
////
This file is generated! See _meta/fields.yml and scripts/generate_field_docs.py
////

[[exported-fields]]
= Exported fields

[partintro]

--
This document describes the fields that are exported by Auditbeat. They are
grouped in the following categories:

* <<exported-fields-alias>>
* <<exported-fields-auditd>>
* <<exported-fields-beat>>
* <<exported-fields-cloud>>
* <<exported-fields-common>>
* <<exported-fields-docker-processor>>
* <<exported-fields-file_integrity>>
* <<exported-fields-host-processor>>
* <<exported-fields-kubernetes-processor>>
* <<exported-fields-system>>

--
[[exported-fields-alias]]
== Alias fields

Alias fields for compatibility with 7.x.



*`host.hostname`*::
+
--
type: alias

alias to: beat.hostname

--

*`event.timezone`*::
+
--
type: alias

alias to: beat.timezone

--

*`cloud.provider`*::
+
--
type: alias

alias to: meta.cloud.provider

--

*`cloud.instance.id`*::
+
--
type: alias

alias to: meta.cloud.instance_id

--

*`cloud.instance.name`*::
+
--
type: alias

alias to: meta.cloud.instance_name

--

*`cloud.machine.type`*::
+
--
type: alias

alias to: meta.cloud.machine_type

--

*`cloud.availability_zone`*::
+
--
type: alias

alias to: meta.cloud.availability_zone

--

*`cloud.project.id`*::
+
--
type: alias

alias to: meta.cloud.project_id

--

*`cloud.region`*::
+
--
type: alias

alias to: meta.cloud.region

--

*`container.id`*::
+
--
type: alias

alias to: docker.container.id

--

*`container.name`*::
+
--
type: alias

alias to: docker.container.name

--

*`container.image.name`*::
+
--
type: alias

alias to: docker.container.image

--

[[exported-fields-auditd]]
== Auditd fields

These are the fields generated by the auditd module.



*`event.category`*::
+
--
type: keyword

example: audit-rule

The event's category is a value derived from the `record_type`.


--

*`event.type`*::
+
--
type: keyword

The audit record's type.

--


*`user.auid`*::
+
--
type: keyword

login user ID

--

*`user.uid`*::
+
--
type: keyword

user ID

--

*`user.euid`*::
+
--
type: keyword

effective user ID

--

*`user.fsuid`*::
+
--
type: keyword

file system user ID

--

*`user.suid`*::
+
--
type: keyword

sent user ID

--

*`user.gid`*::
+
--
type: keyword

group ID

--

*`user.egid`*::
+
--
type: keyword

effective group ID

--

*`user.sgid`*::
+
--
type: keyword

set group ID

--

*`user.fsgid`*::
+
--
type: keyword

file system group ID

--

[float]
== name_map fields

If `resolve_ids` is set to true in the configuration then `name_map` will contain a mapping of uid field names to the resolved name (e.g. auid -> root).



*`user.name_map.auid`*::
+
--
type: keyword

login user name

--

*`user.name_map.uid`*::
+
--
type: keyword

user name

--

*`user.name_map.euid`*::
+
--
type: keyword

effective user name

--

*`user.name_map.fsuid`*::
+
--
type: keyword

file system user name

--

*`user.name_map.suid`*::
+
--
type: keyword

sent user name

--

*`user.name_map.gid`*::
+
--
type: keyword

group name

--

*`user.name_map.egid`*::
+
--
type: keyword

effective group name

--

*`user.name_map.sgid`*::
+
--
type: keyword

set group name

--

*`user.name_map.fsgid`*::
+
--
type: keyword

file system group name

--

[float]
== selinux fields

The SELinux identity of the actor.


*`user.selinux.user`*::
+
--
type: keyword

account submitted for authentication

--

*`user.selinux.role`*::
+
--
type: keyword

user's SELinux role

--

*`user.selinux.domain`*::
+
--
type: keyword

The actor's SELinux domain or type.

--

*`user.selinux.level`*::
+
--
type: keyword

example: s0

The actor's SELinux level.

--

*`user.selinux.category`*::
+
--
type: keyword

The actor's SELinux category or compartments.

--

[float]
== process fields

Process attributes.


*`process.pid`*::
+
--
type: keyword

Process ID.

--

*`process.ppid`*::
+
--
type: keyword

Parent process ID.

--

*`process.name`*::
+
--
type: keyword

Process name (comm).

--

*`process.title`*::
+
--
type: keyword

Process title or command line parameters (proctitle).

--

*`process.exe`*::
+
--
type: keyword

Absolute path of the executable.

--

*`process.cwd`*::
+
--
type: keyword

The current working directory.

--

*`process.args`*::
+
--
type: keyword

The process arguments as a list.

--

[float]
== source fields

Source that triggered the event.


*`source.ip`*::
+
--
type: ip

The remote address.

--

*`source.port`*::
+
--
type: keyword

The port number.

--

*`source.hostname`*::
+
--
type: keyword

Hostname of the source.

--

*`source.path`*::
+
--
type: keyword

This is the path associated with a unix socket.

--

[float]
== destination fields

Destination address that triggered the event.


*`destination.ip`*::
+
--
type: ip

The remote address.

--

*`destination.port`*::
+
--
type: keyword

The port number.

--

*`destination.hostname`*::
+
--
type: keyword

Hostname of the source.

--

*`destination.path`*::
+
--
type: keyword

This is the path associated with a unix socket.

