[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-elastic-ecs-field-mappings":3,"mdc-8174bh-key":34,"related-org-elastic-ecs-field-mappings":6953,"related-repo-elastic-ecs-field-mappings":7125},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":23,"repoUrl":24,"updatedAt":25,"license":26,"forks":27,"topics":28,"repo":29,"sourceUrl":32,"mdContent":33},"ecs-field-mappings","define ECS field mappings for integrations","Use when defining field mappings for data streams, populating ecs.yml with ECS field references, selecting ECS categorization values, choosing custom field types, or troubleshooting mapping validation failures.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"elastic","Elastic","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Felastic.png",[12,16,19,20],{"name":13,"slug":14,"type":15},"Data Quality","data-quality","tag",{"name":17,"slug":18,"type":15},"Integrations","integrations",{"name":9,"slug":8,"type":15},{"name":21,"slug":22,"type":15},"Data Modeling","data-modeling",11,"https:\u002F\u002Fgithub.com\u002Felastic\u002Fintegration-skills","2026-07-12T07:47:13.472534","Apache-2.0",2,[],{"repoUrl":24,"stars":23,"forks":27,"topics":30,"description":31},[],null,"https:\u002F\u002Fgithub.com\u002Felastic\u002Fintegration-skills\u002Ftree\u002FHEAD\u002Fskills\u002Fecs-field-mappings","---\nname: ecs-field-mappings\ndescription: \"Use when defining field mappings for data streams, populating ecs.yml with ECS field references, selecting ECS categorization values, choosing custom field types, or troubleshooting mapping validation failures.\"\nlicense: Apache-2.0\nmetadata:\n  author: elastic\n  version: \"1.0\"\n---\n\n# ecs-field-mappings\n\n## When to use\n\nUse this skill when tasks include:\n- adding or modifying files under `data_stream\u002F\u003Cstream>\u002Ffields\u002F`\n- populating `ecs.yml` with ECS field references\n- selecting `event.kind`, `event.category`, `event.type`, and `event.outcome` values\n- choosing field `type` and mapping properties (`metric_type`, `dimension`, `multi_fields`, and related options)\n- checking whether a field already exists in ECS before adding custom fields\n- troubleshooting mapping validation\u002Fbuild failures from `elastic-package check`, `elastic-package lint`, or pipeline test schema checks\n\n## ECS dependency configuration\n\nEvery package needs `_dev\u002Fbuild\u002Fbuild.yml` at the package root. This file pins the ECS schema version used for field resolution.\n\n```yaml\ndependencies:\n  ecs:\n    reference: \"git@v9.3.0\"\n```\n\nThis file is **required** whenever the package has any field file. The scaffold does not generate it — create it manually. If it is missing or uses an outdated version, tests report ECS fields as undefined (e.g., `field \"destination.ip\" is undefined`).\n\n## Field files and roles\n\nA data stream's `fields\u002F` directory contains a small set of YAML files with distinct responsibilities:\n\n### `base-fields.yml`\n\nFixed routing constants and `@timestamp`. All six fields are ECS fields, so each entry uses `external: ecs`. Override `type` and `value` where the data stream needs a `constant_keyword` with a fixed value — the description is inherited from ECS automatically.\n\n```yaml\n- name: data_stream.type\n  external: ecs\n- name: data_stream.dataset\n  external: ecs\n- name: data_stream.namespace\n  external: ecs\n- name: event.module\n  external: ecs\n  type: constant_keyword\n  value: \u003Cpackage_name>\n- name: event.dataset\n  external: ecs\n  type: constant_keyword\n  value: \u003Cpackage_name>.\u003Cstream_name>\n- name: '@timestamp'\n  external: ecs\n```\n\nDo not add other fields here. Only these routing constants and `@timestamp` belong in `base-fields.yml`.\n\n### `constant_keyword` candidates\n\nFields that hold a single value for every document in a data stream should use `constant_keyword`. Beyond the routing constants in `base-fields.yml`, evaluate these:\n\n| Field | Why `constant_keyword` |\n|-------|------------------------|\n| `event.dataset` | One value per data stream by definition |\n| `event.module` | One value per package |\n| `data_stream.type` | Fixed per stream (`logs`\u002F`metrics`) |\n| `data_stream.dataset` | Fixed per stream |\n| `data_stream.namespace` | Set at deployment, constant within index |\n| `observer.vendor` | Package represents one vendor |\n| `observer.product` | Package represents one product |\n\nWhen a `constant_keyword` field is also an ECS field (e.g., `observer.vendor`), use `external: ecs` with the type override. This inherits the description from ECS and avoids manual duplication. Place the definition in the appropriate field file (`ecs.yml` for most ECS fields, `base-fields.yml` for routing constants):\n\n```yaml\n- name: observer.vendor\n  external: ecs\n  type: constant_keyword\n  value: Acme Corp\n```\n\n**`remove_from_source` option:** Because `constant_keyword` stores the value once in index metadata, it does not need to appear in every document's `_source`. Elasticsearch handles this automatically — no explicit `_source.excludes` configuration is needed. This saves storage when the value is always the same.\n\n### `ecs.yml`\n\n**Populate this file with every ECS field the pipeline sets.** Use only `name` and `external: ecs` for each entry — no type, no description. The type is resolved from the ECS schema via `_dev\u002Fbuild\u002Fbuild.yml`.\n\n`external: ecs` must be used whenever a field name exists in ECS ([wiki reference](https:\u002F\u002Fgithub.com\u002Felastic\u002Fintegrations\u002Fwiki\u002FFleet-Package-Code-Review-Comments#defining-an-ecs-field-without-using-an-external-definition)). This applies across field files — `ecs.yml`, `base-fields.yml`, and any file that defines an ECS field. You may override properties (e.g., `type: constant_keyword`, `value:`) while still using `external: ecs` — the description is inherited from ECS. Do not use `external: ecs` in `fields.yml`, `agent.yml`, or `beats.yml` — those files define non-ECS fields.