used CPU in Mhz
            - name: memory.used.guest.bytes
              type: long
              description: >
                Used Memory of Guest in bytes
              format: bytes
            - name: memory.used.host.bytes
              type: long
              description: >
                Used Memory of Host in bytes
              format: bytes
            - name: memory.total.guest.bytes
              type: long
              description: >
                Total Memory of Guest in bytes
              format: bytes
            - name: memory.free.guest.bytes
              type: long
              description: >
                Free Memory of Guest in bytes
              format: bytes
            - name: custom_fields
              type: object
              object_type: keyword
              description: >
                Custom fields
            - name: network_names
              type: keyword
              description: >
                Network names
- key: windows
  title: "Windows"
  description: >
    Module for Windows
  short_config: false
  release: ga
  fields:
    - name: windows
      type: group
      description: >
      fields:
        - name: perfmon
          type: group
          release: ga
          description: >
            perfmon
          fields:
          - name: instance
            type: keyword
            description: |
              Instance value.
          - name: metrics.*.*
            type: object
            object_type: float
            object_type_mapping_type: "*"
            description: >
              Metric values returned.
        
        - name: service
          type: group
          description: >
            `service` contains the status for Windows services.
          release: ga
          fields:
            - name: id
              type: keyword
              example: hW3NJFc1Ap
              description: >
                A unique ID for the service. It is a hash of the machine's GUID and the
                service name.
        
            - name: name
              type: keyword
              example: Wecsvc
              description: >
                The service name.
        
            - name: display_name
              type: keyword
              example: Windows Event Collector
              description: >
                The display name of the service.
        
            - name: start_type
              type: keyword
              description: >
                The startup type of the service. The possible values are `Automatic`,
                `Boot`, `Disabled`, `Manual`, and `System`.
        
            - name: start_name
              type: keyword
              example: NT AUTHORITY\LocalService
              description: >
                Account name under which a service runs.
        
            - name: path_name
              type: keyword
              example: C:\WINDOWS\system32\svchost.exe -k LocalService -p
              description: >
                Fully qualified path to the file that implements the service,
                including arguments.
        
            - name: state
              type: keyword
              description: >
                The actual state of the service. The possible values are `Continuing`,
                `Pausing`, `Paused`, `Running`, `Starting`, `Stopping`, and `Stopped`.
        
            - name: exit_code
              type: keyword
              description: >
                For `Stopped` services this is the error code that service reports
                when starting to stopping. This will be the generic Windows service
                error code unless the service provides a service-specific error code.
        
            - name: pid
              type: long
              example: 1092
              description: >
                For `Running` services this is the associated process PID.
        
            - name: uptime.ms
              type: long
              format: duration
              input_format: milliseconds
              description: >
                The service's uptime specified in milliseconds.
- key: zookeeper
  title: "ZooKeeper"
  description: >
    ZooKeeper metrics collected by the four-letter monitoring commands.
  short_config: false
  release: ga
  fields:
    - name: zookeeper
      type: group
      description: >
        `zookeeper` contains the metrics reported by ZooKeeper
        commands.
      fields:
        - name: connection
          type: group
          release: ga
          description: >
            connections
          fields:
            - name: interest_ops
              type: long
              description: >
                Interest ops
            - name: queued
              type: long
              description: >
                Queued connections
            - name: received
              type: long
              description: >
                Received connections
            - name: sent
              type: long
              description: >
                Connections sent
        - name: mntr
          type: group
          description: >
            `mntr` contains the metrics reported by the four-letter `mntr`
            command.
          release: ga
          fields:
            - name: hostname
              type: keyword
              description: >
                ZooKeeper hostname.
            - name: approximate_data_size
              type: long
              description: >
                Approximate size of ZooKeeper data.
            - name: latency.avg
              type: long
              description: >
                Average latency between ensemble hosts in milliseconds.
            - name: ephemerals_count
              type: long
              description: >
                Number of ephemeral znodes.
            - name: followers
              type: long
              description: >
                Number of followers seen by the current host.
            - name: max_file_descriptor_count
              type: long
              description: >
                Maximum number of file descriptors allowed for the ZooKeeper process.
            - name: latency.max
              type: long
              description: >
                Maximum latency in milliseconds.
            - name: latency.min
              type: long
              description: >
                Minimum latency in milliseconds.
            - name: num_alive_connections
              type: long
              description: >
                Number of connections to ZooKeeper that are currently alive.
            - name: open_file_descriptor_count
              type: long
              description: >
                Number of file descriptors open by the ZooKeeper process.
            - name: outstanding_requests
              type: long
              description: >
                Number of outstanding requests that need to be processed by the cluster.
            - name: packets.received
              type: long
              description: >
                Number of ZooKeeper network packets received.
            - name: packets.sent
              type: long
              description: >
                Number of ZooKeeper network packets sent.
            - name: pending_syncs
              type: long
              description: >
                Number of pending syncs to carry out to ZooKeeper ensemble followers.
            - name: server_state
              type: keyword
              description: >
                Role in the ZooKeeper ensemble.
            - name: synced_followers
              type: long
              description: >
                Number of synced followers reported when a node server_state is leader.
            - name: version
              type: alias
              path: service.version
              description: >
                ZooKeeper version and build string reported.
            - name: watch_count
              type: long
              description: >
                Number of watches currently set on the local ZooKeeper process.
            - name: znode_count
              type: long
              description: >
                Number of znodes reported by the local ZooKeeper process.
        - name: server
          type: group
          description: 'server contains the metrics reported by the four-letter `srvr` command.'
          release: ga
          fields:
            - name: connections
              type: long
              description: Number of clients currently connected to the server
            - name: latency
              type: group
              fields:
                - name: avg
                  type: long
                  description: Average amount of time taken for the server to respond to a client request
                - name: max
                  type: long
                  description: Maximum amount of time taken for the server to respond to a client request
                - name: min
                  type: long
                  description: Minimum amount of time taken for the server to respond to a client request
            - name: mode
              type: keyword
              description: Mode of the server. In an ensemble, this may either be leader or follower. Otherwise, it is standalone
            - name: node_count
              type: long
              description: Total number of nodes
            - name: outstanding
              type: long
              description: Number of requests queued at the server. This exceeds zero when the server receives more requests than it is able to process
            - name: received
              type: long
              description: Number of requests received by the server
            - name: sent
              type: long
              description: Number of requests sent by the server
            - name: version_date
              type: date
              description: Date of the Zookeeper release currently in use
            - name: zxid
              type: keyword
              description: Unique value of the Zookeeper transaction ID. The zxid consists of an epoch and a counter. It is established by the leader and is used to determine the temporal ordering of changes
            - name: count
              type: long
              description: Total transactions of the leader in epoch
            - name: epoch
              type: long
              description: Epoch value of the Zookeeper transaction ID. An epoch signifies the period in which a server is a leader
