Skip to content

Commit 98254b9

Browse files
adriansradriansr
committed
Update to latest ECS 8.0-dev
1 parent 2da602b commit 98254b9

20 files changed

Lines changed: 87 additions & 79 deletions

File tree

‎auditbeat/docs/fields.asciidoc‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -7672,8 +7672,9 @@ The network.* fields should be populated with details about the network activity
76727672
*`network.application`*::
76737673
+
76747674
--
7675-
A name given to an application level protocol. This can be arbitrarily assigned for things like microservices, but also apply to things like skype, icq, facebook, twitter. This would be used in situations where the vendor or service can be decoded such as from the source/dest IP owners, ports, or wire format.
7676-
The field value must be normalized to lowercase for querying. See the documentation section "Implementing ECS".
7675+
When a specific application or service is identified from network connection details (source/dest IPs, ports, certificates, or wire format), this field captures the application's or service's name.
7676+
For example, the original event identifies the network connection being from a specific web service in a `https` network connection, like `facebook` or `twitter`.
7677+
The field value must be normalized to lowercase for querying.
76777678
76787679
type: keyword
76797680
@@ -7809,8 +7810,8 @@ example: 24
78097810
*`network.protocol`*::
78107811
+
78117812
--
7812-
L7 Network protocol name. ex. http, lumberjack, transport protocol.
7813-
The field value must be normalized to lowercase for querying. See the documentation section "Implementing ECS".
7813+
In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`.
7814+
The field value must be normalized to lowercase for querying.
78147815
78157816
type: keyword
78167817
@@ -7822,7 +7823,7 @@ example: http
78227823
+
78237824
--
78247825
Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)
7825-
The field value must be normalized to lowercase for querying. See the documentation section "Implementing ECS".
7826+
The field value must be normalized to lowercase for querying.
78267827
78277828
type: keyword
78287829
@@ -7834,7 +7835,7 @@ example: tcp
78347835
+
78357836
--
78367837
In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc
7837-
The field value must be normalized to lowercase for querying. See the documentation section "Implementing ECS".
7838+
The field value must be normalized to lowercase for querying.
78387839
78397840
type: keyword
78407841

‎auditbeat/include/fields.go‎

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎filebeat/docs/fields.asciidoc‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -39386,8 +39386,9 @@ The network.* fields should be populated with details about the network activity
3938639386
*`network.application`*::
3938739387
+
3938839388
--
39389-
A name given to an application level protocol. This can be arbitrarily assigned for things like microservices, but also apply to things like skype, icq, facebook, twitter. This would be used in situations where the vendor or service can be decoded such as from the source/dest IP owners, ports, or wire format.
39390-
The field value must be normalized to lowercase for querying. See the documentation section "Implementing ECS".
39389+
When a specific application or service is identified from network connection details (source/dest IPs, ports, certificates, or wire format), this field captures the application's or service's name.
39390+
For example, the original event identifies the network connection being from a specific web service in a `https` network connection, like `facebook` or `twitter`.
39391+
The field value must be normalized to lowercase for querying.
3939139392

3939239393
type: keyword
3939339394

@@ -39523,8 +39524,8 @@ example: 24
3952339524
*`network.protocol`*::
3952439525
+
3952539526
--
39526-
L7 Network protocol name. ex. http, lumberjack, transport protocol.
39527-
The field value must be normalized to lowercase for querying. See the documentation section "Implementing ECS".
39527+
In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`.
39528+
The field value must be normalized to lowercase for querying.
3952839529

3952939530
type: keyword
3953039531

@@ -39536,7 +39537,7 @@ example: http
3953639537
+
3953739538
--
3953839539
Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)
39539-
The field value must be normalized to lowercase for querying. See the documentation section "Implementing ECS".
39540+
The field value must be normalized to lowercase for querying.
3954039541

3954139542
type: keyword
3954239543

@@ -39548,7 +39549,7 @@ example: tcp
3954839549
+
3954939550
--
3955039551
In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc
39551-
The field value must be normalized to lowercase for querying. See the documentation section "Implementing ECS".
39552+
The field value must be normalized to lowercase for querying.
3955239553