\n\n```yaml\n- name: event.kind\n  external: ecs\n- name: event.category\n  external: ecs\n- name: event.type\n  external: ecs\n- name: event.outcome\n  external: ecs\n- name: event.action\n  external: ecs\n- name: source.ip\n  external: ecs\n- name: source.port\n  external: ecs\n- name: destination.ip\n  external: ecs\n- name: user.name\n  external: ecs\n- name: related.ip\n  external: ecs\n- name: related.user\n  external: ecs\n```\n\nWhen attaching extra metadata to an ECS field (for example making a field a TSDB dimension or a constant_keyword with a fixed value), combine `external: ecs` with that metadata. The description is inherited from ECS. Place the definition in `ecs.yml` (or `base-fields.yml` for routing constants):\n\n```yaml\n- name: observer.vendor\n  external: ecs\n  type: constant_keyword\n  value: Acme Corp\n```\n\n### `fields.yml`\n\nIntegration-specific custom (non-ECS) fields only. Use a nested `group` hierarchy for the vendor namespace:\n\n```yaml\n- name: acme.firewall\n  type: group\n  fields:\n    - name: rule_id\n      type: keyword\n    - name: policy_name\n      type: keyword\n    - name: bytes_in\n      type: long\n      unit: byte\n      metric_type: gauge\n```\n\nGroups do not need to be declared as `type: object` — defining a `group` with nested `fields` is sufficient. The object structure is implicit.\n\n#### `labels.*` exception\n\n`labels` is a core ECS object (`type: object`, `object_type: keyword`) designed for ad-hoc key-value metadata. Subkeys under `labels.*` do **not** require vendor namespacing — this is the one exception to the vendor-prefix rule.\n\nUse `labels.*` for simple keyword flags or integration-internal markers (e.g., `labels.is_ioc_transform_source`). Use the vendor namespace for structured or nested data from an upstream source.\n\n#### Flags vs structured data\n\nBoolean flags and simple tags can live flat under the vendor group:\n\n```yaml\n- name: acme.firewall\n  type: group\n  fields:\n    - name: is_encrypted\n      type: boolean\n    - name: policy_name\n      type: keyword\n```\n\nStructured data from the source should use sub-groups for logical hierarchy:\n\n```yaml\n- name: acme.firewall\n  type: group\n  fields:\n    - name: rule\n      type: group\n      fields:\n        - name: id\n          type: keyword\n        - name: name\n          type: keyword\n        - name: action\n          type: keyword\n```\n\n### `agent.yml`\n\nNon-ECS fields populated by the Elastic Agent or Beats framework but not covered by ECS. Include only when the input type emits these fields. Typical fields: `cloud.image.id`, `cloud.instance.id`, `host.containerized`, `host.os.build`, `host.os.codename`, `input.type`, `log.offset`.\n\nSee `references\u002Froot-and-core-fields.md` for full YAML samples.\n\n### `beats.yml`\n\nFilebeat\u002FBeats-specific fields not covered by ECS. Minimal form contains `input.type` and `log.offset`. Some inputs also emit `log.flags` or `log.file.*` sub-fields.\n\nSee `references\u002Froot-and-core-fields.md` for full YAML samples.\n\n## ECS field selection\n\nPrefer ECS fields whenever semantics match. If no ECS field exists for the data, add it under the package namespace in `fields.yml`.\n\n### Categorization quick reference\n\n| Field | Type | Notes |\n| --- | --- | --- |\n| `event.kind` | keyword | Highest-level classification. |\n| `event.category` | keyword[] | Broad domain buckets — always an array. |\n| `event.type` | keyword[] | Sub-buckets within category — always an array. |\n| `event.outcome` | keyword | `success`, `failure`, `unknown`; only set when meaningful. |\n\n- `event.kind`: `alert`, `asset`, `enrichment`, `event`, `metric`, `pipeline_error`, `signal`, `state`\n- `event.category`: `api`, `authentication`, `configuration`, `database`, `driver`, `email`, `file`, `host`, `iam`, `intrusion_detection`, `library`, `malware`, `network`, `package`, `process`, `registry`, `session`, `threat`, `vulnerability`, `web`\n- `event.type`: `access`, `admin`, `allowed`, `change`, `connection`, `creation`, `deletion`, `denied`, `device`, `end`, `error`, `group`, `indicator`, `info`, `installation`, `protocol`, `start`, `user`\n\nDecision workflow:\n1. `event.kind`: `event` for normal logs, `metric` for measurements, `state` for snapshots, `pipeline_error` in `on_failure`\n2. `event.category`: one or more values (array) for the broad domain\n3. `event.type`: one or more values (array) for operation style\n4. `event.outcome`: only when a clear success\u002Ffailure\u002Funknown applies; omit for informational\u002Fmetric events\n5. If no allowed value fits, leave the field empty — do not invent values\n\nUse `event.action` for source-specific verbs (`blocked`, `dropped`, `authenticated`).\n\nSee `references\u002Fcategorization-cheatsheet.md` for full worked examples.\n\n### Timestamp fields\n\nECS defines several timestamp fields with distinct semantics. Use them correctly:\n\n| Field | When to use | Set by |\n| --- | --- | --- |\n| `@timestamp` | The primary event timestamp. Parse from the source event data. Required. | Integration pipeline |\n| `event.created` | When the event was first created or recorded by the source system, if different from `@timestamp`. | Integration pipeline |\n| `event.start` | When an activity or period began (e.g., session start, connection start). | Integration pipeline |\n| `event.end` | When an activity or period ended (e.g., session end, connection close). | Integration pipeline |\n| `event.ingested` | When the event was ingested into Elasticsearch. | **Elasticsearch (outside the integration)** |\n\n**`event.ingested` must NEVER be set by an integration pipeline.** It is managed automatically by Elasticsearch's final pipeline. Do not add a `set` processor for `event.ingested`.\n\nWhen the source data contains multiple timestamps:\n1. Map the primary event timestamp to `@timestamp`.\n2. If another timestamp represents when the event was first recorded\u002Fcreated, map it to `event.created`.\n3. If timestamps represent the start or end of an activity, map them to `event.start` and `event.end`.