Skip to content

Commit 6b818cb

Browse files
leehinmanleehinman
authored
aws generate ecs.yml (#1465)
* convert to ECS generated fields * update changelog
1 parent 779eed5 commit 6b818cb

File tree

31 files changed

+816
-1031
lines changed

31 files changed

+816
-1031
lines changed

‎packages/aws/_dev/build/build.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
dependencies:
2+
ecs:
3+
reference: git@1.11

‎packages/aws/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "0.10.3"
3+
changes:
4+
- description: Convert to generated ECS fields
5+
type: enhancement
6+
link: https://github.com/elastic/integrations/pull/1465
27
- version: '0.10.2'
38
changes:
49
- description: update to ECS 1.11.0

‎packages/aws/data_stream/billing/fields/ecs.yml‎

Lines changed: 35 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -1,60 +1,60 @@
1-
- name: cloud
2-
title: Cloud
3-
group: 2
4-
type: group
5-
footnote: 'Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.'
6-
fields:
7-
- name: account.id
1+
- fields:
2+
- description: 'The cloud account or organization id used to identify different entities in a multi-tenant environment.
3+
4+
Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.'
5+
ignore_above: 1024
86
level: extended
7+
name: account.id
98
type: keyword
10-
description: |-
11-
The cloud account or organization id used to identify different entities in a multi-tenant environment.
12-
Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.
9+
- description: 'The cloud account name or alias used to identify different entities in a multi-tenant environment.
10+
11+
Examples: AWS account name, Google Cloud ORG display name.'
1312
ignore_above: 1024
14-
- name: account.name
1513
level: extended
14+
name: account.name
1615
type: keyword
17-
description: |-
18-
The cloud account name or alias used to identify different entities in a multi-tenant environment.
19-
Examples: AWS account name, Google Cloud ORG display name.
16+
- description: Availability zone in which this host is running.
2017
ignore_above: 1024
21-
- name: availability_zone
2218
level: extended
19+
name: availability_zone
2320
type: keyword
24-
description: Availability zone in which this host is running.
21+
- description: Instance ID of the host machine.
2522
ignore_above: 1024
26-
- name: instance.id
2723
level: extended
24+
name: instance.id
2825
type: keyword
29-
description: Instance ID of the host machine.
26+
- description: Machine type of the host machine.
3027
ignore_above: 1024
31-
- name: machine.type
3228
level: extended
29+
name: machine.type
3330
type: keyword
34-
description: Machine type of the host machine.
31+
- description: Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.
3532
ignore_above: 1024
36-
- name: provider
3733
level: extended
34+
name: provider
3835
type: keyword
39-
description: Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.
36+
- description: Region in which this host is running.
4037
ignore_above: 1024
41-
- name: region
4238
level: extended
39+
name: region
4340
type: keyword
44-
description: Region in which this host is running.
45-
ignore_above: 1024
46-
- name: ecs.version
47-
type: keyword
48-
description: ECS version this event conforms to.
41+
footnote: 'Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.'
42+
group: 2
43+
name: cloud
44+
title: Cloud
45+
type: group
46+
- description: ECS version this event conforms to.
4947
example: 1.0.0
5048
ignore_above: 1024
51-
- name: error
52-
type: group
53-
fields:
54-
- name: message
49+
name: ecs.version
50+
type: keyword
51+
- fields:
52+
- description: Error message.
5553
level: core
54+
name: message
5655
type: text
57-
description: Error message.
58-
- name: service.type
56+
name: error
57+
type: group
58+
- description: Service type
59+
name: service.type
5960
type: keyword
60-
description: Service type