--

*`network.direction`*::
+
--
type: keyword

Direction of the network traffic (`incoming` or `outgoing`).

--


*`auditd.sequence`*::
+
--
type: long

The sequence number of the event as assigned by the kernel. Sequence numbers are stored as a uint32 in the kernel and can rollover.


--

*`auditd.session`*::
+
--
type: keyword

The session ID assigned to a login. All events related to a login session will have the same value.


--

*`auditd.result`*::
+
--
type: keyword

example: success or fail

The result of the audited operation (success/fail).

--


[float]
== actor fields

The actor is the user that triggered the audit event.


*`auditd.summary.actor.primary`*::
+
--
type: keyword

The primary identity of the actor. This is the actor's original login ID. It will not change even if the user changes to another account.


--

*`auditd.summary.actor.secondary`*::
+
--
type: keyword

The secondary identity of the actor. This is typically the same as the primary, except for when the user has used `su`.

--

[float]
== object fields

This is the thing or object being acted upon in the event.



*`auditd.summary.object.type`*::
+
--
type: keyword

A description of the what the "thing" is (e.g. file, socket, user-session).


--

*`auditd.summary.object.primary`*::
+
--
type: keyword



--

*`auditd.summary.object.secondary`*::
+
--
type: keyword



--

*`auditd.summary.how`*::
+
--
type: keyword

This describes how the action was performed. Usually this is the exe or command that was being executed that triggered the event.


--

[float]
== paths fields

List of paths associated with the event.


*`auditd.paths.inode`*::
+
--
type: keyword

inode number

--

*`auditd.paths.dev`*::
+
--
type: keyword

device name as found in /dev

--

*`auditd.paths.obj_user`*::
+
--
type: keyword



--

*`auditd.paths.obj_role`*::
+
--
type: keyword



--

*`auditd.paths.obj_domain`*::
+
--
type: keyword



--

*`auditd.paths.obj_level`*::
+
--
type: keyword



--

*`auditd.paths.objtype`*::
+
--
type: keyword



--

*`auditd.paths.ouid`*::
+
--
type: keyword

file owner user ID

--

*`auditd.paths.rdev`*::
+
--
type: keyword

the device identifier (special files only)

--

*`auditd.paths.nametype`*::
+
--
type: keyword

kind of file operation being referenced

--

*`auditd.paths.ogid`*::
+
--
type: keyword

file owner group ID

--

*`auditd.paths.item`*::
+
--
type: keyword

which item is being recorded

--

*`auditd.paths.mode`*::
+
--
type: keyword

mode flags on a file

--

*`auditd.paths.name`*::
+
--
type: keyword

file name in avcs

--

[float]
== data fields

The data from the audit messages.


