Skip to content

Commit 5db6546

Browse files
authored
Add entity to the top level namespaces in which it's being used (#2556)
Add entity to the top level namespace of which it's used in sub-types. For example, we want user.target.entity fields to be present. user.entity itself is a user type, so entity must be reused on the user type. This also removes custom generator code which was being used to workaround the fact that this wasn't true before.
1 parent d081b8f commit 5db6546

File tree

33 files changed

+14923
-2427
lines changed

33 files changed

+14923
-2427
lines changed

docs/reference/ecs-cloud.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,9 +41,9 @@ Note also that the `cloud` fields may be used directly at the root of the events
4141

4242
| Location | Field Set | Description |
4343
| --- | --- | --- |
44+
| `cloud.entity.*` | [entity](/reference/ecs-entity.md) | Fields to describe various types of entities across IT environments. |
4445
| `cloud.origin.*` | [cloud](/reference/ecs-cloud.md) | Provides the cloud information of the origin entity in case of an incoming request or event. |
4546
| `cloud.target.*` | [cloud](/reference/ecs-cloud.md) | Provides the cloud information of the target entity in case of an outgoing request or event. |
46-
| `cloud.target.entity.*` | [entity](/reference/ecs-entity.md) | Entity information for the target cloud entity. |
4747

4848
### Cloud field usage [_cloud_field_usage]
4949

docs/reference/ecs-entity.md

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -33,9 +33,10 @@ The entity fields provide a standardized way to represent and categorize differe
3333

3434
The `entity` fields are expected to be nested at:
3535

36-
* `cloud.target.entity`
36+
* `cloud.entity`
3737
* `host.entity`
38-
* `service.target.entity`
39-
* `user.target.entity`
38+
* `orchestrator.entity`
39+
* `service.entity`
40+
* `user.entity`
4041

4142
Note also that the `entity` fields are not expected to be used directly at the root of the events.

docs/reference/ecs-orchestrator.md

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,3 +32,8 @@ Fields that describe the resources which container orchestrators manage or act u
3232
| $$$field-orchestrator-type$$$ [orchestrator.type](#field-orchestrator-type) | Orchestrator cluster type (e.g. kubernetes, nomad or cloudfoundry).<br><br>type: keyword<br><br>example: `kubernetes` | extended |
3333

3434

35+
### Field sets that can be nested under Orchestrator [ecs-orchestrator-nestings]
36+
37+
| Location | Field Set | Description |
38+
| --- | --- | --- |
39+
| `orchestrator.entity.*` | [entity](/reference/ecs-entity.md) | Fields to describe various types of entities across IT environments. |

docs/reference/ecs-service.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,9 +43,9 @@ Note also that the `service` fields may be used directly at the root of the even
4343

4444
| Location | Field Set | Description |
4545
| --- | --- | --- |
46+
| `service.entity.*` | [entity](/reference/ecs-entity.md) | Fields to describe various types of entities across IT environments. |
4647
| `service.origin.*` | [service](/reference/ecs-service.md) | _Reusing the `service` fields in this location is currently considered beta._ Describes the origin service in case of an incoming request or event. |
4748
| `service.target.*` | [service](/reference/ecs-service.md) | _Reusing the `service` fields in this location is currently considered beta._ Describes the target service in case of an outgoing request or event. |
48-
| `service.target.entity.*` | [entity](/reference/ecs-entity.md) | Entity information for the target service. |
4949

5050
### Service field usage [_service_field_usage]
5151

docs/reference/ecs-user.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,10 +50,10 @@ Note also that the `user` fields may be used directly at the root of the events.
5050
| --- | --- | --- |
5151
| `user.changes.*` | [user](/reference/ecs-user.md) | Captures changes made to a user. |
5252
| `user.effective.*` | [user](/reference/ecs-user.md) | User whose privileges were assumed. |
53+
| `user.entity.*` | [entity](/reference/ecs-entity.md) | Fields to describe various types of entities across IT environments. |
5354
| `user.group.*` | [group](/reference/ecs-group.md) | User's group relevant to the event. |
5455
| `user.risk.*` | [risk](/reference/ecs-risk.md) | Fields for describing risk score and level. |
5556
| `user.target.*` | [user](/reference/ecs-user.md) | Targeted user of action taken. |
56-
| `user.target.entity.*` | [entity](/reference/ecs-entity.md) | Entity information for the targeted user. |
5757

5858
### User field usage [_user_field_usage]
5959

experimental/generated/beats/fields.ecs.yml

Lines changed: 1120 additions & 167 deletions
Large diffs are not rendered by default.

experimental/generated/csv/fields.csv

Lines changed: 138 additions & 15 deletions
Large diffs are not rendered by default.

0 commit comments

Comments
 (0)