‎packages/aws/data_stream/cloudtrail/fields/ecs.yml‎

Lines changed: 87 additions & 159 deletions
Original file line numberDiff line numberDiff line change
@@ -1,160 +1,88 @@
1-
- name: error.message
2-
type: text
3-
description: Error message.
4-
- name: event.action
5-
type: keyword
6-
description: The action captured by the event.
7-
- name: event.ingested
8-
type: date
9-
description: Timestamp when an event arrived in the central data store.
10-
- name: event.original
11-
type: keyword
12-
description: Raw text message of entire event. Used to demonstrate log integrity.
13-
- name: user.name
14-
type: keyword
15-
description: Short name or login of the user.
16-
- name: user.id
17-
type: keyword
18-
description: Unique identifier of the user.
19-
- name: user.target.name
20-
type: keyword
21-
description: Short name or login of the user.
22-
- name: user.target.id
23-
type: keyword
24-
description: Unique identifier of the user.
25-
- name: user.changes.name
26-
type: keyword
27-
description: Short name or login of the user.
28-
- name: group.id
29-
type: keyword
30-
description: Unique identifier for the group on the system/platform.
31-
- name: group.name
32-
type: keyword
33-
description: Name of the group.
34-
- name: file
35-
title: File
36-
type: group
37-
fields:
38-
- name: path
39-
type: keyword
40-
ignore_above: 1024
41-
multi_fields:
42-
- name: text
43-
type: text
44-
norms: false
45-
default_field: false
46-
description: Full path to the file, including the file name. It should include the drive letter, when appropriate.
47-
- name: hash.md5
48-
type: keyword
49-
ignore_above: 1024
50-
description: MD5 hash.
51-
- name: hash.sha1
52-
type: keyword
53-
ignore_above: 1024
54-
description: SHA1 hash.
55-
- name: hash.sha256
56-
type: keyword
57-
ignore_above: 1024
58-
description: SHA256 hash.
59-
- name: hash.sha512
60-
type: keyword
61-
ignore_above: 1024
62-
description: SHA512 hash.
63-
- name: cloud.account.id
64-
type: keyword
65-
description: The cloud account or organization id used to identify different entities in a multi-tenant environment.
66-
- name: event.provider
67-
type: keyword
68-
description: Source of the event.
69-
- name: cloud.region
70-
type: keyword
71-
description: Region in which this host is running.
72-
- name: source.address
73-
type: keyword
74-
description: Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the .address field.
75-
- name: source.ip
76-
type: ip
77-
description: IP address of the source (IPv4 or IPv6).
78-
- name: user_agent.device.name
79-
type: keyword
80-
description: Name of the device.
81-
- name: user_agent.name
82-
type: keyword
83-
description: Name of the user agent.
84-
- name: user_agent.original
85-
type: keyword
86-
description: Unparsed user_agent string.
87-
- name: user_agent.os.full
88-
type: keyword
89-
description: Operating system name, including the version or code name.
90-
- name: user_agent.os.name
91-
type: keyword
92-
description: Operating system name, without the version.
93-
- name: user_agent.os.version
94-
type: keyword
95-
description: Operating system version as a raw string.
96-
- name: user_agent.version
97-
type: keyword
98-
description: Version of the user agent.
99-
- name: related.user
100-
type: keyword
101-
description: All the user names seen on your event.
102-
- name: related.hash
103-
type: keyword
104-
description: All the hashes seen on your event.
105-
- name: event.kind
106-
type: keyword
107-
description: Event kind (e.g. event, alert, metric, state, pipeline_error, signal)
108-
- name: event.type
109-
type: keyword
110-
description: Event severity (e.g. info, error)
111-
- name: source.as.number
112-
type: long
113-
description: >-
114-
Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet.
115-
- name: source.as.organization.name
116-
type: keyword
117-
ignore_above: 1024
118-
multi_fields:
119-
- name: text
120-
