- key: common
  title: Common
  description: >
      These fields contain data about the environment in which the
      transaction or flow was captured.
  fields:
    - name: server
      description: >
        The name of the server that served the transaction.

    - name: client_server
      description: >
        The name of the server that initiated the transaction.

    - name: service
      description: >
        The name of the logical service that served the transaction.

    - name: client_service
      description: >
        The name of the logical service that initiated the transaction.

    - name: ip
      description: >
        The IP address of the server that served the transaction.
      format: dotted notation.

    - name: client_ip
      description: >
        The IP address of the server that initiated the transaction.
      format: dotted notation.

    - name: real_ip
      description: >
        If the server initiating the transaction is a proxy, this field
        contains the original client IP address.
        For HTTP, for example, the IP address extracted from a configurable
        HTTP header, by default `X-Forwarded-For`.

        Unless this field is disabled, it always has a value, and it matches
        the `client_ip` for non proxy clients.
      format: Dotted notation.

    - name: client_geoip
      description: The GeoIP information of the client.
      type: group
      fields:
        - name: location
          type: geo_point
          example: {lat: 51, lon: 9}
          description: >
            The GeoIP location of the `client_ip` address. This field is available
            only if you define a
            https://www.elastic.co/guide/en/elasticsearch/plugins/master/using-ingest-geoip.html[GeoIP Processor] as a pipeline in the
            https://www.elastic.co/guide/en/elasticsearch/plugins/master/ingest-geoip.html[Ingest GeoIP processor plugin] or using Logstash.

    - name: client_port
      description: >
        The layer 4 port of the process that initiated the transaction.
      format: dotted notation.

    - name: transport
      description: >
        The transport protocol used for the transaction. If not specified, then
        tcp is assumed.
      example: udp

    - name: type
      description: >
        The type of the transaction (for example, HTTP, MySQL, Redis, or RUM) or "flow" in case of flows.
      required: true

    - name: port
      description: >
        The layer 4 port of the process that served the transaction.
      format: dotted notation.

    - name: proc
      description: >
        The name of the process that served the transaction.

    - name: cmdline
      description: >
        The command-line of the process that served the transaction.

    - name: client_proc
      description: >
        The name of the process that initiated the transaction.

    - name: client_cmdline
      description: >
        The command-line of the process that initiated the transaction.

    - name: release
      description: >
        The software release of the service serving the transaction.
        This can be the commit id or a semantic version.

- key: flows_event
  title: "Flow Event"
  description: >
    These fields contain data about the flow itself.
  fields:
    - name: "start_time"
      type: date
      required: true
      format: YYYY-MM-DDTHH:MM:SS.milliZ
      example: 2015-01-24T14:06:05.071Z
      description: >
        The time, the first packet for the flow has been seen.

    - name: "last_time"
      type: date
      required: true
      format: YYYY-MM-DDTHH:MM:SS.milliZ
      example: 2015-01-24T14:06:05.071Z
      description: >
        The time, the most recent processed packet for the flow has been seen.

    - name: final
      description: >
        Indicates if event is last event in flow. If final is false, the event
        reports an intermediate flow state only.

    - name: flow_id
      description: >
        Internal flow id based on connection meta data and address.

    - name: vlan
      description: >
        Innermost VLAN address used in network packets.

    - name: outer_vlan
      description: >
        Second innermost VLAN address used in network packets.


    - name: source
      type: group
      description: >
        Properties of the source host
      fields:
        - name: mac
          description: >
            Source MAC address as indicated by first packet seen for the current flow.

        - name: ip
          description: >
            Innermost IPv4 source address as indicated by first packet seen for the
            current flow.

        - name: ip_location
          type: geo_point
          example: "40.715, -74.011"
          description: >
            The GeoIP location of the `ip_source` IP address. The field is a string
            containing the latitude and longitude separated by a comma.

        - name: outer_ip
          description: >
            Second innermost IPv4 source address as indicated by first packet seen
            for the current flow.

        - name: outer_ip_location
          type: geo_point
          example: "40.715, -74.011"
          description: >
            The GeoIP location of the `outer_ip_source` IP address. The field is a
            string containing the latitude and longitude separated by a comma.

        - name: ipv6
          description: >
            Innermost IPv6 source address as indicated by first packet seen for the
            current flow.

        - name: ipv6_location
          type: geo_point
          example: "60.715, -76.011"
          description: >
            The GeoIP location of the `ipv6_source` IP address. The field is a string
            containing the latitude and longitude separated by a comma.

        - name: outer_ipv6
          description: >
            Second innermost IPv6 source address as indicated by first packet seen
            for the current flow.

        - name: outer_ipv6_location
          type: geo_point
          example: "60.715, -76.011"
          description: >
            The GeoIP location of the `outer_ipv6_source` IP address. The field is a
            string containing the latitude and longitude separated by a comma.

        - name: port
          description: >
            Source port number as indicated by first packet seen for the current flow.

        - name: stats
          type: group
          description: >
            Object with source to destination flow measurements.
          fields:
            - name: net_packets_total
              type: long
              description: >
                Total number of packets

            - name: net_bytes_total
              type: long
              description: >
                Total number of bytes



    - name: dest
      type: group
      description: >
        Properties of the destination host
      fields:
        - name: mac
          description: >
            Destination MAC address as indicated by first packet seen for the current flow.

        - name: ip
          description: >
            Innermost IPv4 destination address as indicated by first packet seen for the
            current flow.

        - name: ip_location
          type: geo_point
          example: "40.715, -74.011"
          description: >
            The GeoIP location of the `ip_dest` IP address. The field is a string
            containing the latitude and longitude separated by a comma.

        - name: outer_ip
          description: >
            Second innermost IPv4 destination address as indicated by first packet
            seen for the current flow.

        - name: outer_ip_location
          type: geo_point
          example: "40.715, -74.011"
          description: >
            The GeoIP location of the `outer_ip_dest` IP address. The field is a
            string containing the latitude and longitude separated by a comma.

        - name: ipv6
          description: >
            Innermost IPv6 destination address as indicated by first packet seen for the
            current flow.

        - name: ipv6_location
          type: geo_point
          example: "60.715, -76.011"
          description: >
            The GeoIP location of the `ipv6_dest` IP address. The field is a string
            containing the latitude and longitude separated by a comma.

        - name: outer_ipv6
          description: >
            Second innermost IPv6 destination address as indicated by first packet
            seen for the current flow.

        - name: outer_ipv6_location
          type: geo_point
          example: "60.715, -76.011"
          description: >
            The GeoIP location of the `outer_ipv6_dest` IP address. The field is a
            string containing the latitude and longitude separated by a comma.

        - name: port
          description: >
            Destination port number as indicated by first packet seen for the current flow.

        - name: stats
          type: group
          description: >
            Object with destination to source flow measurements.
          fields:
            - name: net_packets_total
              type: long
              description: >
                Total number of packets

            - name: net_bytes_total
              type: long
              description: >
                Total number of bytes
    - name: icmp_id
      description: >
        ICMP id used in ICMP based flow.