\n4. If a timestamp does not match the semantics of any of the above, map it to a custom field under the vendor namespace with `type: date` in `fields.yml`.\n\n### Reusable fieldset nesting rules\n\nSome ECS field sets must be nested under a parent entity — they are not valid at document root.\n\n**`geo`** — must be nested under: `client.geo`, `destination.geo`, `host.geo`, `observer.geo`, `server.geo`, `source.geo`, `threat.indicator.geo`\n\nRoot-level `geo.*` fields are not recognized and will appear unmapped. Always set `target_field` on the `geoip` processor:\n\n```yaml\n- geoip:\n    field: source.ip\n    target_field: source.geo\n    ignore_missing: true\n```\n\n**`as`** (Autonomous System) — nested under: `client.as`, `destination.as`, `server.as`, `source.as`\n\nWhen using `geoip` for geolocation, always also perform an ASN lookup using `GeoLite2-ASN.mmdb` and rename the raw output fields to ECS names. The `geoip` ASN processor outputs `asn` and `organization_name`, which must be renamed to `as.number` and `as.organization.name`:\n\n```yaml\n- geoip:\n    database_file: GeoLite2-ASN.mmdb\n    field: source.ip\n    target_field: source.as\n    properties:\n      - asn\n      - organization_name\n    ignore_missing: true\n- rename:\n    field: source.as.asn\n    target_field: source.as.number\n    ignore_missing: true\n- rename:\n    field: source.as.organization_name\n    target_field: source.as.organization.name\n    ignore_missing: true\n```\n\nSee the `ingest-pipelines` skill → `references\u002Fprocessor-cookbook.md` for the full geo+ASN pattern with both source and destination.\n\n**`os`** — nested under: `host.os`, `observer.os`, `user_agent.os`\n\n### Nested (array-of-objects) ECS fields\n\nSome ECS fields use `type: nested`, meaning they hold an **array of objects** where each object groups related sub-fields together. The pipeline must produce this structure — do **not** flatten these into parallel scalar arrays.\n\n**ECS fields that use `nested` type:**\n\n| Field | Contains |\n|---|---|\n| `email.attachments` | `file.name`, `file.size`, `file.extension`, `file.mime_type`, `file.hash.*` |\n| `threat.enrichments` | `indicator.*`, `matched.*` |\n| `threat.indicator.file.elf.sections` | `name`, `physical_size`, `virtual_size`, etc. |\n| `threat.indicator.file.pe.sections` | `name`, `physical_size`, `virtual_size`, etc. |\n| `process.elf.sections` | `name`, `physical_size`, `virtual_size`, etc. |\n| `process.pe.sections` | `name`, `physical_size`, `virtual_size`, etc. |\n\n**Anti-pattern — parallel arrays (WRONG):**\n\n```json\n{\n  \"email\": {\n    \"attachments\": {\n      \"file\": {\n        \"name\": [\"a.pdf\", \"b.pdf\"],\n        \"size\": [1024, 2048]\n      }\n    }\n  }\n}\n```\n\nThis loses the association between each attachment's name and size. Queries cannot isolate individual objects.\n\n**Correct — array of objects:**\n\n```json\n{\n  \"email\": {\n    \"attachments\": [\n      { \"file\": { \"name\": \"a.pdf\", \"size\": 1024 } },\n      { \"file\": { \"name\": \"b.pdf\", \"size\": 2048 } }\n    ]\n  }\n}\n```\n\n**`ecs.yml` declaration:** declare only the parent `nested` field with `external: ecs`. Child fields (`email.attachments.file.name`, etc.) inherit their types from the ECS schema — do not redeclare them individually.\n\n```yaml\n- name: email.attachments\n  external: ecs\n```\n\n**Pipeline construction:** when source data delivers attachment metadata as separate parallel arrays (e.g., a comma-separated list of filenames and a separate list of sizes), use a `script` processor to zip them into an array of objects. See `ingest-pipelines` → `references\u002Fpainless-patterns.md` for array construction patterns and `references\u002Fprocessor-cookbook.md` → **Foreach semantics** for iterating over array elements.\n\n```yaml\n- script:\n    tag: build_email_attachments\n    description: Build email.attachments as array of nested objects from parallel source arrays.\n    lang: painless\n    if: ctx.json?.file_names instanceof List && ctx.json?.file_sizes instanceof List\n    source: |-\n      def names = ctx.json.file_names;\n      def sizes = ctx.json.file_sizes;\n      int len = Math.min(names.size(), sizes.size());\n      def attachments = new ArrayList(len);\n      for (int i = 0; i \u003C len; i++) {\n        def attachment = new HashMap();\n        def file = new HashMap();\n        file.put('name', names.get(i));\n        file.put('size', sizes.get(i));\n        attachment.put('file', file);\n        attachments.add(attachment);\n      }\n      ctx.email = ctx.email ?: [:];\n      ctx.email.attachments = attachments;\n```\n\nWhen source data already delivers each attachment as a separate object (e.g., a JSON array of attachment objects), no zipping is needed — use `rename` or `set` with `copy_from` to place the array at `email.attachments` directly.\n\n## Custom field types\n\nFor non-ECS fields in `fields.yml`:\n- `keyword` for identifiers and exact-match strings\n- `constant_keyword` for fixed values (dataset\u002Fmodule constants)\n- `long`, `double`, `scaled_float` for metrics and numeric values\n- `date` \u002F `date_nanos` for timestamps (`date_nanos` only when sub-millisecond precision is truly needed)\n- `ip` for IP addresses\n- `boolean` for true\u002Ffalse (avoid string booleans in pipelines)\n- `geo_point` for lat\u002Flon coordinates\n- `group` with nested `fields` for logical structure — no need to separately declare intermediate `object` nodes\n- `flattened` for arbitrary key\u002Fvalue blobs with unknown keys\n- `nested` for arrays of objects requiring per-object query isolation (heavier than group)\n- `text` \u002F `match_only_text` for full-text content; add a `keyword` sub-field via `multi_fields` when aggregation is also needed\n\nUseful properties on numeric fields: `metric_type` (`gauge` or `counter`), `unit` (e.g., `byte`, `percent`, `ms`), `dimension` for low-cardinality TSDB fields.\n\nSee `references\u002Fmapping-type-matrix.md` for the full type reference.