3955339554
type: keyword
3955439555

‎filebeat/include/fields.go‎

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎heartbeat/docs/fields.asciidoc‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -5204,8 +5204,9 @@ The network.* fields should be populated with details about the network activity
52045204
*`network.application`*::
52055205
+
52065206
--
5207-
A name given to an application level protocol. This can be arbitrarily assigned for things like microservices, but also apply to things like skype, icq, facebook, twitter. This would be used in situations where the vendor or service can be decoded such as from the source/dest IP owners, ports, or wire format.
5208-
The field value must be normalized to lowercase for querying. See the documentation section "Implementing ECS".
5207+
When a specific application or service is identified from network connection details (source/dest IPs, ports, certificates, or wire format), this field captures the application's or service's name.
5208+
For example, the original event identifies the network connection being from a specific web service in a `https` network connection, like `facebook` or `twitter`.
5209+
The field value must be normalized to lowercase for querying.
52095210
52105211
type: keyword
52115212
@@ -5341,8 +5342,8 @@ example: 24
53415342
*`network.protocol`*::
53425343
+
53435344
--
5344-
L7 Network protocol name. ex. http, lumberjack, transport protocol.
5345-
The field value must be normalized to lowercase for querying. See the documentation section "Implementing ECS".
5345+
In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`.
5346+
The field value must be normalized to lowercase for querying.
53465347
53475348
type: keyword
53485349
@@ -5354,7 +5355,7 @@ example: http
53545355
+
53555356
--
53565357
Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)
5357-
The field value must be normalized to lowercase for querying. See the documentation section "Implementing ECS".
5358+
The field value must be normalized to lowercase for querying.
53585359
53595360
type: keyword
53605361
@@ -5366,7 +5367,7 @@ example: tcp
53665367
+
53675368
--
53685369
In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc
5369-
The field value must be normalized to lowercase for querying. See the documentation section "Implementing ECS".
5370+
The field value must be normalized to lowercase for querying.
53705371
53715372
type: keyword
53725373

‎heartbeat/include/fields.go‎

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎journalbeat/docs/fields.asciidoc‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -5756,8 +5756,9 @@ The network.* fields should be populated with details about the network activity
57565756
*`network.application`*::
57575757
+
57585758
--
5759-
A name given to an application level protocol. This can be arbitrarily assigned for things like microservices, but also apply to things like skype, icq, facebook, twitter. This would be used in situations where the vendor or service can be decoded such as from the source/dest IP owners, ports, or wire format.
5760-
The field value must be normalized to lowercase for querying. See the documentation section "Implementing ECS".
5759+
When a specific application or service is identified from network connection details (source/dest IPs, ports, certificates, or wire format), this field captures the application's or service's name.
5760+
For example, the original event identifies the network connection being from a specific web service in a `https` network connection, like `facebook` or `twitter`.
5761+
The field value must be normalized to lowercase for querying.
57615762
57625763
type: keyword
57635764
@@ -5893,8 +5894,8 @@ example: 24
58935894
*`network.protocol`*::
58945895
+
58955896
--
5896-
L7 Network protocol name. ex. http, lumberjack, transport protocol.
5897-
The field value must be normalized to lowercase for querying. See the documentation section "Implementing ECS".
5897+
In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`.
5898+
The field value must be normalized to lowercase for querying.
58985899
58995900
type: keyword
59005901
@@ -5906,7 +5907,7 @@ example: http
59065907
+
59075908
--
59085909
Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)
5909-
The field value must be normalized to lowercase for querying. See the documentation section "Implementing ECS".
5910+
The field value must be normalized to lowercase for querying.
59105911
59115912
type: keyword
59125913
@@ -5918,7 +5919,7 @@ example: tcp
59185919
+
59195920
--
59205921
In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc
5921-
The field value must be normalized to lowercase for querying. See the documentation section "Implementing ECS".
5922+
The field value must be normalized to lowercase for querying.
59225923
59235924
type: keyword
59245925

‎journalbeat/include/fields.go‎

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎libbeat/_meta/fields.ecs.yml‎