    - name: connection_id
      description: >
        optional TCP connection id

- key: trans_event
  title: "Transaction Event"
  description: >
    These fields contain data about the transaction itself.
  fields:

    - name: direction
      required: true
      description: >
        Indicates whether the transaction is inbound (emitted by server)
        or outbound (emitted by the client). Values can be in or out. No defaults.
      possible_values:
        - in
        - out

    - name: status
      description: >
        The high level status of the transaction. The way to compute this
        value depends on the protocol, but the result has a meaning
        independent of the protocol.
      required: true
      possible_values:
        - OK
        - Error
        - Server Error
        - Client Error

    - name: method
      description: >
        The command/verb/method of the transaction. For HTTP, this is the
        method name (GET, POST, PUT, and so on), for SQL this is the verb (SELECT,
        UPDATE, DELETE, and so on).

    - name: resource
      description: >
        The logical resource that this transaction refers to. For HTTP, this is
        the URL path up to the last slash (/). For example, if the URL is `/users/1`,
        the resource is `/users`. For databases, the resource is typically the
        table name. The field is not filled for all transaction types.

    - name: path
      required: true
      description: >
        The path the transaction refers to. For HTTP, this is the URL.
        For SQL databases, this is the table name. For key-value stores, this
        is the key.

    - name: query
      type: keyword
      description: >
        The query in a human readable format. For HTTP, it will typically be
        something like `GET /users/_search?name=test`. For MySQL, it is
        something like `SELECT id from users where name=test`.

    - name: params
      type: text
      description: >
        The request parameters. For HTTP, these are the POST or GET parameters.
        For Thrift-RPC, these are the parameters from the request.

    - name: notes
      description: >
        Messages from Packetbeat itself. This field usually contains error messages for
        interpreting the raw data. This information can be helpful for troubleshooting.

- key: raw
  title: Raw
  description: These fields contain the raw transaction data.
  fields:
    - name: request
      type: text
      description: >
        For text protocols, this is the request as seen on the wire
        (application layer only). For binary protocols this is our
        representation of the request.

    - name: response
      type: text
      description: >
        For text protocols, this is the response as seen on the wire
        (application layer only). For binary protocols this is our
        representation of the request.

- key: trans_measurements
  title: "Measurements (Transactions)"
  description: >
    These fields contain measurements related to the transaction.
  fields:
    - name: responsetime
      description: >
        The wall clock time it took to complete the transaction.
        The precision is in milliseconds.
      type: long

    - name: cpu_time
      description: The CPU time it took to complete the transaction.
      type: long

    - name: bytes_in
      description: >
        The number of bytes of the request. Note that this size is
        the application layer message length, without the length of the IP or
        TCP headers.
      type: long
      format: bytes

    - name: bytes_out
      description: >
        The number of bytes of the response. Note that this size is
        the application layer message length, without the length of the IP or
        TCP headers.
      type: long
      format: bytes

    - name: dnstime
      type: long
      description: >
        The time it takes to query the name server for a given request.
        This is typically used for RUM (real-user-monitoring) but can
        also have values for server-to-server communication when DNS
        is used for service discovery.
        The precision is in microseconds.

    - name: connecttime
      type: long
      description: >
        The time it takes for the TCP connection to be established for
        the given transaction.
        The precision is in microseconds.

    - name: loadtime
      type: long
      description: >
        The time it takes for the content to be loaded. This is typically
        used for RUM (real-user-monitoring) but it can make sense in other
        cases as well.
        The precision is in microseconds.

    - name: domloadtime
      type: long
      description: >
        In RUM (real-user-monitoring), the total time it takes for the
        DOM to be loaded. In terms of the W3 Navigation Timing API, this is
        the difference between `domContentLoadedEnd` and
        `domContentLoadedStart`.


- key: beat
  title: Beat
  description: >
    Contains common beat fields available in all event types.
  fields:

    - name: beat.name
      description: >
        The name of the Beat sending the log messages. If the Beat name is
        set in the configuration file, then that value is used. If it is not
        set, the hostname is used. To set the Beat name, use the `name`
        option in the configuration file.
    - name: beat.hostname
      description: >
        The hostname as returned by the operating system on which the Beat is
        running.
    - name: beat.timezone
      description: >
        The timezone as returned by the operating system on which the Beat is
        running.
    - name: beat.version
      description: >
        The version of the beat that generated this event.

    - name: "@timestamp"
      type: date
      required: true
      format: date
      example: August 26th 2016, 12:35:53.332
      description: >
        The timestamp when the event log record was generated.

    - name: tags
      description: >
        Arbitrary tags that can be set per Beat and per transaction
        type.

    - name: fields
      type: object
      object_type: keyword
      description: >
        Contains user configurable fields.

    - name: error
      type: group
      description: >
        Error fields containing additional info in case of errors.
      fields:
        - name: message
          type: text
          description: >
            Error message.
        - name: code
          type: long
          description: >
            Error code.
        - name: type
          type: keyword
          description: >
            Error type.

- key: alias
  title: Alias
  description: >
    Alias fields for compatibility with 7.x.
  fields:
    # Common Beats fields
    - name: host.hostname
      type: alias
      path: beat.hostname
    - name: event.timezone
      type: alias
      path: beat.timezone

    # Cloud processor fields
    - name: cloud.provider
      type: alias
      path: meta.cloud.provider
    - name: cloud.instance.id
      type: alias
      path: meta.cloud.instance_id
    - name: cloud.instance.name
      type: alias
      path: meta.cloud.instance_name
    - name: cloud.machine.type
      type: alias
      path: meta.cloud.machine_type
    - name: cloud.availability_zone
      type: alias
      path: meta.cloud.availability_zone
    - name: cloud.project.id
      type: alias
      path: meta.cloud.project_id
    - name: cloud.region
      type: alias
      path: meta.cloud.region

    # Docker processor fields
    - name: container.id
      type: alias
      path: docker.container.id
    - name: container.name
      type: alias
      path: docker.container.name
    - name: container.image.name
      type: alias
      path: docker.container.image
- key: cloud
  title: Cloud provider metadata
  description: >
    Metadata from cloud providers added by the add_cloud_metadata processor.
  fields:

    - name: meta.cloud.provider
      example: ec2
      description: >
        Name of the cloud provider. Possible values are ec2, gce, or digitalocean.

    - name: meta.cloud.instance_id
      description: >
        Instance ID of the host machine.

    - name: meta.cloud.instance_name
      description: >
        Instance name of the host machine.

    - name: meta.cloud.machine_type
      example: t2.medium
      description: >
        Machine type of the host machine.

    - name: meta.cloud.availability_zone
      example: us-east-1c
      description: >
        Availability zone in which this host is running.

    - name: meta.cloud.project_id
      example: project-x
      description: >
        Name of the project in Google Cloud.

