Skip to content

Commit deb8179

Browse files
committed
Regenerating README
1 parent 02aafd4 commit deb8179

File tree

1 file changed

+17
-0
lines changed

1 file changed

+17
-0
lines changed

packages/traefik/docs/README.md

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -117,6 +117,20 @@ An example event for `access` looks as following:
117117
| data_stream.dataset | Data stream dataset. | constant_keyword |
118118
| data_stream.namespace | Data stream namespace. | constant_keyword |
119119
| data_stream.type | Data stream type. | constant_keyword |
120+
| destination.address | Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword |
121+
| destination.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long |
122+
| destination.as.organization.name | Organization name. | wildcard |
123+
| destination.domain | Destination domain. | wildcard |
124+
| destination.geo.city_name | City name. | keyword |
125+
| destination.geo.continent_name | Name of the continent. | keyword |
126+
| destination.geo.country_iso_code | Country ISO code. | keyword |
127+
| destination.geo.country_name | Country name. | keyword |
128+
| destination.geo.location | Longitude and latitude. | geo_point |
129+
| destination.geo.name | User-defined description of a location, at the level of granularity they care about. | wildcard |
130+
| destination.geo.region_iso_code | Region ISO code. | keyword |
131+
| destination.geo.region_name | Region name. | keyword |
132+
| destination.ip | IP address of the destination (IPv4 or IPv6). | ip |
133+
| destination.port | Port of the destination. | long |
120134
| ecs.version | ECS version | keyword |
121135
| http.request.method | HTTP request method. Prior to ECS 1.6.0 the following guidance was provided: "The field value must be normalized to lowercase for querying." As of ECS 1.6.0, the guidance is deprecated because the original case of the method may be useful in anomaly detection. Original case will be mandated in ECS 2.0.0 | keyword |
122136
| http.request.referrer | Referrer for this HTTP request. | keyword |
@@ -126,6 +140,8 @@ An example event for `access` looks as following:
126140
| input.type | Input type | keyword |
127141
| log.file.path | Log path | keyword |
128142
| log.offset | Log offset | long |
143+
| network.community_id | A hash of source and destination IPs and ports. | keyword |
144+
| network.transport | Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.) | keyword |
129145
| related.ip | All of the IPs seen on your event. | ip |
130146
| related.user | All the user names seen on your event. | keyword |
131147
| source.address | Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword |
@@ -145,6 +161,7 @@ An example event for `access` looks as following:
145161
| traefik.access.request_count | The number of requests | long |
146162
| traefik.access.user_agent.os | | alias |
147163
| traefik.access.user_identifier | Is the RFC 1413 identity of the client | keyword |
164+
| url.domain | Domain of the url, such as "www.elastic.co". In some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `domain` field. If the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732), the `[` and `]` characters should also be captured in the `domain` field. | keyword |
148165
| url.original | Unmodified original url as seen in the event source. Note that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path. This field is meant to represent the URL as it was observed, complete or not. | keyword |
149166
| user.name | Short name or login of the user. | keyword |
150167
| user_agent.device.name | Name of the device. | keyword |

0 commit comments

Comments
 (0)