It is hard to identify Linux events today. This would be useful, for example when looking at centralized logs from different devices - logs from the major operating systems (Linux, Windows, macOS) are very different. It often makes sense to be able to pull them apart and visualize/look at them separately and write rules/alerts that are specific to each.

None of the fields in the OS field set contain linux as a value, so the only way today to get all Linux events is to exclude all non-Linux events. That's not great.

What we have today:

• os.family
  • Documentation: redhat, debian, freebsd, windows
  • Values in the wild (internal cluster): redhat, debian, darwin, windows
• os.platform
  • Documentation: centos, ubuntu, windows
  • Values in the wild: debian, ubuntu, centos, darwin, windows, raspbian, ol, opensuse-leap
• os.full
  • Documentation: Mac OS Mojave
  • Values in the wild: None (Libbeat's add_host_metadata does not fill it)
• os.name
  • Documentation: Mac OS X
  • Values in the wild: Debian GNU/Linux, Oracle Linux Server, Windows Server 2019 Datacenter, Windows 8.1 Enterprise Evaluation

I think we should have a field that contains one value each for Linux, Windows, and macOS. Beats and other Go-based agents could fill it with the value of runtime.GOOS and we could take the list of possible GOOS values as the accepted values of this field (this would be linux, darwin, windows for the major three, the full list is here).

As to which fields, we could:

• Introduce a new field, such as os.type.
• Re-purpose one of the existing fields, either os.family or os.platform.

/cc @webmat @MikePaquette @andrewkroh @ruflin