    - name: meta.cloud.region
      description: >
        Region in which this host is running.
- key: docker
  title: Docker
  description: >
    Docker stats collected from Docker.
  short_config: false
  anchor: docker-processor
  fields:
    - name: docker
      type: group
      fields:
        - name: container.id
          type: keyword
          description: >
            Unique container id.
        - name: container.image
          type: keyword
          description: >
            Name of the image the container was built on.
        - name: container.name
          type: keyword
          description: >
            Container name.
        - name: container.labels
          type: object
          object_type: keyword
          description: >
            Image labels.
- key: host
  title: Host
  description: >
    Info collected for the host machine.
  anchor: host-processor
  fields:
    - name: host
      type: group
      fields:
        - name: name
          type: keyword
          description: >
            Hostname.
        - name: id
          type: keyword
          description: >
            Unique host id.
        - name: architecture
          type: keyword
          description: >
            Host architecture (e.g. x86_64, arm, ppc, mips).
        - name: containerized
          type: boolean
          description: >
            If the host is a container.
        - name: os.platform
          type: keyword
          description: >
            OS platform (e.g. centos, ubuntu, windows).
        - name: os.name
          type: keyword
          description: >
            Operating system name (e.g. "Mac OS X").
        - name: os.build
          type: keyword
          description: >
            OS build information (e.g. "18D109").
        - name: os.version
          type: keyword
          description: >
            OS version.
        - name: os.family
          type: keyword
          description: >
            OS family (e.g. redhat, debian, freebsd, windows).
        - name: ip
          type: ip
          description: >
            List of IP-addresses.
        - name: mac
          type: keyword
          description: >
            List of hardware-addresses, usually MAC-addresses.
- key: kubernetes
  title: Kubernetes
  description: >
    Kubernetes metadata added by the kubernetes processor
  short_config: false
  anchor: kubernetes-processor
  fields:
    - name: kubernetes
      type: group
      fields:
        - name: pod.name
          type: keyword
          description: >
            Kubernetes pod name

        - name: pod.uid
          type: keyword
          description: >
            Kubernetes Pod UID

        - name: namespace
          type: keyword
          description: >
            Kubernetes namespace

        - name: node.name
          type: keyword
          description: >
            Kubernetes node name

        - name: labels
          type: object
          description: >
            Kubernetes labels map

        - name: annotations
          type: object
          description: >
            Kubernetes annotations map

        - name: container.name
          type: keyword
          description: >
            Kubernetes container name

        - name: container.image
          type: keyword
          description: >
            Kubernetes container image
- key: amqp
  title: "AMQP"
  description: AMQP specific event fields.
  fields:
    - name: amqp
      type: group
      fields:
        - name: reply-code
          type: long
          description: >
            AMQP reply code to an error, similar to http reply-code
          example: 404

        - name: reply-text
          type: keyword
          description: >
            Text explaining the error.

        - name: class-id
          type: long
          description: >
            Failing method class.

        - name: method-id
          type: long
          description: >
            Failing method ID.

        - name: exchange
          type: keyword
          description: >
            Name of the exchange.

        - name: exchange-type
          type: keyword
          description: >
            Exchange type.
          example: fanout

        - name: passive
          type: boolean
          description: >
            If set, do not create exchange/queue.

        - name: durable
          type: boolean
          description: >
            If set, request a durable exchange/queue.

        - name: exclusive
          type: boolean
          description: >
            If set, request an exclusive queue.

        - name: auto-delete
          type: boolean
          description: >
            If set, auto-delete queue when unused.

        - name: no-wait
          type: boolean
          description: >
            If set, the server will not respond to the method.

        - name: consumer-tag
          description: >
            Identifier for the consumer, valid within the current channel.

        - name: delivery-tag
          type: long
          description: >
            The server-assigned and channel-specific delivery tag.

        - name: message-count
          type: long
          description: >
            The number of messages in the queue, which will be zero for
            newly-declared queues.

        - name: consumer-count
          type: long
          description: >
            The number of consumers of a queue.

        - name: routing-key
          type: keyword
          description: >
            Message routing key.

        - name: no-ack
          type: boolean
          description: >
            If set, the server does not expect acknowledgements for messages.

        - name: no-local
          type: boolean
          description: >
            If set, the server will not send messages to the connection that
            published them.

        - name: if-unused
          type: boolean
          description: >
            Delete only if unused.

        - name: if-empty
          type: boolean
          description: >
            Delete only if empty.

        - name: queue
          type: keyword
          description: >
            The queue name identifies the queue within the vhost.

        - name: redelivered
          type: boolean
          description: >
            Indicates that the message has been previously delivered to this
            or another client.

        - name: multiple
          type: boolean
          description: >
            Acknowledge multiple messages.

        - name: arguments
          type: object
          description: >
            Optional additional arguments passed to some methods. Can be of
            various types.

        - name: mandatory
          type: boolean
          description: >
            Indicates mandatory routing.

        - name: immediate
          type: boolean
          description: >
            Request immediate delivery.

        - name: content-type
          type: keyword
          description: >
            MIME content type.
          example: text/plain

        - name: content-encoding
          type: keyword
          description: >
            MIME content encoding.

        - name: headers
          type: object
          object_type: keyword
          description: >
            Message header field table.

        - name: delivery-mode
          type: keyword
          description: >
            Non-persistent (1) or persistent (2).

        - name: priority
          type: long
          description: >
            Message priority, 0 to 9.

        - name: correlation-id
          type: keyword
          description: >
            Application correlation identifier.

        - name: reply-to
          type: keyword
          description: >
            Address to reply to.

        - name: expiration
          type: keyword
          description: >
            Message expiration specification.

        - name: message-id
          type: keyword
          description: >
            Application message identifier.

        - name: timestamp
          type: keyword
          description: >
            Message timestamp.

        - name: type
          type: keyword
          description: >
            Message type name.

        - name: user-id
          type: keyword
          description: >
            Creating user id.

        - name: app-id
          type: keyword
          description: >
            Creating application id.

- key: cassandra
  title: "Cassandra"
  description: Cassandra v4/3 specific event fields.
  fields:
    - name: cassandra
      type: group
      description: Information about the Cassandra request and response.
      fields:
        - name: request
          type: group
          description: Cassandra request.
          fields:
            - name: headers
              type: group
              description: Cassandra request headers.
              fields:
                - name: version
                  type: long
                  description: The version of the protocol.
                - name: flags
                  type: keyword
                  description: Flags applying to this frame.
                - name: stream
                  type: keyword
                  description:  A frame has a stream id.  If a client sends a request message with the stream id X, it is guaranteed that the stream id of the response to that message will be X.
                - name: op
                  type: keyword
                  description: An operation type that distinguishes the actual message.
                - name: length
                  type: long
                  description: A integer representing the length of the body of the frame (a frame is limited to 256MB in length).
            - name: query
              type: keyword
              description: The CQL query which client send to cassandra.

        - name: response
          type: group
          description: Cassandra response.
          fields:
            - name: headers
              type: group
              description: Cassandra response headers, the structure is as same as request's header.
              fields:
                - name: version
                  type: long
                  description: The version of the protocol.
                - name: flags
                  type: keyword
                  description: Flags applying to this frame.
                - name: stream
                  type: keyword
                  description:  A frame has a stream id.  If a client sends a request message with the stream id X, it is guaranteed that the stream id of the response to that message will be X.
                - name: op
                  type: keyword
                  description: An operation type that distinguishes the actual message.
                - name: length
                  type: long
                  description: A integer representing the length of the body of the frame (a frame is limited to 256MB in length).