Lines changed: 14 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -3538,14 +3538,15 @@
35383538
level: extended
35393539
type: keyword
35403540
ignore_above: 1024
3541-
description: 'A name given to an application level protocol. This can be arbitrarily
3542-
assigned for things like microservices, but also apply to things like skype,
3543-
icq, facebook, twitter. This would be used in situations where the vendor
3544-
or service can be decoded such as from the source/dest IP owners, ports, or
3545-
wire format.
3546-
3547-
The field value must be normalized to lowercase for querying. See the documentation
3548-
section "Implementing ECS".'
3541+
description: 'When a specific application or service is identified from network
3542+
connection details (source/dest IPs, ports, certificates, or wire format),
3543+
this field captures the application''s or service''s name.
3544+
3545+
For example, the original event identifies the network connection being from
3546+
a specific web service in a `https` network connection, like `facebook` or
3547+
`twitter`.
3548+
3549+
The field value must be normalized to lowercase for querying.'
35493550
example: aim
35503551
- name: bytes
35513552
level: core
@@ -3637,10 +3638,10 @@
36373638
level: core
36383639
type: keyword
36393640
ignore_above: 1024
3640-
description: 'L7 Network protocol name. ex. http, lumberjack, transport protocol.
3641+
description: 'In the OSI Model this would be the Application Layer protocol.
3642+
For example, `http`, `dns`, or `ssh`.
36413643
3642-
The field value must be normalized to lowercase for querying. See the documentation
3643-
section "Implementing ECS".'
3644+
The field value must be normalized to lowercase for querying.'
36443645
example: http
36453646
- name: transport
36463647
level: core
@@ -3649,8 +3650,7 @@
36493650
description: 'Same as network.iana_number, but instead using the Keyword name
36503651
of the transport layer (udp, tcp, ipv6-icmp, etc.)
36513652
3652-
The field value must be normalized to lowercase for querying. See the documentation
3653-
section "Implementing ECS".'
3653+
The field value must be normalized to lowercase for querying.'
36543654
example: tcp
36553655
- name: type
36563656
level: core
@@ -3659,8 +3659,7 @@
36593659
description: 'In the OSI Model this would be the Network Layer. ipv4, ipv6,
36603660
ipsec, pim, etc
36613661
3662-
The field value must be normalized to lowercase for querying. See the documentation
3663-
section "Implementing ECS".'
3662+
The field value must be normalized to lowercase for querying.'
36643663
example: ipv4
36653664
- name: vlan.id
36663665
level: extended

‎metricbeat/docs/fields.asciidoc‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -17700,8 +17700,9 @@ The network.* fields should be populated with details about the network activity
1770017700
*`network.application`*::
1770117701
+
1770217702
--
17703-
A name given to an application level protocol. This can be arbitrarily assigned for things like microservices, but also apply to things like skype, icq, facebook, twitter. This would be used in situations where the vendor or service can be decoded such as from the source/dest IP owners, ports, or wire format.
17704-
The field value must be normalized to lowercase for querying. See the documentation section "Implementing ECS".
17703+
When a specific application or service is identified from network connection details (source/dest IPs, ports, certificates, or wire format), this field captures the application's or service's name.
17704+
For example, the original event identifies the network connection being from a specific web service in a `https` network connection, like `facebook` or `twitter`.
17705+
The field value must be normalized to lowercase for querying.
1770517706

1770617707
type: keyword
1770717708

@@ -17837,8 +17838,8 @@ example: 24
1783717838
*`network.protocol`*::
1783817839
+
1783917840
--
17840-
L7 Network protocol name. ex. http, lumberjack, transport protocol.
17841-
The field value must be normalized to lowercase for querying. See the documentation section "Implementing ECS".
17841+
In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`.
17842+
The field value must be normalized to lowercase for querying.
1784217843

1784317844
type: keyword
1784417845

@@ -17850,7 +17851,7 @@ example: http
1785017851
+
1785117852
--
1785217853
Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)
17853-
The field value must be normalized to lowercase for querying. See the documentation section "Implementing ECS".
17854+
The field value must be normalized to lowercase for querying.
1785417855

1785517856
type: keyword
1785617857

@@ -17862,7 +17863,7 @@ example: tcp
1786217863
+
1786317864
--
1786417865
In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc
17865-
The field value must be normalized to lowercase for querying. See the documentation section "Implementing ECS".
17866+
The field value must be normalized to lowercase for querying.
1786617867

1786717868
type: keyword
1786817869

0 commit comments

Comments
 (0)