*`auditd.data.action`*::
+
--
type: keyword

netfilter packet disposition

--

*`auditd.data.minor`*::
+
--
type: keyword

device minor number

--

*`auditd.data.acct`*::
+
--
type: keyword

a user's account name

--

*`auditd.data.addr`*::
+
--
type: keyword

the remote address that the user is connecting from

--

*`auditd.data.cipher`*::
+
--
type: keyword

name of crypto cipher selected

--

*`auditd.data.id`*::
+
--
type: keyword

during account changes

--

*`auditd.data.entries`*::
+
--
type: keyword

number of entries in the netfilter table

--

*`auditd.data.kind`*::
+
--
type: keyword

server or client in crypto operation

--

*`auditd.data.ksize`*::
+
--
type: keyword

key size for crypto operation

--

*`auditd.data.spid`*::
+
--
type: keyword

sent process ID

--

*`auditd.data.arch`*::
+
--
type: keyword

the elf architecture flags

--

*`auditd.data.argc`*::
+
--
type: keyword

the number of arguments to an execve syscall

--

*`auditd.data.major`*::
+
--
type: keyword

device major number

--

*`auditd.data.unit`*::
+
--
type: keyword

systemd unit

--

*`auditd.data.table`*::
+
--
type: keyword

netfilter table name

--

*`auditd.data.terminal`*::
+
--
type: keyword

terminal name the user is running programs on

--

*`auditd.data.grantors`*::
+
--
type: keyword

pam modules approving the action

--

*`auditd.data.direction`*::
+
--
type: keyword

direction of crypto operation

--

*`auditd.data.op`*::
+
--
type: keyword

the operation being performed that is audited

--

*`auditd.data.tty`*::
+
--
type: keyword

tty udevice the user is running programs on

--

*`auditd.data.syscall`*::
+
--
type: keyword

syscall number in effect when the event occurred

--

*`auditd.data.data`*::
+
--
type: keyword

TTY text

--

*`auditd.data.family`*::
+
--
type: keyword

netfilter protocol

--

*`auditd.data.mac`*::
+
--
type: keyword

crypto MAC algorithm selected

--

*`auditd.data.pfs`*::
+
--
type: keyword

perfect forward secrecy method

--

*`auditd.data.items`*::
+
--
type: keyword

the number of path records in the event

--

*`auditd.data.a0`*::
+
--
type: keyword



--

*`auditd.data.a1`*::
+
--
type: keyword



--

*`auditd.data.a2`*::
+
--
type: keyword



--

*`auditd.data.a3`*::
+
--
type: keyword



--

*`auditd.data.hostname`*::
+
--
type: keyword

the hostname that the user is connecting from

--

*`auditd.data.lport`*::
+
--
type: keyword

local network port

--

*`auditd.data.rport`*::
+
--
type: keyword

remote port number

--

*`auditd.data.exit`*::
+
--
type: keyword

syscall exit code

--

*`auditd.data.fp`*::
+
--
type: keyword

crypto key finger print

--

*`auditd.data.laddr`*::
+
--
type: keyword

local network address

--

*`auditd.data.sport`*::
+
--
type: keyword

local port number

--

*`auditd.data.capability`*::
+
--
type: keyword

posix capabilities

--

*`auditd.data.nargs`*::
+
--
type: keyword

the number of arguments to a socket call

--

*`auditd.data.new-enabled`*::
+
--
type: keyword

new TTY audit enabled setting

--

*`auditd.data.audit_backlog_limit`*::
+
--
type: keyword

audit system's backlog queue size

--

*`auditd.data.dir`*::
+
--
type: keyword

directory name

--

*`auditd.data.cap_pe`*::
+
--
type: keyword

process effective capability map

--

*`auditd.data.model`*::
+
--
type: keyword

security model being used for virt

--

*`auditd.data.new_pp`*::
+
--
type: keyword

new process permitted capability map

--

*`auditd.data.old-enabled`*::
+
--
type: keyword

present TTY audit enabled setting

--

*`auditd.data.oauid`*::
+
--
type: keyword

object's login user ID

--

*`auditd.data.old`*::
+
--
type: keyword

old value

--

*`auditd.data.banners`*::
+
--
type: keyword

banners used on printed page

--

*`auditd.data.feature`*::
+
--
type: keyword

kernel feature being changed

--

*`auditd.data.vm-ctx`*::
+
--
type: keyword

the vm's context string

--

*`auditd.data.opid`*::
+
--
type: keyword

object's process ID

--

*`auditd.data.seperms`*::
+
--
type: keyword

SELinux permissions being used

--

*`auditd.data.seresult`*::
+
--
type: keyword

SELinux AVC decision granted/denied

--

*`auditd.data.new-rng`*::
+
--
type: keyword

device name of rng being added from a vm

--

*`auditd.data.old-net`*::
+
--
type: keyword

present MAC address assigned to vm

--

*`auditd.data.sigev_signo`*::
+
--
type: keyword

signal number

--

*`auditd.data.ino`*::
+
--
type: keyword

inode number

--

*`auditd.data.old_enforcing`*::
+
--
type: keyword

old MAC enforcement status

--

*`auditd.data.old-vcpu`*::
+
--
type: keyword

present number of CPU cores

--

*`auditd.data.range`*::
+
--
type: keyword

user's SE Linux range

--

*`auditd.data.res`*::
+
--
type: keyword

result of the audited operation(success/fail)