            - name: result
              type: group
              description: Details about the returned result.
              fields:
                - name: type
                  type: keyword
                  description: Cassandra result type.
                - name: rows
                  type: group
                  description: Details about the rows.
                  fields:
                    - name: num_rows
                      type: long
                      description: Representing the number of rows present in this result.
                    - name: meta
                      type: group
                      description: Composed of result metadata.
                      fields:
                        - name: keyspace
                          type: keyword
                          description: Only present after set Global_tables_spec, the keyspace name.
                        - name: table
                          type: keyword
                          description: Only present after set Global_tables_spec, the table name.
                        - name: flags
                          type: keyword
                          description: Provides information on the formatting of the remaining information.
                        - name: col_count
                          type: long
                          description: Representing the number of columns selected by the query that produced this result.
                        - name: pkey_columns
                          type: long
                          description: Representing the PK columns index and counts.
                        - name: paging_state
                          type: keyword
                          description: The paging_state is a bytes value that should be used in QUERY/EXECUTE to continue paging and retrieve the remainder of the result for this query.
                - name: keyspace
                  type: keyword
                  description: Indicating the name of the keyspace that has been set.
                - name: schema_change
                  type: group
                  description: The result to a schema_change message.
                  fields:
                    - name: change
                      type: keyword
                      description:  Representing the type of changed involved.
                    - name: keyspace
                      type: keyword
                      description: This describes which keyspace has changed.
                    - name: table
                      type: keyword
                      description: This describes which table has changed.
                    - name: object
                      type: keyword
                      description: This describes the name of said affected object (either the table, user type, function, or aggregate name).
                    - name: target
                      type: keyword
                      description: Target could be "FUNCTION" or "AGGREGATE", multiple arguments.
                    - name: name
                      type: keyword
                      description: The function/aggregate name.
                    - name: args
                      type: keyword
                      description: One string for each argument type (as CQL type).
                - name: prepared
                  type: group
                  description: The result to a PREPARE message.
                  fields:
                    - name: prepared_id
                      type: keyword
                      description: Representing the prepared query ID.
                    - name: req_meta
                      type: group
                      description: This describes the request metadata.
                      fields:
                        - name: keyspace
                          type: keyword
                          description: Only present after set Global_tables_spec, the keyspace name.
                        - name: table
                          type: keyword
                          description: Only present after set Global_tables_spec, the table name.
                        - name: flags
                          type: keyword
                          description: Provides information on the formatting of the remaining information.
                        - name: col_count
                          type: long
                          description: Representing the number of columns selected by the query that produced this result.
                        - name: pkey_columns
                          type: long
                          description: Representing the PK columns index and counts.
                        - name: paging_state
                          type: keyword
                          description: The paging_state is a bytes value that should be used in QUERY/EXECUTE to continue paging and retrieve the remainder of the result for this query.
                    - name: resp_meta
                      type: group
                      description: This describes the metadata for the result set.
                      fields:
                        - name: keyspace
                          type: keyword
                          description: Only present after set Global_tables_spec, the keyspace name.
                        - name: table
                          type: keyword
                          description: Only present after set Global_tables_spec, the table name.
                        - name: flags
                          type: keyword
                          description: Provides information on the formatting of the remaining information.
                        - name: col_count
                          type: long
                          description: Representing the number of columns selected by the query that produced this result.
                        - name: pkey_columns
                          type: long
                          description: Representing the PK columns index and counts.
                        - name: paging_state
                          type: keyword
                          description: The paging_state is a bytes value that should be used in QUERY/EXECUTE to continue paging and retrieve the remainder of the result for this query.

            - name: supported
              type: object
              object_type: keyword
              description:  Indicates which startup options are supported by the server. This message comes as a response to an OPTIONS message.

            - name: authentication
              type: group
              description:  Indicates that the server requires authentication, and which authentication mechanism to use.
              fields:
              - name: class
                type: keyword
                description: Indicates the full class name of the IAuthenticator in use


            - name: warnings
              type: keyword
              description: The text of the warnings, only occur when Warning flag was set.

            - name: event
              type: group
              description: Event pushed by the server. A client will only receive events for the types it has REGISTERed to.
              fields:
                - name: type
                  type: keyword
                  description: Representing the event type.
                - name: change
                  type: keyword
                  description: The message corresponding respectively to the type of change followed by the address of the new/removed node.
                - name: host
                  type: keyword
                  description: Representing the node ip.
                - name: port
                  type: long
                  description: Representing the node port.
                - name: schema_change
                  type: group
                  description: The events details related to schema change.
                  fields:
                    - name: change
                      type: keyword
                      description:  Representing the type of changed involved.
                    - name: keyspace
                      type: keyword
                      description: This describes which keyspace has changed.
                    - name: table
                      type: keyword
                      description: This describes which table has changed.
                    - name: object
                      type: keyword
                      description: This describes the name of said affected object (either the table, user type, function, or aggregate name).
                    - name: target
                      type: keyword
                      description: Target could be "FUNCTION" or "AGGREGATE", multiple arguments.
                    - name: name
                      type: keyword
                      description: The function/aggregate name.
                    - name: args
                      type: keyword
                      description: One string for each argument type (as CQL type).


            - name: error
              type: group
              description: Indicates an error processing a request. The body of the message will be an  error code followed by a error message. Then, depending on the exception, more content may follow.
              fields:
                - name: code
                  type: long
                  description: The error code of the Cassandra response.

                - name: msg
                  type: keyword
                  description: The error message of the Cassandra response.

                - name: type
                  type: keyword
                  description: The error type of the Cassandra response.

                - name: details
                  type: group
                  description: The details of the error.
                  fields:
                    - name: read_consistency
                      type: keyword
                      description:  Representing the consistency level of the query that triggered the exception.

                    - name: required
                      type: long
                      description:  Representing the number of nodes that should be alive to respect consistency level.

                    - name: alive
                      type: long
                      description:  Representing the number of replicas that were known to be alive when the request had been processed (since an unavailable exception has been triggered).

                    - name: received
                      type: long
                      description:  Representing the number of nodes having acknowledged the request.

                    - name: blockfor
                      type: long
                      description:  Representing the number of replicas whose acknowledgement is required to achieve consistency level.

                    - name: write_type
                      type: keyword
                      description:  Describe the type of the write that timed out.

                    - name: data_present
                      type: boolean
                      description:  It means the replica that was asked for data had responded.

                    - name: keyspace
                      type: keyword
                      description:  The keyspace of the failed function.

                    - name: table
                      type: keyword
                      description:  The keyspace of the failed function.

                    - name: stmt_id
                      type: keyword
                      description:  Representing the unknown ID.

                    - name: num_failures
                      type: keyword
                      description:  Representing the number of nodes that experience a failure while executing the request.

                    - name: function
                      type: keyword
                      description:  The name of the failed function.

                    - name: arg_types
                      type: keyword
                      description:  One string for each argument type (as CQL type) of the failed function.


- key: dhcpv4
  title: "DHCPv4"
  description: DHCPv4 event fields
  fields:
    - name: dhcpv4
      type: group
      fields:
        - name: transaction_id
          type: keyword
          description: |
            Transaction ID, a random number chosen by the
            client, used by the client and server to associate
            messages and responses between a client and a
            server.

        - name: seconds
          type: long
          description: |
            Number of seconds elapsed since client began address acquisition or
            renewal process.

        - name: flags
          type: keyword
          description: |
            Flags are set by the client to indicate how the DHCP server should
            its reply -- either unicast or broadcast.