\n\n## Field naming conventions\n\n| Rule | DO | DON'T |\n|------|-----|-------|\n| Use snake_case | `user_name`, `request_count` | `userName`, `RequestCount` |\n| Use lowercase | `source_ip` | `Source_IP` |\n| No asterisks in names | `network.bytes` | `network.*` (literal asterisk) |\n| Use groups for hierarchy | `vendor.module.field` as nested group | `vendor.module.field` as flat dotted name |\n\nField names must never contain literal `*` characters. An asterisk in a field name is almost always a copy-paste error from documentation or wildcard patterns. Use a `group` with known subfields or `flattened` for dynamic keys instead.\n\n## Dotted field names vs nested groups\n\nBoth styles are valid in field files:\n\n```yaml\n# Dotted (flat) — common for ECS fields in ecs.yml\n- name: source.ip\n  external: ecs\n\n# Nested group — common for custom fields\n- name: acme.firewall\n  type: group\n  fields:\n    - name: rule_id\n      type: keyword\n```\n\nPipeline expected output (`*-expected.json`) always uses nested object form regardless of how the source data represented the field. A source `\"host.name\": \"myhost\"` produces `{\"host\": {\"name\": \"myhost\"}}` in the output.\n\nWhen source data contains literal dotted keys that Elasticsearch would otherwise expand, use `dot_expander`:\n\n```yaml\n- dot_expander:\n    field: \"*\"\n    override: true\n```\n\n## geo_point field handling\n\nIn pipeline test expected outputs, `geo_point` fields appear as objects with `lat` and `lon` keys:\n\n```json\n\"source\": {\n  \"geo\": {\n    \"location\": { \"lat\": 51.5142, \"lon\": -0.0931 },\n    \"city_name\": \"London\",\n    \"country_iso_code\": \"GB\"\n  }\n}\n```\n\nThese sub-fields do not need entries in `fields.yml` — they are part of the `geo_point` type mapping. Only the `*.geo.location` field (type `geo_point`) needs to be in `ecs.yml` for non-standard parent prefixes where `ecs@mappings` does not apply.\n\n## Common pipeline categorization patterns\n\n### Web access\n\n```yaml\n- set:\n    field: event.kind\n    value: event\n- append:\n    field: event.category\n    value: web\n- append:\n    field: event.type\n    value: access\n```\n\n### Outcome from HTTP status\n\n```yaml\n- set:\n    field: event.outcome\n    value: success\n    if: \"ctx?.http?.response?.status_code != null && ctx.http.response.status_code \u003C 400\"\n- set:\n    field: event.outcome\n    value: failure\n    if: \"ctx?.http?.response?.status_code != null && ctx.http.response.status_code >= 400\"\n```\n\n### Pipeline error fallback\n\n```yaml\non_failure:\n  - set:\n      field: event.kind\n      value: pipeline_error\n```\n\n## Troubleshooting: \"field X is undefined\" for ECS fields\n\nWhen tests report `field \"destination.ip\" is undefined` for standard ECS fields:\n\n1. Check `_dev\u002Fbuild\u002Fbuild.yml` exists at the package root\n2. Check `dependencies.ecs.reference` is set (use `git@v9.3.0`)\n3. Check the field is listed in `ecs.yml` with `external: ecs`\n\nFix the root cause. Do not work around it by:\n- Adding ECS fields with full type definitions to `fields.yml` without `external: ecs`\n- Skipping `external: ecs` and defining ECS field types\u002Fdescriptions manually\n\n**Exception:** Custom (non-ECS) fields reported as undefined must be defined in `fields.yml`.\n\n## Common failure patterns\n\n- **missing `_dev\u002Fbuild\u002Fbuild.yml`** — all ECS fields reported undefined; create with `dependencies.ecs.reference`\n- **outdated ECS version in `build.yml`** — fields from newer ECS versions undefined; update reference to `git@v9.3.0`\n- **ECS field set in pipeline but missing from `ecs.yml`** — field is undefined in test schema validation; add it to `ecs.yml`\n- **ECS field defined without `external: ecs`** — descriptions and types diverge from ECS; always use `external: ecs` for ECS fields, with overrides as needed\n- **`metric_type` on non-numeric field** — lint error\n- **`geo.*` at document root** — unmapped; always nest under a parent entity\n- **`event.category` or `event.type` set as scalar** — must use `append` processor, not `set`\n- **`nested` ECS field mapped as parallel arrays** — `email.attachments`, `threat.enrichments`, and similar `nested` fields must be arrays of objects, not objects with parallel scalar arrays; see the *Nested (array-of-objects) ECS fields* section above\n\n## Validation loop\n\n```bash\nelastic-package lint\nelastic-package check\nelastic-package test pipeline --data-streams \u003Cstream>\n```\n\n## References\n\n- `references\u002Fmapping-type-matrix.md`\n- `references\u002Fcategorization-cheatsheet.md`\n- `references\u002Froot-and-core-fields.md`\n- `references\u002Ffieldset-links.md`\n- [ECS field reference](https:\u002F\u002Fwww.elastic.co\u002Fdocs\u002Freference\u002Fecs\u002Fecs-field-reference)\n",{"data":35,"body":38},{"name":4,"description":6,"license":26,"metadata":36},{"author":8,"version":37},"1.0",{"type":39,"children":40},"root",[41,48,55,61,187,193,206,277,298,304,317,328,372,679,698,709,728,896,936,1009,1048,1057,1087,1173,1571,1596,1666,1675,1688,1886,1914,1927,1966,1986,1992,1997,2119,2124,2330,2339,2393,2406,2415,2449,2459,2465,2476,2482,2615,2964,2969,3050,3083,3095,3101,3106,3246,3275,3280,3340,3346,3351,3413,3442,3516,3557,3613,3860,3881,3915,3921,3947,3963,4196,4204,4435,4440,4448,4711,4748,4790,4836,5061,5095,5101,5112,5295,5358,5370,5376,5526,5553,5559,5564,5710,5739,5751,5813,5819,5846,6060,6109,6115,6121,6269,6275,6422,6428,6495,6501,6513,6562,6567,6599,6615,6621,6813,6819,6895,6901,6947],{"type":42,"tag":43,"props":44,"children":45},"element","h1",{"id":4},[46],{"type":47,"value":4},"text",{"type":42,"tag":49,"props":50,"children":52},"h2",{"id":51},"when-to-use",[53],{"type":47,"value":54},"When to use",{"type":42,"tag":56,"props":57,"children":58},"p",{},[59],{"type":47,"value":60},"Use this skill when tasks include:",{"type":42,"tag":62,"props":63,"children":64},"ul",{},[65,78,91,127,162,167],{"type":42,"tag":66,"props":67,"children":68},"li",{},[69,71],{"type":47,"value":70},"adding or modifying files under ",{"type":42,"tag":72,"props":73,"children":75},"code",{"className":74},[],[76],{"type":47,"value":77},"data_stream\u002F\u003Cstream>\u002Ffields\u002F",{"type":42,"tag":66,"props":79,"children":80},{},[81,83,89],{"type":47,"value":82},"populating ",{"type":42,"tag":72,"props":84,"children":86},{"className":85},[],[87],{"type":47,"value":88},"ecs.yml",{"type":47,"value":90}," with ECS field references",{"type":42,"tag":66,"props":92,"children":93},{},[94,96,102,104,110,111,117,119,125],{"type":47,"value":95},"selecting ",{"type":42,"tag":72,"props":97,"children":99},{"className":98},[],[100],{"type":47,"value":101},"event.kind",{"type":47,"value":103},", ",{"type":42,"tag":72,"props":105,"children":107},{"className":106},[],[108],{"type":47,"value":109},"event.category",{"type":47,"value":103},{"type":42,"tag":72,"props":112,"children":114},{"className":113},[],[115],{"type":47,"value":116},"event.type",{"type":47,"value":118},", and ",{"type":42,"tag":72,"props":120,"children":122},{"className":121},[],[123],{"type":47,"value":124},"event.outcome",{"type":47,"value":126}," values",{"type":42,"tag":66,"props":128,"children":129},{},[130,132,138,140,146,147,153,154,160],{"type":47,"value":131},"choosing field ",{"type":42,"tag":72,"props":133,"children":135},{"className":134},[],[136],{"type":47,"value":137},"type",{"type":47,"value":139}," and mapping properties (",{"type":42,"tag":72,"props":141,"children":143},{"className":142},[],[144],{"type":47,"value":145},"metric_type",{"type":47,"value":103},{"type":42,"tag":72,"props":148,"children":150},{"className":149},[],[151],{"type":47,"value":152},"dimension",{"type":47,"value":103},{"type":42,"tag":72,"props":155,"children":157},{"className":156},[],[158],{"type":47,"value":159},"multi_fields",{"type":47,"value":161},", and related options)",{"type":42,"tag":66,"props":163,"children":164},{},[165],{"type":47,"value":166},"checking whether a field already exists in ECS before adding custom fields",{"type":42,"tag":66,"props":168,"children":169},{},[170,172,178,179,185],{"type":47,"value":171},"troubleshooting mapping validation\u002Fbuild failures from ",{"type":42,"tag":72,"props":173,"children":175},{"className":174},[],[176],{"type":47,"value":177},"elastic-package check",{"type":47,"value":103},{"type":42,"tag":72,"props":180,"children":182},{"className":181},[],[183],{"type":47,"value":184},"elastic-package lint",{"type":47,"value":186},", or pipeline test schema checks",{"type":42,"tag":49,"props":188,"children":190},{"id":189},"ecs-dependency-configuration",[191],{"type":47,"value":192},"ECS dependency configuration",{"type":42,"tag":56,"props":194,"children":195},{},[196,198,204],{"type":47,"value":197},"Every package needs ",{"type":42,"tag":72,"props":199,"children":201},{"className":200},[],[202],{"type":47,"value":203},"_dev\u002Fbuild\u002Fbuild.yml",{"type":47,"value":205}," at the package root. This file pins the ECS schema version used for field resolution.",{"type":42,"tag":207,"props":208,"children":213},"pre",{"className":209,"code":210,"language":211,"meta":212,"style":212},"language-yaml shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","dependencies:\n  ecs:\n    reference: \"git@v9.3.0\"\n","yaml","",[214],{"type":42,"tag":72,"props":215,"children":216},{"__ignoreMap":212},[217,235,247],{"type":42,"tag":218,"props":219,"children":222},"span",{"class":220,"line":221},"line",1,[223,229],{"type":42,"tag":218,"props":224,"children":226},{"style":225},"--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178",[227],{"type":47,"value":228},"dependencies",{"type":42,"tag":218,"props":230,"children":232},{"style":231},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[233],{"type":47,"value":234},":\n",{"type":42,"tag":218,"props":236,"children":237},{"class":220,"line":27},[238,243],{"type":42,"tag":218,"props":239,"children":240},{"style":225},[241],{"type":47,"value":242},"  ecs",{"type":42,"tag":218,"props":244,"children":245},{"style":231},[246],{"type":47,"value":234},{"type":42,"tag":218,"props":248,"children":250},{"class":220,"line":249},3,[251,256,261,266,272],{"type":42,"tag":218,"props":252,"children":253},{"style":225},[254],{"type":47,"value":255},"    reference",{"type":42,"tag":218,"props":257,"children":258},{"style":231},[259],{"type":47,"value":260},":",{"type":42,"tag":218,"props":262,"children":263},{"style":231},[264],{"type":47,"value":265}," \"",{"type":42,"tag":218,"props":267,"children":269},{"style":268},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[270],{"type":47,"value":271},"git@v9.3.0",{"type":42,"tag":218,"props":273,"children":274},{"style":231},[275],{"type":47,"value":276},"\"\n",{"type":42,"tag":56,"props":278,"children":279},{},[280,282,288,290,296],{"type":47,"value":281},"This file is ",{"type":42,"tag":283,"props":284,"children":285},"strong",{},[286],{"type":47,"value":287},"required",{"type":47,"value":289}," whenever the package has any field file. The scaffold does not generate it — create it manually. If it is missing or uses an outdated version, tests report ECS fields as undefined (e.g., ",{"type":42,"tag":72,"props":291,"children":293},{"className":292},[],[294],{"type":47,"value":295},"field \"destination.ip\" is undefined",{"type":47,"value":297},").",{"type":42,"tag":49,"props":299,"children":301},{"id":300},"field-files-and-roles",[302],{"type":47,"value":303},"Field files and roles",{"type":42,"tag":56,"props":305,"children":306},{},[307,309,315],{"type":47,"value":308},"A data stream's ",{"type":42,"tag":72,"props":310,"children":312},{"className":311},[],[313],{"type":47,"value":314},"fields\u002F",{"type":47,"value":316}," directory contains a small set of YAML files with distinct responsibilities:",{"type":42,"tag":318,"props":319,"children":321},"h3",{"id":320},"base-fieldsyml",[322],{"type":42,"tag":72,"props":323,"children":325},{"className":324},[],[326],{"type":47,"value":327},"base-fields.yml",{"type":42,"tag":56,"props":329,"children":330},{},[331,333,339,341,347,349,354,356,362,364,370],{"type":47,"value":332},"Fixed routing constants and ",{"type":42,"tag":72,"props":334,"children":336},{"className":335},[],[337],{"type":47,"value":338},"@timestamp",{"type":47,"value":340},". All six fields are ECS fields, so each entry uses ",{"type":42,"tag":72,"props":342,"children":344},{"className":343},[],[345],{"type":47,"value":346},"external: ecs",{"type":47,"value":348},". Override ",{"type":42,"tag":72,"props":350,"children":352},{"className":351},[],[353],{"type":47,"value":137},{"type":47,"value":355}," and ",{"type":42,"tag":72,"props":357,"children":359},{"className":358},[],[360],{"type":47,"value":361},"value",{"type":47,"value":363}," where the data stream needs a ",{"type":42,"tag":72,"props":365,"children":367},{"className":366},[],[368],{"type":47,"value":369},"constant_keyword",{"type":47,"value":371}," with a fixed value — the description is inherited from ECS automatically.",{"type":42,"tag":207,"props":373,"children":375},{"className":209,"code":374,"language":211,"meta":212,"style":212},"- name: data_stream.type\n  external: ecs\n- name: data_stream.dataset\n  external: ecs\n- name: data_stream.namespace\n  external: ecs\n- name: event.module\n  external: ecs\n  type: constant_keyword\n  value: \u003Cpackage_name>\n- name: event.dataset\n  external: ecs\n  type: constant_keyword\n  value: \u003Cpackage_name>.\u003Cstream_name>\n- name: '@timestamp'\n  external: ecs\n",[376],{"type":42,"tag":72,"props":377,"children":378},{"__ignoreMap":212},[379,401,418,438,454,475,491,512,528,546,564,584,600,616,633,663],{"type":42,"tag":218,"props":380,"children":381},{"class":220,"line":221},[382,387,392,396],{"type":42,"tag":218,"props":383,"children":384},{"style":231},[385],{"type":47,"value":386},"-",{"type":42,"tag":218,"props":388,"children":389},{"style":225},[390],{"type":47,"value":391}," name",{"type":42,"tag":218,"props":393,"children":394},{"style":231},[395],{"type":47,"value":260},{"type":42,"tag":218,"props":397,"children":398},{"style":268},[399],{"type":47,"value":400}," data_stream.type\n",{"type":42,"tag":218,"props":402,"children":403},{"class":220,"line":27},[404,409,413],{"type":42,"tag":218,"props":405,"children":406},{"style":225},[407],{"type":47,"value":408},"  external",{"type":42,"tag":218,"props":410,"children":411},{"style":231},[412],{"type":47,"value":260},{"type":42,"tag":218,"props":414,"children":415},{"style":268},[416],{"type":47,"value":417}," ecs\n",{"type":42,"tag":218,"props":419,"children":420},{"class":220,"line":249},[421,425,429,433],{"type":42,"tag":218,"props":422,"children":423},{"style":231},[424],{"type":47,"value":386},{"type":42,"tag":218,"props":426,"children":427},{"style":225},[428],{"type":47,"value":391},{"type":42,"tag":218,"props":430,"children":431},{"style":231},[432],{"type":47,"value":260},{"type":42,"tag":218,"props":434,"children":435},{"style":268},[436],{"type":47,"value":437}," data_stream.dataset\n",{"type":42,"tag":218,"props":439,"children":441},{"class":220,"line":440},4,[442,446,450],{"type":42,"tag":218,"props":443,"children":444},{"style":225},[445],{"type":47,"value":408},{"type":42,"tag":218,"props":447,"children":448},{"style":231},[449],{"type":47,"value":260},{"type":42,"tag":218,"props":451,"children":452},{"style":268},[453],{"type":47,"value":417},{"type":42,"tag":218,"props":455,"children":457},{"class":220,"line":456},5,[458,462,466,470],{"type":42,"tag":218,"props":459,"children":460},{"style":231},[461],{"type":47,"value":386},{"type":42,"tag":218,"props":463,"children":464},{"style":225},[465],{"type":47,"value":391},{"type":42,"tag":218,"props":467,"children":468},{"style":231},[469],{"type":47,"value":260},{"type":42,"tag":218,"props":471,"children":472},{"style":268},[473],{"type":47,"value":474}," data_stream.namespace\n",{"type":42,"tag":218,"props":476,"children":478},{"class":220,"line":477},6,[479,483,487],{"type":42,"tag":218,"props":480,"children":481},{"style":225},[482],{"type":47,"value":408},{"type":42,"tag":218,"props":484,"children":485},{"style":231},[486],{"type":47,"value":260},{"type":42,"tag":218,"props":488,"children":489},{"style":268},[490],{"type":47,"value":417},{"type":42,"tag":218,"props":492,"children":494},{"class":220,"line":493},7,[495,499,503,507],{"type":42,"tag":218,"props":496,"children":497},{"style":231},[498],{"type":47,"value":386},{"type":42,"tag":218,"props":500,"children":501},{"style":225},[502],{"type":47,"value":391},{"type":42,"tag":218,"props":504,"children":505},{"style":231},[506],{"type":47,"value":260},{"type":42,"tag":218,"props":508,"children":509},{"style":268},[510],{"type":47,"value":511}," event.module\n",{"type":42,"tag":218,"props":513,"children":515},{"class":220,"line":514},8,[516,520,524],{"type":42,"tag":218,"props":517,"children":518},{"style":225},[519],{"type":47,"value":408},{"type":42,"tag":218,"props":521,"children":522},{"style":231},[523],{"type":47,"value":260},{"type":42,"tag":218,"props":525,"children":526},{"style":268},[527],{"type":47,"value":417},{"type":42,"tag":218,"props":529,"children":531},{"class":220,"line":530},9,[532,537,541],{"type":42,"tag":218,"props":533,"children":534},{"style":225},[535],{"type":47,"value":536},"  type",{"type":42,"tag":218,"props":538,"children":539},{"style":231},[540],{"type":47,"value":260},{"type":42,"tag":218,"props":542,"children":543},{"style":268},[544],{"type":47,"value":545}," constant_keyword\n",{"type":42,"tag":218,"props":547,"children":549},{"class":220,"line":548},10,[550,555,559],{"type":42,"tag":218,"props":551,"children":552},{"style":225},[553],{"type":47,"value":554},"  