--

*`auditd.data.added`*::
+
--
type: keyword

number of new files detected

--

*`auditd.data.fam`*::
+
--
type: keyword

socket address family

--

*`auditd.data.nlnk-pid`*::
+
--
type: keyword

pid of netlink packet sender

--

*`auditd.data.subj`*::
+
--
type: keyword

lspp subject's context string

--

*`auditd.data.a[0-3]`*::
+
--
type: keyword

the arguments to a syscall

--

*`auditd.data.cgroup`*::
+
--
type: keyword

path to cgroup in sysfs

--

*`auditd.data.kernel`*::
+
--
type: keyword

kernel's version number

--

*`auditd.data.ocomm`*::
+
--
type: keyword

object's command line name

--

*`auditd.data.new-net`*::
+
--
type: keyword

MAC address being assigned to vm

--

*`auditd.data.permissive`*::
+
--
type: keyword

SELinux is in permissive mode

--

*`auditd.data.class`*::
+
--
type: keyword

resource class assigned to vm

--

*`auditd.data.compat`*::
+
--
type: keyword

is_compat_task result

--

*`auditd.data.fi`*::
+
--
type: keyword

file assigned inherited capability map

--

*`auditd.data.changed`*::
+
--
type: keyword

number of changed files

--

*`auditd.data.msg`*::
+
--
type: keyword

the payload of the audit record

--

*`auditd.data.dport`*::
+
--
type: keyword

remote port number

--

*`auditd.data.new-seuser`*::
+
--
type: keyword

new SELinux user

--

*`auditd.data.invalid_context`*::
+
--
type: keyword

SELinux context

--

*`auditd.data.dmac`*::
+
--
type: keyword

remote MAC address

--

*`auditd.data.ipx-net`*::
+
--
type: keyword

IPX network number

--

*`auditd.data.iuid`*::
+
--
type: keyword

ipc object's user ID

--

*`auditd.data.macproto`*::
+
--
type: keyword

ethernet packet type ID field

--

*`auditd.data.obj`*::
+
--
type: keyword

lspp object context string

--

*`auditd.data.ipid`*::
+
--
type: keyword

IP datagram fragment identifier

--

*`auditd.data.new-fs`*::
+
--
type: keyword

file system being added to vm

--

*`auditd.data.vm-pid`*::
+
--
type: keyword

vm's process ID

--

*`auditd.data.cap_pi`*::
+
--
type: keyword

process inherited capability map

--

*`auditd.data.old-auid`*::
+
--
type: keyword

previous auid value

--

*`auditd.data.oses`*::
+
--
type: keyword

object's session ID

--

*`auditd.data.fd`*::
+
--
type: keyword

file descriptor number

--

*`auditd.data.igid`*::
+
--
type: keyword

ipc object's group ID

--

*`auditd.data.new-disk`*::
+
--
type: keyword

disk being added to vm

--

*`auditd.data.parent`*::
+
--
type: keyword

the inode number of the parent file

--

*`auditd.data.len`*::
+
--
type: keyword

length

--

*`auditd.data.oflag`*::
+
--
type: keyword

open syscall flags

--

*`auditd.data.uuid`*::
+
--
type: keyword

a UUID

--

*`auditd.data.code`*::
+
--
type: keyword

seccomp action code

--

*`auditd.data.nlnk-grp`*::
+
--
type: keyword

netlink group number

--

*`auditd.data.cap_fp`*::
+
--
type: keyword

file permitted capability map

--

*`auditd.data.new-mem`*::
+
--
type: keyword

new amount of memory in KB

--

*`auditd.data.seperm`*::
+
--
type: keyword

SELinux permission being decided on

--

*`auditd.data.enforcing`*::
+
--
type: keyword

new MAC enforcement status

--

*`auditd.data.new-chardev`*::
+
--
type: keyword

new character device being assigned to vm

--

*`auditd.data.old-rng`*::
+
--
type: keyword

device name of rng being removed from a vm

--

*`auditd.data.outif`*::
+
--
type: keyword

out interface number

--

*`auditd.data.cmd`*::
+
--
type: keyword

command being executed

--

*`auditd.data.hook`*::
+
--
type: keyword

netfilter hook that packet came from

--

*`auditd.data.new-level`*::
+
--
type: keyword

new run level

--

*`auditd.data.sauid`*::
+
--
type: keyword

sent login user ID

--

*`auditd.data.sig`*::
+
--
type: keyword

signal number

--

*`auditd.data.audit_backlog_wait_time`*::
+
--
type: keyword

audit system's backlog wait time

--

*`auditd.data.printer`*::
+
--
type: keyword

printer name

--

*`auditd.data.old-mem`*::
+
--
type: keyword

present amount of memory in KB

--

*`auditd.data.perm`*::
+
--
type: keyword

the file permission being used

--

*`auditd.data.old_pi`*::
+
--
type: keyword

old process inherited capability map

--

*`auditd.data.state`*::
+
--
type: keyword

audit daemon configuration resulting state

--

*`auditd.data.format`*::
+
--
type: keyword

audit log's format

--

*`auditd.data.new_gid`*::
+
--
type: keyword

new group ID being assigned

--

*`auditd.data.tcontext`*::
+
--
type: keyword

the target's or object's context string

--

*`auditd.data.maj`*::
+
--
type: keyword

device major number

--

*`auditd.data.watch`*::
+
--
type: keyword

file name in a watch record

--

*`auditd.data.device`*::
+
--
type: keyword

device name

--

*`auditd.data.grp`*::
+
--
type: keyword

group name

--

*`auditd.data.bool`*::
+
--
type: keyword

name of SELinux boolean

--

*`auditd.data.icmp_type`*::
+
--
type: keyword

type of icmp message

--

*`auditd.data.new_lock`*::
+
--
type: keyword

new value of feature lock

--

*`auditd.data.old_prom`*::
+
--
type: keyword

network promiscuity flag

--

*`auditd.data.acl`*::
+
--
type: keyword

access mode of resource assigned to vm

--

*`auditd.data.ip`*::
+
--
type: keyword

network address of a printer

--

*`auditd.data.new_pi`*::
+
--
type: keyword

new process inherited capability map

--

*`auditd.data.default-context`*::
+
--
type: keyword

default MAC context

--

*`auditd.data.inode_gid`*::
+
--
type: keyword

group ID of the inode's owner

--

*`auditd.data.new-log_passwd`*::
+
--
type: keyword

new value for TTY password logging

--

*`auditd.data.new_pe`*::
+
--
type: keyword

new process effective capability map

--

*`auditd.data.selected-context`*::
+
--
type: keyword

new MAC context assigned to session

--

*`auditd.data.cap_fver`*::
+
--
type: keyword

file system capabilities version number

--

*`auditd.data.file`*::
+
--
type: keyword

file name

--

*`auditd.data.net`*::
+
--
type: keyword

network MAC address

--

*`auditd.data.virt`*::