        - name: client_ip
          type: ip
          description: The current IP address of the client.

        - name: assigned_ip
          type: ip
          description: |
            The IP address that the DHCP server is assigning to the client.
            This field is also known as "your" IP address.

        - name: server_ip
          type: ip
          description: |
            The IP address of the DHCP server that the client should use for the
            next step in the bootstrap process.

        - name: relay_ip
          type: ip
          description: |
            The relay IP address used by the client to contact the server
            (i.e. a DHCP relay server).

        - name: client_mac
          type: keyword
          description: The client's MAC address (layer two).

        - name: server_name
          type: keyword
          description: |
            The name of the server sending the message. Optional. Used in
            DHCPOFFER or DHCPACK messages.

        - name: op_code
          type: keyword
          example: bootreply
          description: |
            The message op code (bootrequest or bootreply).

        - name: hops
          type: long
          description: The number of hops the DHCP message went through.

        - name: hardware_type
          type: keyword
          description: |
            The type of hardware used for the local network (Ethernet,
            LocalTalk, etc).

        - name: option
          type: group
          fields:
            - name: message_type
              type: keyword
              example: ack
              description: |
                The specific type of DHCP message being sent (e.g. discover,
                offer, request, decline, ack, nak, release, inform).

            - name: parameter_request_list
              type: keyword
              description: |
                This option is used by a DHCP client to request values for
                specified configuration parameters.

            - name: requested_ip_address
              type: ip
              description: |
                This option is used in a client request (DHCPDISCOVER) to allow
                the client to request that a particular IP address be assigned.

            - name: server_identifier
              type: ip
              description: |
                IP address of the individual DHCP server which handled this
                message.

            - name: broadcast_address
              type: ip
              description: |
                This option specifies the broadcast address in use on the
                client's subnet.

            - name: max_dhcp_message_size
              type: long
              description: |
                This option specifies the maximum length DHCP message that the
                client is willing to accept.

            - name: class_identifier
              type: keyword
              description: |
                This option is used by DHCP clients to optionally identify the
                vendor type and configuration of a DHCP client. Vendors may
                choose to define specific vendor class identifiers to convey
                particular configuration or other identification information
                about a client.  For example, the identifier may encode the
                client's hardware configuration.

            - name: domain_name
              type: keyword
              description: |
                This option specifies the domain name that client should use
                when resolving hostnames via the Domain Name System.

            - name: dns_servers
              type: ip
              description: |
                The domain name server option specifies a list of Domain Name
                System servers available to the client.

            - name: vendor_identifying_options
              type: object
              description: |
                A DHCP client may use this option to unambiguously identify the
                vendor that manufactured the hardware on which the client is
                running, the software in use, or an industry consortium to which
                the vendor belongs. This field is described in RFC 3925.

            - name: subnet_mask
              type: ip
              description: |
                The subnet mask that the client should use on the currnet
                network.

            - name: utc_time_offset_sec
              type: long
              description: |
                The time offset field specifies the offset of the client's
                subnet in seconds from Coordinated Universal Time (UTC).

            - name: router
              type: ip
              description: |
                The router option specifies a list of IP addresses for routers
                on the client's subnet.

            - name: time_servers
              type: ip
              description: |
                The time server option specifies a list of RFC 868 time servers
                available to the client.

            - name: ntp_servers
              type: ip
              description: |
                This option specifies a list of IP addresses indicating NTP
                servers available to the client.

            - name: hostname
              type: keyword
              description: |
                This option specifies the name of the client.

            - name: ip_address_lease_time_sec
              type: long
              description: |
                This option is used in a client request (DHCPDISCOVER or
                DHCPREQUEST) to allow the client to request a lease time for the
                IP address.  In a server reply (DHCPOFFER), a DHCP server uses
                this option to specify the lease time it is willing to offer.

            - name: message
              type: text
              description: |
                This option is used by a DHCP server to provide an error message
                to a DHCP client in a DHCPNAK message in the event of a failure.
                A client may use this option in a DHCPDECLINE message to
                indicate the why the client declined the offered parameters.

            - name: renewal_time_sec
              type: long
              description: |
                This option specifies the time interval from address assignment
                until the client transitions to the RENEWING state.

            - name: rebinding_time_sec
              type: long
              description: |
                This option specifies the time interval from address assignment
                until the client transitions to the REBINDING state.

            - name: boot_file_name
              type: keyword
              description: |
                This option is used to identify a bootfile when the 'file' field
                in the DHCP header has been used for DHCP options.
- key: dns
  title: "DNS"
  description: DNS-specific event fields.
  fields:
    - name: dns
      type: group
      fields:
        - name: id
          type: long
          description: >
            The DNS packet identifier assigned by the program that generated the
            query. The identifier is copied to the response.

        - name: op_code
          description: >
            The DNS operation code that specifies the kind of query in the message.
            This value is set by the originator of a query and copied into the
            response.
          example: QUERY

        - name: flags.authoritative
          type: boolean
          description: >
            A DNS flag specifying that the responding server is an authority for
            the domain name used in the question.

        - name: flags.recursion_available
          type: boolean
          description: >
            A DNS flag specifying whether recursive query support is available in the
            name server.

        - name: flags.recursion_desired
          type: boolean
          description: >
            A DNS flag specifying that the client directs the server to pursue a
            query recursively. Recursive query support is optional.

        - name: flags.authentic_data
          type: boolean
          description: >
            A DNS flag specifying that the recursive server considers the response
            authentic.

        - name: flags.checking_disabled
          type: boolean
          description: >
            A DNS flag specifying that the client disables the server
            signature validation of the query.

        - name: flags.truncated_response
          type: boolean
          description: >
            A DNS flag specifying that only the first 512 bytes of the reply were
            returned.

        - name: response_code
          description: The DNS status code.
          example: NOERROR

        - name: question.name
          description: >
            The domain name being queried. If the name field contains non-printable
            characters (below 32 or above 126), then those characters are represented
            as escaped base 10 integers (\DDD). Back slashes and quotes are escaped.
            Tabs, carriage returns, and line feeds are converted to \t, \r, and
            \n respectively.
          example: www.google.com.

        - name: question.type
          description: The type of records being queried.
          example: AAAA

        - name: question.class
          description: The class of of records being queried.
          example: IN

        - name: question.etld_plus_one
          description: The effective top-level domain (eTLD) plus one more label.
            For example, the eTLD+1 for "foo.bar.golang.org." is "golang.org.".
            The data for determining the eTLD comes from an embedded copy of the
            data from http://publicsuffix.org.
          example: amazon.co.uk.

        - name: answers
          type: object
          description: >
            An array containing a dictionary about each answer section returned by
            the server.

        - name: answers_count
          type: long
          description: >
            The number of resource records contained in the `dns.answers` field.


        - name: answers.name
          description: The domain name to which this resource record pertains.
          example: example.com.

        - name: answers.type
          description: The type of data contained in this resource record.
          example: MX

        - name: answers.class
          description: The class of DNS data contained in this resource record.
          example: IN

        - name: answers.ttl
          description: >
            The time interval in seconds that this resource record may be cached
            before it should be discarded. Zero values mean that the data should
            not be cached.
          type: long

        - name: answers.data
          description: >
            The data describing the resource. The meaning of this data depends
            on the type and class of the resource record.