type: text
121-
norms: false
122-
default_field: false
123-
description: Organization name.
124-
- name: source.geo.city_name
125-
type: keyword
126-
ignore_above: 1024
127-
description: City name.
128-
- name: source.geo.continent_name
129-
type: keyword
130-
ignore_above: 1024
131-
description: Name of the continent.
132-
- name: source.geo.country_iso_code
133-
type: keyword
134-
ignore_above: 1024
135-
description: Country ISO code.
136-
- name: source.geo.country_name
137-
type: keyword
138-
ignore_above: 1024
139-
description: Country name.
140-
- name: source.geo.location
1+
- external: ecs
2+
name: cloud.account.id
3+
- external: ecs
4+
name: cloud.region
5+
- external: ecs
6+
name: ecs.version
7+
- external: ecs
8+
name: error.message
9+
- external: ecs
10+
name: event.action
11+
- external: ecs
12+
name: event.ingested
13+
- external: ecs
14+
name: event.kind
15+
- external: ecs
16+
name: event.original
17+
- external: ecs
18+
name: event.provider
19+
- external: ecs
20+
name: event.type
21+
- external: ecs
22+
name: file.hash.md5
23+
- external: ecs
24+
name: file.hash.sha1
25+
- external: ecs
26+
name: file.hash.sha256
27+
- external: ecs
28+
name: file.hash.sha512
29+
- external: ecs
30+
name: file.path
31+
- external: ecs
32+
name: group.id
33+
- external: ecs
34+
name: group.name
35+
- external: ecs
36+
name: related.hash
37+
- external: ecs
38+
name: related.user
39+
- external: ecs
40+
name: source.address
41+
- external: ecs
42+
name: source.as.number
43+
- external: ecs
44+
name: source.as.organization.name
45+
- external: ecs
46+
name: source.geo.city_name
47+
- external: ecs
48+
name: source.geo.continent_name
49+
- external: ecs
50+
name: source.geo.country_iso_code
51+
- external: ecs
52+
name: source.geo.country_name
53+
- description: Longitude and latitude.
54+
level: core
55+
name: source.geo.location
14156
type: geo_point
142-
description: Longitude and latitude.
143-
- name: source.geo.region_iso_code
144-
type: keyword
145-
ignore_above: 1024
146-
description: Region ISO code.
147-
- name: source.geo.region_name
148-
type: keyword
149-
ignore_above: 1024
150-
description: Region name.
151-
- name: ecs.version
152-
type: keyword
153-
description: ECS version this event conforms to.
154-
example: 1.0.0
155-
ignore_above: 1024
156-
- name: tags
157-
description: List of keywords used to tag each event.
158-
example: '["production", "env2"]'
159-
ignore_above: 1024
160-
type: keyword
57+
- external: ecs
58+
name: source.geo.region_iso_code
59+
- external: ecs
60+
name: source.geo.region_name
61+
- external: ecs
62+
name: source.ip
63+
- external: ecs
64+
name: tags
65+
- external: ecs
66+
name: user.changes.name
67+
- external: ecs
68+
name: user.id
69+
- external: ecs
70+
name: user.name
71+
- external: ecs
72+
name: user.target.id
73+
- external: ecs
74+
name: user.target.name
75+
- external: ecs
76+
name: user_agent.device.name
77+
- external: ecs
78+
name: user_agent.name
79+
- external: ecs
80+
name: user_agent.original
81+
- external: ecs
82+
name: user_agent.os.full
83+
- external: ecs
84+
name: user_agent.os.name
85+
- external: ecs
86+
name: user_agent.os.version
87+
- external: ecs
88+
name: user_agent.version

‎packages/aws/data_stream/cloudwatch_logs/fields/ecs.yml‎

Lines changed: 6 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,6 @@
1-
- name: ecs.version
2-
type: keyword
3-
description: ECS version this event conforms to.
4-
example: 1.0.0
5-
ignore_above: 1024
6-
- name: error
7-
type: group
8-
fields:
9-
- name: message
10-
level: core
11-
type: text
12-
description: Error message.
13-
- name: tags
14-
description: List of keywords used to tag each event.
15-
example: '["production", "env2"]'
16-
ignore_above: 1024
17-
type: keyword
1+
- external: ecs
2+
name: ecs.version
3+
- external: ecs
4+
name: error.message
5+
- external: ecs
6+
name: tags

0 commit comments

Comments
 (0)