+
--
type: keyword

kind of virtualization being referenced

--

*`auditd.data.cap_pp`*::
+
--
type: keyword

process permitted capability map

--

*`auditd.data.old-range`*::
+
--
type: keyword

present SELinux range

--

*`auditd.data.resrc`*::
+
--
type: keyword

resource being assigned

--

*`auditd.data.new-range`*::
+
--
type: keyword

new SELinux range

--

*`auditd.data.obj_gid`*::
+
--
type: keyword

group ID of object

--

*`auditd.data.proto`*::
+
--
type: keyword

network protocol

--

*`auditd.data.old-disk`*::
+
--
type: keyword

disk being removed from vm

--

*`auditd.data.audit_failure`*::
+
--
type: keyword

audit system's failure mode

--

*`auditd.data.inif`*::
+
--
type: keyword

in interface number

--

*`auditd.data.vm`*::
+
--
type: keyword

virtual machine name

--

*`auditd.data.flags`*::
+
--
type: keyword

mmap syscall flags

--

*`auditd.data.nlnk-fam`*::
+
--
type: keyword

netlink protocol number

--

*`auditd.data.old-fs`*::
+
--
type: keyword

file system being removed from vm

--

*`auditd.data.old-ses`*::
+
--
type: keyword

previous ses value

--

*`auditd.data.seqno`*::
+
--
type: keyword

sequence number

--

*`auditd.data.fver`*::
+
--
type: keyword

file system capabilities version number

--

*`auditd.data.qbytes`*::
+
--
type: keyword

ipc objects quantity of bytes

--

*`auditd.data.seuser`*::
+
--
type: keyword

user's SE Linux user acct

--

*`auditd.data.cap_fe`*::
+
--
type: keyword

file assigned effective capability map

--

*`auditd.data.new-vcpu`*::
+
--
type: keyword

new number of CPU cores

--

*`auditd.data.old-level`*::
+
--
type: keyword

old run level

--

*`auditd.data.old_pp`*::
+
--
type: keyword

old process permitted capability map

--

*`auditd.data.daddr`*::
+
--
type: keyword

remote IP address

--

*`auditd.data.old-role`*::
+
--
type: keyword

present SELinux role

--

*`auditd.data.ioctlcmd`*::
+
--
type: keyword

The request argument to the ioctl syscall

--

*`auditd.data.smac`*::
+
--
type: keyword

local MAC address

--

*`auditd.data.apparmor`*::
+
--
type: keyword

apparmor event information

--

*`auditd.data.fe`*::
+
--
type: keyword

file assigned effective capability map

--

*`auditd.data.perm_mask`*::
+
--
type: keyword

file permission mask that triggered a watch event

--

*`auditd.data.ses`*::
+
--
type: keyword

login session ID

--

*`auditd.data.cap_fi`*::
+
--
type: keyword

file inherited capability map

--

*`auditd.data.obj_uid`*::
+
--
type: keyword

user ID of object

--

*`auditd.data.reason`*::
+
--
type: keyword

text string denoting a reason for the action

--

*`auditd.data.list`*::
+
--
type: keyword

the audit system's filter list number

--

*`auditd.data.old_lock`*::
+
--
type: keyword

present value of feature lock

--

*`auditd.data.bus`*::
+
--
type: keyword

name of subsystem bus a vm resource belongs to

--

*`auditd.data.old_pe`*::
+
--
type: keyword

old process effective capability map

--

*`auditd.data.new-role`*::
+
--
type: keyword

new SELinux role

--

*`auditd.data.prom`*::
+
--
type: keyword

network promiscuity flag

--

*`auditd.data.uri`*::
+
--
type: keyword

URI pointing to a printer

--

*`auditd.data.audit_enabled`*::
+
--
type: keyword

audit systems's enable/disable status

--

*`auditd.data.old-log_passwd`*::
+
--
type: keyword

present value for TTY password logging

--

*`auditd.data.old-seuser`*::
+
--
type: keyword

present SELinux user

--

*`auditd.data.per`*::
+
--
type: keyword

linux personality

--

*`auditd.data.scontext`*::
+
--
type: keyword

the subject's context string

--

*`auditd.data.tclass`*::
+
--
type: keyword

target's object classification

--

*`auditd.data.ver`*::
+
--
type: keyword

audit daemon's version number

--

*`auditd.data.new`*::
+
--
type: keyword

value being set in feature

--

*`auditd.data.val`*::
+
--
type: keyword

generic value associated with the operation

--

*`auditd.data.img-ctx`*::
+
--
type: keyword

the vm's disk image context string

--

*`auditd.data.old-chardev`*::
+
--
type: keyword

present character device assigned to vm

--

*`auditd.data.old_val`*::
+
--
type: keyword

current value of SELinux boolean

--

*`auditd.data.success`*::
+
--
type: keyword

whether the syscall was successful or not

--

*`auditd.data.inode_uid`*::
+
--
type: keyword

user ID of the inode's owner

--

*`auditd.data.removed`*::
+
--
type: keyword

number of deleted files

--


*`auditd.data.socket.port`*::
+
--
type: keyword

The port number.

--

*`auditd.data.socket.saddr`*::
+
--
type: keyword

The raw socket address structure.

--

*`auditd.data.socket.addr`*::
+
--
type: keyword

The remote address.

--

*`auditd.data.socket.family`*::
+
--
type: keyword

example: unix

The socket family (unix, ipv4, ipv6, netlink).

--

*`auditd.data.socket.path`*::
+
--
type: keyword

This is the path associated with a unix socket.

--

*`auditd.messages`*::
+
--
type: text

An ordered list of the raw messages received from the kernel that were used to construct this document. This field is present if an error occurred processing the data or if `include_raw_message` is set in the config.


--

*`auditd.warnings`*::
+
--
type: keyword

The warnings generated by the Beat during the construction of the event. These are disabled by default and are used for development and debug purposes only.


--

[float]
== geoip fields

The geoip fields are defined as a convenience in case you decide to enrich the data using a geoip filter in Logstash or Ingest Node.



*`geoip.continent_name`*::
+
--
type: keyword

The name of the continent.


--

*`geoip.city_name`*::
+
--
type: keyword

The name of the city.


--

*`geoip.region_name`*::
+
--
type: keyword

The name of the region.


--

*`geoip.country_iso_code`*::
+
--
type: keyword

Country ISO code.


--

*`geoip.location`*::
+
--
type: geo_point

The longitude and latitude.


--

[[exported-fields-beat]]
== Beat fields

Contains common beat fields available in all event types.