        - name: authorities
          type: object
          description: >
            An array containing a dictionary for each authority section from the
            answer.

        - name: authorities_count
          type: long
          description: >
            The number of resource records contained in the `dns.authorities` field.
            The `dns.authorities` field may or may not be included depending on the
            configuration of Packetbeat.

        - name: authorities.name
          description: The domain name to which this resource record pertains.
          example: example.com.

        - name: authorities.type
          description: The type of data contained in this resource record.
          example: NS

        - name: authorities.class
          description: The class of DNS data contained in this resource record.
          example: IN

        - name: additionals
          type: object
          description: >
            An array containing a dictionary for each additional section from the
            answer.

        - name: additionals_count
          type: long
          description: >
            The number of resource records contained in the `dns.additionals` field.
            The `dns.additionals` field may or may not be included depending on the
            configuration of Packetbeat.

        - name: additionals.name
          description: The domain name to which this resource record pertains.
          example: example.com.

        - name: additionals.type
          description: The type of data contained in this resource record.
          example: NS

        - name: additionals.class
          description: The class of DNS data contained in this resource record.
          example: IN

        - name: additionals.ttl
          description: >
            The time interval in seconds that this resource record may be cached
            before it should be discarded. Zero values mean that the data should
            not be cached.
          type: long

        - name: additionals.data
          description: >
            The data describing the resource. The meaning of this data depends
            on the type and class of the resource record.

        - name: opt.version
          description: The EDNS version.
          example: "0"

        - name: opt.do
          type: boolean
          description: If set, the transaction uses DNSSEC.

        - name: opt.ext_rcode
          description: Extended response code field.
          example: "BADVERS"

        - name: opt.udp_size
          type: long
          description: Requestor's UDP payload size (in bytes).

- key: http
  title: "HTTP"
  description: HTTP-specific event fields.
  fields:
    - name: http
      type: group
      description: Information about the HTTP request and response.
      fields:
        - name: request
          description: HTTP request
          type: group
          fields:
            - name: params
              description: >
                The query parameters or form values. The query parameters are available in the Request-URI
                and the form values are set in the HTTP body when the content-type is set to `x-www-form-urlencoded`.
            - name: headers
              type: object
              object_type: keyword
              description: >
                A map containing the captured header fields from the request.
                Which headers to capture is configurable. If headers with the same
                header name are present in the message, they will be separated by
                commas.
            - name: body
              type: text
              description: The body of the HTTP request.

        - name: response
          description: HTTP response
          type: group
          fields:
            - name: code
              description: The HTTP status code.
              example: 404

            - name: phrase
              description: The HTTP status phrase.
              example: Not found.

            - name: headers
              type: object
              object_type: keyword
              description: >
                A map containing the captured header fields from the response.
                Which headers to capture is configurable. If headers with the
                same header name are present in the message, they will be separated
                by commas.
            - name: body
              type: text
              description: The body of the HTTP response.

- key: icmp
  title: "ICMP"
  description: >
    ICMP specific event fields.
  fields:
    - name: icmp
      type: group
      fields:
        - name: version
          description: The version of the ICMP protocol.
          possible_values:
            - 4
            - 6

        - name: request.message
          type: keyword
          description: A human readable form of the request.

        - name: request.type
          type: long
          description: The request type.

        - name: request.code
          type: long
          description: The request code.

        - name: response.message
          type: keyword
          description: A human readable form of the response.

        - name: response.type
          type: long
          description: The response type.

        - name: response.code
          type: long
          description: The response code.

- key: memcache
  title: "Memcache"
  description: Memcached-specific event fields
  fields:
    - name: memcache
      type: group
      fields:
        - name: protocol_type
          type: keyword
          description: >
            The memcache protocol implementation. The value can be "binary"
            for binary-based, "text" for text-based, or "unknown" for an unknown
            memcache protocol type.

        - name: request.line
          type: keyword
          description: >
            The raw command line for unknown commands ONLY.

        - name: request.command
          type: keyword
          description: >
            The memcache command being requested in the memcache text protocol.
            For example "set" or "get".
            The binary protocol opcodes are translated into memcache text protocol
            commands.

        - name: response.command
          type: keyword
          description: >
            Either the text based protocol response message type
            or the name of the originating request if binary protocol is used.

        - name: request.type
          type: keyword
          description: >
            The memcache command classification. This value can be "UNKNOWN", "Load",
            "Store", "Delete", "Counter", "Info", "SlabCtrl", "LRUCrawler",
            "Stats", "Success", "Fail", or "Auth".

        - name: response.type
          type: keyword
          description: >
            The memcache command classification. This value can be "UNKNOWN", "Load",
            "Store", "Delete", "Counter", "Info", "SlabCtrl", "LRUCrawler",
            "Stats", "Success", "Fail", or "Auth".
            The text based protocol will employ any of these, whereas the
            binary based protocol will mirror the request commands only (see
            `memcache.response.status` for binary protocol).

        - name: response.error_msg
          type: keyword
          description: >
            The optional error message in the memcache response (text based protocol only).

        - name: request.opcode
          type: keyword
          description: >
            The binary protocol message opcode name.

        - name: response.opcode
          type: keyword
          description: >
            The binary protocol message opcode name.

        - name: request.opcode_value
          type: long
          description: >
            The binary protocol message opcode value.

        - name: response.opcode_value
          type: long
          description: >
            The binary protocol message opcode value.

        - name: request.opaque
          type: long
          description: >
            The binary protocol opaque header value used for correlating request
            with response messages.

        - name: response.opaque
          type: long
          description: >
            The binary protocol opaque header value used for correlating request
            with response messages.

        - name: request.vbucket
          type: long
          description: >
            The vbucket index sent in the binary message.

        - name: response.status
          type: keyword
          description: >
            The textual representation of the response error code
            (binary protocol only).

        - name: response.status_code
          type: long
          description: >
            The status code value returned in the response (binary protocol only).

        - name: request.keys
          type: array
          description: >
            The list of keys sent in the store or load commands.

        - name: response.keys
          type: array
          description: >
            The list of keys returned for the load command (if present).

        - name: request.count_values
          type: long
          description: >
            The number of values found in the memcache request message.
            If the command does not send any data, this field is missing.

        - name: response.count_values
          type: long
          description: >
            The number of values found in the memcache response message.
            If the command does not send any data, this field is missing.

        - name: request.values
          type: array
          description: >
            The list of base64 encoded values sent with the request (if present).

        - name: response.values
          type: array
          description: >
            The list of base64 encoded values sent with the response (if present).

        - name: request.bytes
          type: long
          format: bytes
          description: >
            The byte count of the values being transferred.

        - name: response.bytes
          type: long
          format: bytes
          description: >
            The byte count of the values being transferred.

        - name: request.delta
          type: long
          description: >
            The counter increment/decrement delta value.

        - name: request.initial
          type: long
          description: >
            The counter increment/decrement initial value parameter (binary protocol only).

        - name: request.verbosity
          type: long
          description: >
            The value of the memcache "verbosity" command.

        - name: request.raw_args
          type: keyword
          description: >
            The text protocol raw arguments for the "stats ..." and "lru crawl ..." commands.

