fields.yml

- key: beat
  title: Beat
  description: >
    Contains common beat fields available in all event types.
  fields:

    - name: beat.name
      description: >
        The name of the Beat sending the log messages. If the Beat name is
        set in the configuration file, then that value is used. If it is not
        set, the hostname is used. To set the Beat name, use the `name`
        option in the configuration file.
    - name: beat.hostname
      description: >
        The hostname as returned by the operating system on which the Beat is
        running.
    - name: beat.timezone
      description: >
        The timezone as returned by the operating system on which the Beat is
        running.
    - name: beat.version
      description: >
        The version of the beat that generated this event.

    - name: "@timestamp"
      type: date
      required: true
      format: date
      example: August 26th 2016, 12:35:53.332
      description: >
        The timestamp when the event log record was generated.

    - name: tags
      description: >
        Arbitrary tags that can be set per Beat and per transaction
        type.

    - name: fields
      type: object
      object_type: keyword
      description: >
        Contains user configurable fields.

    - name: error
      type: group
      description: >
        Error fields containing additional info in case of errors.
      fields:
        - name: message
          type: text
          description: >
            Error message.
        - name: code
          type: long
          description: >
            Error code.
        - name: type
          type: keyword
          description: >
            Error type.
- key: cloud
  title: Cloud provider metadata
  description: >
    Metadata from cloud providers added by the add_cloud_metadata processor.
  fields:

    - name: meta.cloud.provider
      example: ec2
      description: >
        Name of the cloud provider. Possible values are ec2, gce, or digitalocean.

    - name: meta.cloud.instance_id
      description: >
        Instance ID of the host machine.

    - name: meta.cloud.instance_name
      description: >
        Instance name of the host machine.

    - name: meta.cloud.machine_type
      example: t2.medium
      description: >
        Machine type of the host machine.

    - name: meta.cloud.availability_zone
      example: us-east-1c
      description: >
        Availability zone in which this host is running.

    - name: meta.cloud.project_id
      example: project-x
      description: >
        Name of the project in Google Cloud.

    - name: meta.cloud.region
      description: >
        Region in which this host is running.
- key: docker
  title: Docker
  description: >
    Docker stats collected from Docker.
  short_config: false
  anchor: docker-processor
  fields:
    - name: docker
      type: group
      fields:
        - name: container.id
          type: keyword
          description: >
            Unique container id.
        - name: container.image
          type: keyword
          description: >
            Name of the image the container was built on.
        - name: container.name
          type: keyword
          description: >
            Container name.
        - name: container.labels
          type: object
          object_type: keyword
          description: >
            Image labels.
- key: host
  title: Host
  description: >
    Info collected for the host machine.
  anchor: host-processor
  fields:
    - name: host
      type: group
      fields:
        - name: name
          type: keyword
          description: >
            Hostname.
        - name: id
          type: keyword
          description: >
            Unique host id.
        - name: architecture
          type: keyword
          description: >
            Host architecture (e.g. x86_64, arm, ppc, mips).
        - name: os.platform
          type: keyword
          description: >
            OS platform (e.g. centos, ubuntu, windows).
        - name: os.version
          type: keyword
          description: >
            OS version.
        - name: os.family
          type: keyword
          description: >
            OS family (e.g. redhat, debian, freebsd, windows).
- key: kubernetes
  title: Kubernetes
  description: >
    Kubernetes metadata added by the kubernetes processor
  short_config: false
  anchor: kubernetes-processor
  fields:
    - name: kubernetes
      type: group
      fields:
        - name: pod.name
          type: keyword
          description: >
            Kubernetes pod name

        - name: namespace
          type: keyword
          description: >
            Kubernetes namespace

        - name: node.name
          type: keyword
          description: >
            Kubernetes node name

        - name: labels
          type: object
          description: >
            Kubernetes labels map

        - name: annotations
          type: object
          description: >
            Kubernetes annotations map

        - name: container.name
          type: keyword
          description: >
            Kubernetes container name

        - name: container.image
          type: keyword
          description: >
            Kubernetes container image
- key: statsdbeat
  title: statsdbeat
  description: >
    Statsdbeat module listens for UDP messages (default localhost:8125) that follows the statsd protocol. 
    The messages are converted to beat.Events and on fixed interval send to Elastic Search.

  fields:
    - name: statsd
      type: group
      fields:        
        - name: bucket
          type: text
          norms: false          
          example: accounts.authentication.password.failure.no_email_found
          description: >
            statsd bucket

        - name: namespace
          type: text
          norms: false
          doc_values: false          
          ignore_above: 1024
          example: accounts.authentication
          description: >
            statsd bucket namespace

        - name: section
          type: keyword          
          ignore_above: 1024
          example: password
          description: >
            statsd bucket section

        - name: target
          type: keyword          
          ignore_above: 1024
          example: failure
          description: >
            statsd bucket target (noun)

        - name: action
          type: keyword          
          ignore_above: 1024
          example: no_email_found
          description: >
            statsd bucket action (past tense)
        
        - name: val
          type: long          
          description: >
            value for the bucket
        
        - name: type
          type: keyword
          ignore_above: 1024
          description: >
            The type of statsd counter  gauge  histogram.

        - name: ctx
          type: object
          object_type: keyword          
          object_type_mapping_type: "*"
          dynamic: true          
          description: >
            Contains user tags