You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: packages/traefik/docs/README.md
+17Lines changed: 17 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -117,6 +117,20 @@ An example event for `access` looks as following:
117
117
| data_stream.dataset | Data stream dataset. | constant_keyword |
118
118
| data_stream.namespace | Data stream namespace. | constant_keyword |
119
119
| data_stream.type | Data stream type. | constant_keyword |
120
+
| destination.address | Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword |
121
+
| destination.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long |
| destination.geo.city_name | City name. | keyword |
125
+
| destination.geo.continent_name | Name of the continent. | keyword |
126
+
| destination.geo.country_iso_code | Country ISO code. | keyword |
127
+
| destination.geo.country_name | Country name. | keyword |
128
+
| destination.geo.location | Longitude and latitude. | geo_point |
129
+
| destination.geo.name | User-defined description of a location, at the level of granularity they care about. | wildcard |
130
+
| destination.geo.region_iso_code | Region ISO code. | keyword |
131
+
| destination.geo.region_name | Region name. | keyword |
132
+
| destination.ip | IP address of the destination (IPv4 or IPv6). | ip |
133
+
| destination.port | Port of the destination. | long |
120
134
| ecs.version | ECS version | keyword |
121
135
| http.request.method | HTTP request method. Prior to ECS 1.6.0 the following guidance was provided: "The field value must be normalized to lowercase for querying." As of ECS 1.6.0, the guidance is deprecated because the original case of the method may be useful in anomaly detection. Original case will be mandated in ECS 2.0.0 | keyword |
122
136
| http.request.referrer | Referrer for this HTTP request. | keyword |
@@ -126,6 +140,8 @@ An example event for `access` looks as following:
126
140
| input.type | Input type | keyword |
127
141
| log.file.path | Log path | keyword |
128
142
| log.offset | Log offset | long |
143
+
| network.community_id | A hash of source and destination IPs and ports. | keyword |
144
+
| network.transport | Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.) | keyword |
129
145
| related.ip | All of the IPs seen on your event. | ip |
130
146
| related.user | All the user names seen on your event. | keyword |
131
147
| source.address | Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword |
@@ -145,6 +161,7 @@ An example event for `access` looks as following:
145
161
| traefik.access.request_count | The number of requests | long |
146
162
| traefik.access.user_agent.os || alias |
147
163
| traefik.access.user_identifier | Is the RFC 1413 identity of the client | keyword |
164
+
| url.domain | Domain of the url, such as "www.elastic.co". In some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `domain` field. If the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732), the `[` and `]` characters should also be captured in the `domain` field. | keyword |
148
165
| url.original | Unmodified original url as seen in the event source. Note that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path. This field is meant to represent the URL as it was observed, complete or not. | keyword |
149
166
| user.name | Short name or login of the user. | keyword |
150
167
| user_agent.device.name | Name of the device. | keyword |
0 commit comments