        - name: request.source_class
          type: long
          description: >
            The source class id in 'slab reassign' command.

        - name: request.dest_class
          type: long
          description: >
            The destination class id in 'slab reassign' command.

        - name: request.automove
          type: keyword
          description: >
              The automove mode in the 'slab automove' command expressed as a string.
              This value can be "standby"(=0), "slow"(=1), "aggressive"(=2), or the raw value if
              the value is unknown.

        - name: request.flags
          type: long
          description: >
            The memcache command flags sent in the request (if present).

        - name: response.flags
          type: long
          description: >
            The memcache message flags sent in the response (if present).

        - name: request.exptime
          type: long
          description: >
            The data expiry time in seconds sent with the memcache command (if present).
            If the value is <30 days, the expiry time is relative to "now", or else it
            is an absolute Unix time in seconds (32-bit).

        - name: request.sleep_us
          type: long
          description: >
            The sleep setting in microseconds for the 'lru_crawler sleep' command.

        - name: response.value
          type: long
          description: >
            The counter value returned by a counter operation.

        - name: request.noreply
          type: boolean
          description: >
            Set to true if noreply was set in the request.
            The `memcache.response` field will be missing.

        - name: request.quiet
          type: boolean
          description: >
            Set to true if the binary protocol message is to be treated as a quiet message.

        - name: request.cas_unique
          type: long
          description: >
            The CAS (compare-and-swap) identifier if present.

        - name: response.cas_unique
          type: long
          description: >
            The CAS (compare-and-swap) identifier to be used with CAS-based updates
            (if present).

        - name: response.stats
          type: array
          description: >
            The list of statistic values returned. Each entry is a dictionary with the
            fields "name" and "value".

        - name: response.version
          type: keyword
          description: >
            The returned memcache version string.

- key: mongodb
  title: "MongoDb"
  description: >
    MongoDB-specific event fields. These fields mirror closely
    the fields for the MongoDB wire protocol. The higher level fields
    (for example, `query` and `resource`) apply to MongoDB events as well.
  fields:
    - name: mongodb
      type: group
      fields:
        - name: error
          description: >
            If the MongoDB request has resulted in an error, this field contains the
            error message returned by the server.
        - name: fullCollectionName
          description: >
            The full collection name.
            The full collection name is the concatenation of the database name with the collection name,
            using a dot (.) for the concatenation.
            For example, for the database foo and the collection bar, the full collection name is foo.bar.
        - name: numberToSkip
          type: long
          description: >
            Sets the number of documents to omit - starting from the first document in the resulting dataset -
            when returning the result of the query.
        - name: numberToReturn
          type: long
          description: >
            The requested maximum number of documents to be returned.
        - name: numberReturned
          type: long
          description: >
            The number of documents in the reply.
        - name: startingFrom
          description: >
            Where in the cursor this reply is starting.
        - name: query
          description: >
            A JSON document that represents the query.
            The query will contain one or more elements, all of which must match for a document
            to be included in the result set.
            Possible elements include $query, $orderby, $hint, $explain, and $snapshot.
        - name: returnFieldsSelector
          description: >
            A JSON document that limits the fields in the returned documents.
            The returnFieldsSelector contains one or more elements, each of which is the name of a field that should be returned,
            and the integer value 1.
        - name: selector
          description: >
            A BSON document that specifies the query for selecting the document to update or delete.
        - name: update
          description: >
            A BSON document that specifies the update to be performed.
            For information on specifying updates, see the Update Operations documentation from the MongoDB Manual.
        - name: cursorId
          description: >
            The cursor identifier returned in the OP_REPLY. This must be the value that was returned from the database.

    - name: rpc
      type: group
      description: OncRPC specific event fields.
      fields:
        - name: xid
          description: RPC message transaction identifier.

        - name: call_size
          type: long
          description: RPC call size with argument.

        - name: reply_size
          type: long
          description: RPC reply size with argument.

        - name: status
          description: RPC message reply status.

        - name: time
          type: long
          description: RPC message processing time.

        - name: time_str
          description: RPC message processing time in human readable form.

        - name: auth_flavor
          description: RPC authentication flavor.

        - name: cred.uid
          type: long
          description: RPC caller's user id, in case of auth-unix.

        - name: cred.gid
          type: long
          description: RPC caller's group id, in case of auth-unix.

        - name: cred.gids
          description: RPC caller's secondary group ids, in case of auth-unix.

        - name: cred.stamp
          type: long
          description: Arbitrary ID which the caller machine may generate.

        - name: cred.machinename
          description: The name of the caller's machine.

- key: mysql
  title: "MySQL"
  description: >
    MySQL-specific event fields.
  fields:
    - name: mysql
      type: group
      fields:
        - name: iserror
          type: boolean
          description: >
           If the MySQL query returns an error, this field is set to true.

        - name: affected_rows
          type: long
          description: >
            If the MySQL command is successful, this field contains the affected
            number of rows of the last statement.

        - name: insert_id
          description: >
            If the INSERT query is successful, this field contains the id of the
            newly inserted row.

        - name: num_fields
          description: >
            If the SELECT query is successful, this field is set to the number
            of fields returned.

        - name: num_rows
          description: >
            If the SELECT query is successful, this field is set to the number
            of rows returned.

        - name: query
          description: >
            The row mysql query as read from the transaction's request.

        - name: error_code
          type: long
          description: >
            The error code returned by MySQL.

        - name: error_message
          description: >
            The error info message returned by MySQL.

- key: nfs
  title: "NFS"
  description: NFS v4/3 specific event fields.
  fields:
    - name: nfs
      type: group
      fields:
        - name: version
          type: long
          description: NFS protocol version number.

        - name: minor_version
          type: long
          description: NFS protocol minor version number.

        - name: tag
          description: NFS v4 COMPOUND operation tag.

        - name: opcode
          description: >
            NFS operation name, or main operation name, in case of COMPOUND
            calls.

        - name: status
          description: NFS operation reply status.


- key: pgsql
  title: "PostgreSQL"
  description: >
    PostgreSQL-specific event fields.
  fields:
    - name: pgsql
      type: group
      fields:
        - name: query
          description: >
            The row pgsql query as read from the transaction's request.

        - name: iserror
          type: boolean
          description: >
            If the PgSQL query returns an error, this field is set to true.

        - name: error_code
          description: The PostgreSQL error code.
          type: long

        - name: error_message
          description: The PostgreSQL error message.

        - name: error_severity
          description: The PostgreSQL error severity.
          possible_values:
            - ERROR
            - FATAL
            - PANIC

        - name: num_fields
          description: >
            If the SELECT query if successful, this field is set to the number
            of fields returned.

        - name: num_rows
          description: >
            If the SELECT query if successful, this field is set to the number
            of rows returned.

- key: redis
  title: "Redis"
  description: >
    Redis-specific event fields.
  fields:
    - name: redis
      type: group
      fields:
        - name: return_value
          description: >
            The return value of the Redis command in a human readable format.

        - name: error
          description: >
            If the Redis command has resulted in an error, this field contains the
            error message returned by the Redis server.

- key: thrift
  title: "Thrift-RPC"
  description: >
    Thrift-RPC specific event fields.
  fields:
    - name: thrift
      type: group
      fields:
        - name: params
          description: >
            The RPC method call parameters in a human readable format. If the IDL
            files are available, the parameters use names whenever possible.
            Otherwise, the IDs from the message are used.