*`beat.name`*::
+
--
The name of the Beat sending the log messages. If the Beat name is set in the configuration file, then that value is used. If it is not set, the hostname is used. To set the Beat name, use the `name` option in the configuration file.


--

*`beat.hostname`*::
+
--
The hostname as returned by the operating system on which the Beat is running.


--

*`beat.timezone`*::
+
--
The timezone as returned by the operating system on which the Beat is running.


--

*`beat.version`*::
+
--
The version of the beat that generated this event.


--

*`@timestamp`*::
+
--
type: date

example: August 26th 2016, 12:35:53.332

format: date

required: True

The timestamp when the event log record was generated.


--

*`tags`*::
+
--
Arbitrary tags that can be set per Beat and per transaction type.


--

*`fields`*::
+
--
type: object

Contains user configurable fields.


--

[float]
== error fields

Error fields containing additional info in case of errors.



*`error.message`*::
+
--
type: text

Error message.


--

*`error.code`*::
+
--
type: long

Error code.


--

*`error.type`*::
+
--
type: keyword

Error type.


--

[[exported-fields-cloud]]
== Cloud provider metadata fields

Metadata from cloud providers added by the add_cloud_metadata processor.



*`meta.cloud.provider`*::
+
--
example: ec2

Name of the cloud provider. Possible values are ec2, gce, or digitalocean.


--

*`meta.cloud.instance_id`*::
+
--
Instance ID of the host machine.


--

*`meta.cloud.instance_name`*::
+
--
Instance name of the host machine.


--

*`meta.cloud.machine_type`*::
+
--
example: t2.medium

Machine type of the host machine.


--

*`meta.cloud.availability_zone`*::
+
--
example: us-east-1c

Availability zone in which this host is running.


--

*`meta.cloud.project_id`*::
+
--
example: project-x

Name of the project in Google Cloud.


--

*`meta.cloud.region`*::
+
--
Region in which this host is running.


--

[[exported-fields-common]]
== Common fields

Contains common fields available in all event types.



*`event.module`*::
+
--
The name of the module that generated the event.


--

*`event.dataset`*::
+
--
The name of the module's dataset that generated the event.


--

*`event.action`*::
+
--
type: keyword

example: logged-in

Action describes the change that triggered the event.
For the file integrity module the possible values are: attributes_modified, created, deleted, updated, moved, and config_change.


--

*`event.id`*::
+
--
type: keyword

example: 8a4f500d

Unique ID to describe the event.


--

*`event.kind`*::
+
--
type: keyword

example: state

The kind of the event.
This gives information about what type of information the event contains, without being specific to the contents of the event.  Examples are `event`, `state`, `alarm`. Warning: In future versions of ECS, we plan to provide a list of acceptable values for this field, please use with caution.


--

*`message`*::
+
--
type: text

example: Hello World

For log events the message field contains the log message.
In other use cases the message field can be used to concatenate different values which are then freely searchable. If multiple messages exist, they can be combined into one message.


--

[float]
== process fields

These fields contain information about a process. These fields can help you correlate metrics information with a process id/name from a log message.  The `process.pid` often stays in the metric itself and is copied to the global field for correlation.



*`process.start`*::
+
--
type: date

example: 2016-05-23T08:05:34.853Z

The time the process started.


--

*`process.working_directory`*::
+
--
type: keyword

example: /home/alice

The working directory of the process.


--

*`process.executable`*::
+
--
type: keyword

example: /usr/bin/ssh

Absolute path to the process executable.


--

*`network.type`*::
+
--
type: keyword

example: IPv4

In the OSI Model this would be the Network Layer. IPv4, IPv6, IPSec, PIM, etc


--

[float]
== user fields

The user fields describe information about the user that is relevant to  the event. Fields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them.



*`user.id`*::
+
--
type: keyword

One or multiple unique identifiers of the user.


--

*`user.name`*::
+
--
type: keyword

example: albert

Short name or login of the user.


--

[float]
== group fields

The group fields are meant to represent groups that are relevant to the event.



*`user.group.id`*::
+
--
type: keyword

Unique identifier for the group on the system/platform.


--

*`user.group.name`*::
+
--
type: keyword

Name of the group.


--

[float]
== file fields

File attributes.


*`file.path`*::
+
--
type: text

The path to the file.

--

*`file.path.raw`*::
+
--
type: keyword

The path to the file. This is a non-analyzed field that is useful for aggregations.


--

*`file.target_path`*::
+
--
type: keyword

The target path for symlinks.

--

*`file.type`*::
+
--
type: keyword

The file type (file, dir, or symlink).

--

*`file.device`*::
+
--
type: keyword

The device.

--

*`file.inode`*::
+
--
type: keyword

The inode representing the file in the filesystem.

--

*`file.uid`*::
+
--
type: keyword

The user ID (UID) or security identifier (SID) of the file owner.


--

*`file.owner`*::
+
--
type: keyword

The file owner's username.

--

*`file.gid`*::
+
--
type: keyword

The primary group ID (GID) of the file.

--

*`file.group`*::
+
--
type: keyword

The primary group name of the file.

--

*`file.mode`*::
+
--
type: keyword

example: 416

The mode of the file in octal representation.

--

*`file.setuid`*::
+
--
type: boolean

example: True

Set if the file has the `setuid` bit set. Omitted otherwise.