value",{"type":42,"tag":218,"props":556,"children":557},{"style":231},[558],{"type":47,"value":260},{"type":42,"tag":218,"props":560,"children":561},{"style":268},[562],{"type":47,"value":563}," \u003Cpackage_name>\n",{"type":42,"tag":218,"props":565,"children":566},{"class":220,"line":23},[567,571,575,579],{"type":42,"tag":218,"props":568,"children":569},{"style":231},[570],{"type":47,"value":386},{"type":42,"tag":218,"props":572,"children":573},{"style":225},[574],{"type":47,"value":391},{"type":42,"tag":218,"props":576,"children":577},{"style":231},[578],{"type":47,"value":260},{"type":42,"tag":218,"props":580,"children":581},{"style":268},[582],{"type":47,"value":583}," event.dataset\n",{"type":42,"tag":218,"props":585,"children":587},{"class":220,"line":586},12,[588,592,596],{"type":42,"tag":218,"props":589,"children":590},{"style":225},[591],{"type":47,"value":408},{"type":42,"tag":218,"props":593,"children":594},{"style":231},[595],{"type":47,"value":260},{"type":42,"tag":218,"props":597,"children":598},{"style":268},[599],{"type":47,"value":417},{"type":42,"tag":218,"props":601,"children":603},{"class":220,"line":602},13,[604,608,612],{"type":42,"tag":218,"props":605,"children":606},{"style":225},[607],{"type":47,"value":536},{"type":42,"tag":218,"props":609,"children":610},{"style":231},[611],{"type":47,"value":260},{"type":42,"tag":218,"props":613,"children":614},{"style":268},[615],{"type":47,"value":545},{"type":42,"tag":218,"props":617,"children":619},{"class":220,"line":618},14,[620,624,628],{"type":42,"tag":218,"props":621,"children":622},{"style":225},[623],{"type":47,"value":554},{"type":42,"tag":218,"props":625,"children":626},{"style":231},[627],{"type":47,"value":260},{"type":42,"tag":218,"props":629,"children":630},{"style":268},[631],{"type":47,"value":632}," \u003Cpackage_name>.\u003Cstream_name>\n",{"type":42,"tag":218,"props":634,"children":636},{"class":220,"line":635},15,[637,641,645,649,654,658],{"type":42,"tag":218,"props":638,"children":639},{"style":231},[640],{"type":47,"value":386},{"type":42,"tag":218,"props":642,"children":643},{"style":225},[644],{"type":47,"value":391},{"type":42,"tag":218,"props":646,"children":647},{"style":231},[648],{"type":47,"value":260},{"type":42,"tag":218,"props":650,"children":651},{"style":231},[652],{"type":47,"value":653}," '",{"type":42,"tag":218,"props":655,"children":656},{"style":268},[657],{"type":47,"value":338},{"type":42,"tag":218,"props":659,"children":660},{"style":231},[661],{"type":47,"value":662},"'\n",{"type":42,"tag":218,"props":664,"children":666},{"class":220,"line":665},16,[667,671,675],{"type":42,"tag":218,"props":668,"children":669},{"style":225},[670],{"type":47,"value":408},{"type":42,"tag":218,"props":672,"children":673},{"style":231},[674],{"type":47,"value":260},{"type":42,"tag":218,"props":676,"children":677},{"style":268},[678],{"type":47,"value":417},{"type":42,"tag":56,"props":680,"children":681},{},[682,684,689,691,696],{"type":47,"value":683},"Do not add other fields here. Only these routing constants and ",{"type":42,"tag":72,"props":685,"children":687},{"className":686},[],[688],{"type":47,"value":338},{"type":47,"value":690}," belong in ",{"type":42,"tag":72,"props":692,"children":694},{"className":693},[],[695],{"type":47,"value":327},{"type":47,"value":697},".",{"type":42,"tag":318,"props":699,"children":701},{"id":700},"constant_keyword-candidates",[702,707],{"type":42,"tag":72,"props":703,"children":705},{"className":704},[],[706],{"type":47,"value":369},{"type":47,"value":708}," candidates",{"type":42,"tag":56,"props":710,"children":711},{},[712,714,719,721,726],{"type":47,"value":713},"Fields that hold a single value for every document in a data stream should use ",{"type":42,"tag":72,"props":715,"children":717},{"className":716},[],[718],{"type":47,"value":369},{"type":47,"value":720},". Beyond the routing constants in ",{"type":42,"tag":72,"props":722,"children":724},{"className":723},[],[725],{"type":47,"value":327},{"type":47,"value":727},", evaluate these:",{"type":42,"tag":729,"props":730,"children":731},"table",{},[732,756],{"type":42,"tag":733,"props":734,"children":735},"thead",{},[736],{"type":42,"tag":737,"props":738,"children":739},"tr",{},[740,746],{"type":42,"tag":741,"props":742,"children":743},"th",{},[744],{"type":47,"value":745},"Field",{"type":42,"tag":741,"props":747,"children":748},{},[749,751],{"type":47,"value":750},"Why ",{"type":42,"tag":72,"props":752,"children":754},{"className":753},[],[755],{"type":47,"value":369},{"type":42,"tag":757,"props":758,"children":759},"tbody",{},[760,778,795,828,845,862,879],{"type":42,"tag":737,"props":761,"children":762},{},[763,773],{"type":42,"tag":764,"props":765,"children":766},"td",{},[767],{"type":42,"tag":72,"props":768,"children":770},{"className":769},[],[771],{"type":47,"value":772},"event.dataset",{"type":42,"tag":764,"props":774,"children":775},{},[776],{"type":47,"value":777},"One value per data stream by definition",{"type":42,"tag":737,"props":779,"children":780},{},[781,790],{"type":42,"tag":764,"props":782,"children":783},{},[784],{"type":42,"tag":72,"props":785,"children":787},{"className":786},[],[788],{"type":47,"value":789},"event.module",{"type":42,"tag":764,"props":791,"children":792},{},[793],{"type":47,"value":794},"One value per package",{"type":42,"tag":737,"props":796,"children":797},{},[798,807],{"type":42,"tag":764,"props":799,"children":800},{},[801],{"type":42,"tag":72,"props":802,"children":804},{"className":803},[],[805],{"type":47,"value":806},"data_stream.type",{"type":42,"tag":764,"props":808,"children":809},{},[810,812,818,820,826],{"type":47,"value":811},"Fixed per stream (",{"type":42,"tag":72,"props":813,"children":815},{"className":814},[],[816],{"type":47,"value":817},"logs",{"type":47,"value":819},"\u002F",{"type":42,"tag":72,"props":821,"children":823},{"className":822},[],[824],{"type":47,"value":825},"metrics",{"type":47,"value":827},")",{"type":42,"tag":737,"props":829,"children":830},{},[831,840],{"type":42,"tag":764,"props":832,"children":833},{},[834],{"type":42,"tag":72,"props":835,"children":837},{"className":836},[],[838],{"type":47,"value":839},"data_stream.dataset",{"type":42,"tag":764,"props":841,"children":842},{},[843],{"type":47,"value":844},"Fixed per stream",{"type":42,"tag":737,"props":846,"children":847},{},[848,857],{"type":42,"tag":764,"props":849,"children":850},{},[851],{"type":42,"tag":72,"props":852,"children":854},{"className":853},[],[855],{"type":47,"value":856},"data_stream.namespace",{"type":42,"tag":764,"props":858,"children":859},{},[860],{"type":47,"value":861},"Set at deployment, constant