        - name: service
          description: >
            The name of the Thrift-RPC service as defined in the IDL files.

        - name: return_value
          description: >
            The value returned by the Thrift-RPC call. This is encoded in a human
            readable format.

        - name: exceptions
          description: >
            If the call resulted in exceptions, this field contains the exceptions in a human
            readable format.

- key: tls
  title: "TLS"
  description: >
    TLS-specific event fields.
  fields:
    - name: tls
      type: group
      fields:
        - name: version
          type: keyword
          description: >
            The version of the TLS protocol used.
          example: "TLS 1.3"

        - name: handshake_completed
          type: boolean
          description: >
            Whether the TLS negotiation has been successful and the session has
            transitioned to encrypted mode.

        - name: resumed
          type: boolean
          description: >
            If the TLS session has been resumed from a previous session.

        - name: resumption_method
          type: keyword
          description: >
            If the session has been resumed, the underlying method used. One of
            "id" for TLS session ID or "ticket" for TLS ticket extension.

        - name: client_certificate_requested
          type: boolean
          description: >
            Whether the server has requested the client to authenticate itself
            using a client certificate.

        - name: client_hello
          type: group
          fields:
            - name: version
              type: keyword
              description: >
                The version of the TLS protocol by which the client wishes to
                communicate during this session.

            - name: supported_ciphers
              type: array
              description: >
                List of ciphers the client is willing to use for this session.
                See https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-4

            - name: supported_compression_methods
              type: array
              description: >
                The list of compression methods the client supports.
                See https://www.iana.org/assignments/comp-meth-ids/comp-meth-ids.xhtml

            - name: extensions
              type: group
              description: The hello extensions provided by the client.
              fields:
                - name: server_name_indication
                  type: keyword
                  description: List of hostnames

                - name: application_layer_protocol_negotiation
                  type: keyword
                  description: >
                    List of application-layer protocols the client is willing to use.

                - name: session_ticket
                  type: keyword
                  description: >
                    Length of the session ticket, if provided, or an empty string
                    to advertise support for tickets.

                - name: supported_versions
                  type: keyword
                  description: >
                    List of TLS versions that the client is willing to use.

        - name: server_hello
          type: group
          fields:
            - name: version
              type: keyword
              description: >
                The version of the TLS protocol that is used for this session.
                It is the highest version supported by the server not exceeding
                the version requested in the client hello.

            - name: selected_cipher
              type: keyword
              description: >
                The cipher suite selected by the server from the list provided
                by in the client hello.

            - name: selected_compression_method
              type: keyword
              description: >
                The compression method selected by the server from the list
                provided in the client hello.

            - name: extensions
              type: group
              description: The hello extensions provided by the server.
              fields:
                - name: application_layer_protocol_negotiation
                  type: array
                  description: Negotiated application layer protocol

                - name: session_ticket
                  type: keyword
                  description: >
                    Used to announce that a session ticket will be provided
                    by the server. Always an empty string.

                - name: supported_versions
                  type: keyword
                  description: >
                    Negotiated TLS version to be used.

        - name: client_certificate
          type: group
          description: Certificate provided by the client for authentication.
          fields:

            - name: version
              type: long
              description: X509 format version.

            - name: serial_number
              type: keyword
              description: The certificate's serial number.

            - name: not_before
              type: date
              description: Date before which the certificate is not valid.

            - name: not_after
              type: date
              description: Date after which the certificate expires.

            - name: public_key_algorithm
              type: keyword
              description: >
                The algorithm used for this certificate's public key.
                One of RSA, DSA or ECDSA.

            - name: public_key_size
              type: long
              description: Size of the public key.

            - name: signature_algorithm
              type: keyword
              description: >
                The algorithm used for the certificate's signature.

            - name: alternative_names
              type: array
              description: Subject Alternative Names for this certificate.

            - name: raw
              type: keyword
              description: The raw certificate in PEM format.

            - name: subject
              type: group
              description: Subject represented by this certificate.
              fields:
                - name: country
                  type: keyword
                  description: Country code.

                - name: organization
                  type: keyword
                  description: Organization name.

                - name: organizational_unit
                  type: keyword
                  description: Unit within organization.

                - name: province
                  type: keyword
                  description: Province or region within country.

                - name: common_name
                  type: keyword
                  description: Name or host name identified by the certificate.

            - name: issuer
              type: group
              description: Entity that issued and signed this certificate.
              fields:
                - name: country
                  type: keyword
                  description: Country code.

                - name: organization
                  type: keyword
                  description: Organization name.

                - name: organizational_unit
                  type: keyword
                  description: Unit within organization.

                - name: province
                  type: keyword
                  description: Province or region within country.

                - name: common_name
                  type: keyword
                  description: Name or host name identified by the certificate.


        - name: server_certificate
          type: group
          description: Certificate provided by the server for authentication.
          fields:

            - name: version
              type: long
              description: X509 format version.

            - name: serial_number
              type: keyword
              description: The certificate's serial number.

            - name: not_before
              type: date
              description: Date before which the certificate is not valid.

            - name: not_after
              type: date
              description: Date after which the certificate expires.

            - name: public_key_algorithm
              type: keyword
              description: >
                The algorithm used for this certificate's public key.
                One of RSA, DSA or ECDSA.

            - name: public_key_size
              type: long
              description: Size of the public key.

            - name: signature_algorithm
              type: keyword
              description: >
                The algorithm used for the certificate's signature.

            - name: alternative_names
              type: array
              description: Subject Alternative Names for this certificate.

            - name: raw
              type: keyword
              description: The raw certificate in PEM format.

            - name: subject
              type: group
              description: Subject represented by this certificate.
              fields:
                - name: country
                  type: keyword
                  description: Country code.

                - name: organization
                  type: keyword
                  description: Organization name.

                - name: organizational_unit
                  type: keyword
                  description: Unit within organization.

                - name: province
                  type: keyword
                  description: Province or region within country.

                - name: common_name
                  type: keyword
                  description: Name or host name identified by the certificate.

            - name: issuer
              type: group
              description: Entity that issued and signed this certificate.
              fields:
                - name: country
                  type: keyword
                  description: Country code.

                - name: organization
                  type: keyword
                  description: Organization name.

                - name: organizational_unit
                  type: keyword
                  description: Unit within organization.

                - name: province
                  type: keyword
                  description: Province or region within country.

                - name: common_name
                  type: keyword
                  description: Name or host name identified by the certificate.

        - name: server_certificate_chain
          type: array
          description: Chain of trust for the server certificate.

        - name: client_certificate_chain
          type: array
          description: Chain of trust for the client certificate.

        - name: alert_types
          type: keyword
          description: >
            An array containing the TLS alert type for every alert received.

        - name: fingerprints
          type: group
          description: Fingerprints for this TLS session.
          fields:

            - name: ja3
              type: group
              description: JA3 TLS client fingerprint
              fields:

                - name: hash
                  type: keyword
                  description: >
                    The JA3 fingerprint hash for the client side.

                - name: str
                  type: keyword
                  description: >
                    The JA3 string used to calculate the hash.