--

*`file.setgid`*::
+
--
type: boolean

example: True

Set if the file has the `setgid` bit set. Omitted otherwise.

--

*`file.size`*::
+
--
type: long

The file size in bytes (field is only added when `type` is `file`).

--

*`file.mtime`*::
+
--
type: date

The last modified time of the file (time when content was modified).

--

*`file.ctime`*::
+
--
type: date

The last change time of the file (time when metadata was changed).

--

*`file.origin`*::
+
--
type: text

An array of strings describing a possible external origin for this file. For example, the URL it was downloaded from. Only supported in macOS, via the kMDItemWhereFroms attribute. Omitted if origin information is not available.


--

*`file.origin.raw`*::
+
--
type: keyword

This is a non-analyzed field that is useful for aggregations on the origin data.


--

[float]
== selinux fields

The SELinux identity of the file.


*`file.selinux.user`*::
+
--
type: keyword

The owner of the object.

--

*`file.selinux.role`*::
+
--
type: keyword

The object's SELinux role.

--

*`file.selinux.domain`*::
+
--
type: keyword

The object's SELinux domain or type.

--

*`file.selinux.level`*::
+
--
type: keyword

example: s0

The object's SELinux level.

--

[float]
== user fields

User information.


[float]
== effective fields

Effective user information.


*`user.effective.id`*::
+
--
type: keyword

Effective user ID.

--

[float]
== group fields

Effective group information.


*`user.effective.group.id`*::
+
--
type: keyword

Effective group ID.

--

[float]
== saved fields

Saved user information.


*`user.saved.id`*::
+
--
type: keyword

Saved user ID.

--

[float]
== group fields

Saved group information.


*`user.saved.group.id`*::
+
--
type: keyword

Saved group ID.

--

[[exported-fields-docker-processor]]
== Docker fields

Docker stats collected from Docker.




*`docker.container.id`*::
+
--
type: keyword

Unique container id.


--

*`docker.container.image`*::
+
--
type: keyword

Name of the image the container was built on.


--

*`docker.container.name`*::
+
--
type: keyword

Container name.


--

*`docker.container.labels`*::
+
--
type: object

Image labels.


--

[[exported-fields-file_integrity]]
== File Integrity fields

These are the fields generated by the file_integrity module.


[float]
== hash fields

Hashes of the file. The keys are algorithm names and the values are the hex encoded digest values.



*`hash.blake2b_256`*::
+
--
type: keyword

BLAKE2b-256 hash of the file.

--

*`hash.blake2b_384`*::
+
--
type: keyword

BLAKE2b-384 hash of the file.

--

*`hash.blake2b_512`*::
+
--
type: keyword

BLAKE2b-512 hash of the file.

--

*`hash.md5`*::
+
--
type: keyword

MD5 hash of the file.

--

*`hash.sha1`*::
+
--
type: keyword

SHA1 hash of the file.

--

*`hash.sha224`*::
+
--
type: keyword

SHA224 hash of the file.

--

*`hash.sha256`*::
+
--
type: keyword

SHA256 hash of the file.

--

*`hash.sha384`*::
+
--
type: keyword

SHA384 hash of the file.

--

*`hash.sha3_224`*::
+
--
type: keyword

SHA3_224 hash of the file.

--

*`hash.sha3_256`*::
+
--
type: keyword

SHA3_256 hash of the file.

--

*`hash.sha3_384`*::
+
--
type: keyword

SHA3_384 hash of the file.

--

*`hash.sha3_512`*::
+
--
type: keyword

SHA3_512 hash of the file.

--

*`hash.sha512`*::
+
--
type: keyword

SHA512 hash of the file.

--

*`hash.sha512_224`*::
+
--
type: keyword

SHA512/224 hash of the file.

--

*`hash.sha512_256`*::
+
--
type: keyword

SHA512/256 hash of the file.

--

*`hash.xxh64`*::
+
--
type: keyword

XX64 hash of the file.

--

[[exported-fields-host-processor]]
== Host fields

Info collected for the host machine.




*`host.name`*::
+
--
type: keyword

Hostname.


--

*`host.id`*::
+
--
type: keyword

Unique host id.


--

*`host.architecture`*::
+
--
type: keyword

Host architecture (e.g. x86_64, arm, ppc, mips).


--

*`host.containerized`*::
+
--
type: boolean

If the host is a container.


--

*`host.os.platform`*::
+
--
type: keyword

OS platform (e.g. centos, ubuntu, windows).


--

*`host.os.name`*::
+
--
type: keyword

Operating system name (e.g. "Mac OS X").


--

*`host.os.build`*::
+
--
type: keyword

OS build information (e.g. "18D109").


--

*`host.os.version`*::
+
--
type: keyword

OS version.


--

*`host.os.family`*::
+
--
type: keyword

OS family (e.g. redhat, debian, freebsd, windows).


--

*`host.ip`*::
+
--
type: ip

List of IP-addresses.


--

*`host.mac`*::
+
--
type: keyword

List of hardware-addresses, usually MAC-addresses.


--

[[exported-fields-kubernetes-processor]]
== Kubernetes fields

Kubernetes metadata added by the kubernetes processor




*`kubernetes.pod.name`*::
+
--
type: keyword

Kubernetes pod name


--

*`kubernetes.pod.uid`*::
+
--
type: keyword

Kubernetes Pod UID


--

*`kubernetes.namespace`*::
+
--
type: keyword

Kubernetes namespace


--

*`kubernetes.node.name`*::
+
--
type: keyword

Kubernetes node name


--

*`kubernetes.labels`*::
+
--
type: object

Kubernetes labels map


--

*`kubernetes.annotations`*::
+
--
type: object

Kubernetes annotations map


--

*`kubernetes.container.name`*::
+
--
type: keyword

Kubernetes container name


--

*`kubernetes.container.image`*::
+
--
type: keyword

Kubernetes container image


--

[[exported-fields-system]]
== System fields

These are the fields generated by the system module.




*`event.origin`*::
+
--
type: keyword

Origin of the event. This can be a file path (e.g. `/var/log/log.1`), or the name of the system component that supplied the data (e.g. `netlink`).


--

*`event.outcome`*::
+
--
type: keyword

example: success

The outcome of the event.
If the event describes an action, this fields contains the outcome of that action. Examples outcomes are `success` and `failure`. Warning: In future versions of ECS, we plan to provide a list of acceptable values for this field, please use with caution.


--


*`user.entity_id`*::
+
--
type: keyword

ID uniquely identifying the user on a host. It is computed as a SHA-256 hash of the host ID, user ID, and user name.


--

*`user.terminal`*::
+
--
type: keyword

Terminal of the user.


--


*`process.entity_id`*::
+
--
type: keyword

ID uniquely identifying the process. It is computed as a SHA-256 hash of the host ID, PID, and process start time.


--


*`socket.entity_id`*::
+
--
type: keyword

ID uniquely identifying the socket. It is computed as a SHA-256 hash of the host ID, socket inode, local IP, local port, remote IP, and remote port.


--

[float]
== system.audit fields




[float]
== host fields

`host` contains general host information.



*`system.audit.host.uptime`*::
+
--
type: long

format: duration

Uptime in nanoseconds.


--

*`system.audit.host.boottime`*::
+
--
type: date

Boot time.


--

*`system.audit.host.containerized`*::
+
--
type: boolean

Set if host is a container.


--

*`system.audit.host.timezone.name`*::
+
--
type: keyword

Name of the timezone of the host, e.g. BST.


--

*`system.audit.host.timezone.offset.sec`*::
+
--
type: long

Timezone offset in seconds.


--

*`system.audit.host.hostname`*::
+
--
type: keyword

Hostname.


--

*`system.audit.host.id`*::
+
--
type: keyword

Host ID.


--

*`system.audit.host.architecture`*::
+
--
type: keyword

Host architecture (e.g. x86_64).


--

*`system.audit.host.mac`*::
+
--
type: keyword

MAC addresses.


--

*`system.audit.host.ip`*::
+
--
type: ip

IP addresses.


--

[float]
== os fields

`os` contains information about the operating system.



*`system.audit.host.os.platform`*::
+
--
type: keyword

OS platform (e.g. centos, ubuntu, windows).


--

*`system.audit.host.os.name`*::
+
--
type: keyword

OS name (e.g. Mac OS X).


--

*`system.audit.host.os.family`*::
+
--
type: keyword

OS family (e.g. redhat, debian, freebsd, windows).


--

*`system.audit.host.os.version`*::
+
--
type: keyword

OS version.


--

*`system.audit.host.os.kernel`*::
+
--
type: keyword

The operating system's kernel version.


--

[float]
== package fields

`package` contains information about an installed or removed package.



*`system.audit.package.entity_id`*::
+
--
type: keyword

ID uniquely identifying the package. It is computed as a SHA-256 hash of the
  host ID, package name, and package version.


--

*`system.audit.package.name`*::
+
--
type: keyword

Package name.


--

*`system.audit.package.version`*::
+
--
type: keyword

Package version.


--

*`system.audit.package.release`*::
+
--
type: keyword

Package release.


--

*`system.audit.package.arch`*::
+
--
type: keyword

Package architecture.


--

*`system.audit.package.license`*::
+
--
type: keyword

Package license.


--

*`system.audit.package.installtime`*::
+
--
type: date

Package install time.


--

*`system.audit.package.size`*::
+
--
type: long

Package size.


--

*`system.audit.package.summary`*::
+
--
Package summary.


--

*`system.audit.package.url`*::
+
--
type: keyword

Package URL.


--

[float]
== user fields

`user` contains information about the users on a system.



*`system.audit.user.name`*::
+
--
type: keyword

User name.


--

*`system.audit.user.uid`*::
+
--
type: keyword

User ID.


--

*`system.audit.user.gid`*::
+
--
type: keyword

Group ID.


--

*`system.audit.user.dir`*::
+
--
type: keyword

User's home directory.


--

*`system.audit.user.shell`*::
+
--
type: keyword

Program to run at login.


--

*`system.audit.user.user_information`*::
+
--
type: text

General user information. On Linux, this is the gecos field.


--

*`system.audit.user.group`*::
+
--
type: object

`group` contains information about any groups the user is part of (beyond the user's primary group).


--

[float]
== password fields

`password` contains information about a user's password (not the password itself).



*`system.audit.user.password.type`*::
+
--
type: keyword

A user's password type. Possible values are `shadow_password` (the password hash is in the shadow file), `password_disabled`, `no_password` (this is dangerous as anyone can log in), and `crypt_password` (when the password field in /etc/passwd seems to contain an encrypted password).


--

*`system.audit.user.password.last_changed`*::
+
--
type: date

The day the user's password was last changed.


--