within index",{"type":42,"tag":737,"props":863,"children":864},{},[865,874],{"type":42,"tag":764,"props":866,"children":867},{},[868],{"type":42,"tag":72,"props":869,"children":871},{"className":870},[],[872],{"type":47,"value":873},"observer.vendor",{"type":42,"tag":764,"props":875,"children":876},{},[877],{"type":47,"value":878},"Package represents one vendor",{"type":42,"tag":737,"props":880,"children":881},{},[882,891],{"type":42,"tag":764,"props":883,"children":884},{},[885],{"type":42,"tag":72,"props":886,"children":888},{"className":887},[],[889],{"type":47,"value":890},"observer.product",{"type":42,"tag":764,"props":892,"children":893},{},[894],{"type":47,"value":895},"Package represents one product",{"type":42,"tag":56,"props":897,"children":898},{},[899,901,906,908,913,915,920,922,927,929,934],{"type":47,"value":900},"When a ",{"type":42,"tag":72,"props":902,"children":904},{"className":903},[],[905],{"type":47,"value":369},{"type":47,"value":907}," field is also an ECS field (e.g., ",{"type":42,"tag":72,"props":909,"children":911},{"className":910},[],[912],{"type":47,"value":873},{"type":47,"value":914},"), use ",{"type":42,"tag":72,"props":916,"children":918},{"className":917},[],[919],{"type":47,"value":346},{"type":47,"value":921}," with the type override. This inherits the description from ECS and avoids manual duplication. Place the definition in the appropriate field file (",{"type":42,"tag":72,"props":923,"children":925},{"className":924},[],[926],{"type":47,"value":88},{"type":47,"value":928}," for most ECS fields, ",{"type":42,"tag":72,"props":930,"children":932},{"className":931},[],[933],{"type":47,"value":327},{"type":47,"value":935}," for routing constants):",{"type":42,"tag":207,"props":937,"children":939},{"className":209,"code":938,"language":211,"meta":212,"style":212},"- name: observer.vendor\n  external: ecs\n  type: constant_keyword\n  value: Acme Corp\n",[940],{"type":42,"tag":72,"props":941,"children":942},{"__ignoreMap":212},[943,963,978,993],{"type":42,"tag":218,"props":944,"children":945},{"class":220,"line":221},[946,950,954,958],{"type":42,"tag":218,"props":947,"children":948},{"style":231},[949],{"type":47,"value":386},{"type":42,"tag":218,"props":951,"children":952},{"style":225},[953],{"type":47,"value":391},{"type":42,"tag":218,"props":955,"children":956},{"style":231},[957],{"type":47,"value":260},{"type":42,"tag":218,"props":959,"children":960},{"style":268},[961],{"type":47,"value":962}," observer.vendor\n",{"type":42,"tag":218,"props":964,"children":965},{"class":220,"line":27},[966,970,974],{"type":42,"tag":218,"props":967,"children":968},{"style":225},[969],{"type":47,"value":408},{"type":42,"tag":218,"props":971,"children":972},{"style":231},[973],{"type":47,"value":260},{"type":42,"tag":218,"props":975,"children":976},{"style":268},[977],{"type":47,"value":417},{"type":42,"tag":218,"props":979,"children":980},{"class":220,"line":249},[981,985,989],{"type":42,"tag":218,"props":982,"children":983},{"style":225},[984],{"type":47,"value":536},{"type":42,"tag":218,"props":986,"children":987},{"style":231},[988],{"type":47,"value":260},{"type":42,"tag":218,"props":990,"children":991},{"style":268},[992],{"type":47,"value":545},{"type":42,"tag":218,"props":994,"children":995},{"class":220,"line":440},[996,1000,1004],{"type":42,"tag":218,"props":997,"children":998},{"style":225},[999],{"type":47,"value":554},{"type":42,"tag":218,"props":1001,"children":1002},{"style":231},[1003],{"type":47,"value":260},{"type":42,"tag":218,"props":1005,"children":1006},{"style":268},[1007],{"type":47,"value":1008}," Acme Corp\n",{"type":42,"tag":56,"props":1010,"children":1011},{},[1012,1023,1025,1030,1032,1038,1040,1046],{"type":42,"tag":283,"props":1013,"children":1014},{},[1015,1021],{"type":42,"tag":72,"props":1016,"children":1018},{"className":1017},[],[1019],{"type":47,"value":1020},"remove_from_source",{"type":47,"value":1022}," option:",{"type":47,"value":1024}," Because ",{"type":42,"tag":72,"props":1026,"children":1028},{"className":1027},[],[1029],{"type":47,"value":369},{"type":47,"value":1031}," stores the value once in index metadata, it does not need to appear in every document's ",{"type":42,"tag":72,"props":1033,"children":1035},{"className":1034},[],[1036],{"type":47,"value":1037},"_source",{"type":47,"value":1039},". Elasticsearch handles this automatically — no explicit ",{"type":42,"tag":72,"props":1041,"children":1043},{"className":1042},[],[1044],{"type":47,"value":1045},"_source.excludes",{"type":47,"value":1047}," configuration is needed. This saves storage when the value is always the same.",{"type":42,"tag":318,"props":1049,"children":1051},{"id":1050},"ecsyml",[1052],{"type":42,"tag":72,"props":1053,"children":1055},{"className":1054},[],[1056],{"type":47,"value":88},{"type":42,"tag":56,"props":1058,"children":1059},{},[1060,1065,1067,1073,1074,1079,1081,1086],{"type":42,"tag":283,"props":1061,"children":1062},{},[1063],{"type":47,"value":1064},"Populate this file with every ECS field the pipeline sets.",{"type":47,"value":1066}," Use only ",{"type":42,"tag":72,"props":1068,"children":1070},{"className":1069},[],[1071],{"type":47,"value":1072},"name",{"type":47,"value":355},{"type":42,"tag":72,"props":1075,"children":1077},{"className":1076},[],[1078],{"type":47,"value":346},{"type":47,"value":1080}," for each entry — no type, no description. The type is resolved from the ECS schema via ",{"type":42,"tag":72,"props":1082,"children":1084},{"className":1083},[],[1085],{"type":47,"value":203},{"type":47,"value":697},{"type":42,"tag":56,"props":1088,"children":1089},{},[1090,1095,1097,1106,1108,1113,1114,1119,1121,1127,1128,1134,1136,1141,1143,1148,1150,1156,1157,1163,1165,1171],{"type":42,"tag":72,"props":1091,"children":1093},{"className":1092},[],[1094],{"type":47,"value":346},{"type":47,"value":1096}," must be used whenever a field name exists in ECS (",{"type":42,"tag":1098,"props":1099,"children":1103},"a",{"href":1100,"rel":1101},"https:\u002F\u002Fgithub.com\u002Felastic\u002Fintegrations\u002Fwiki\u002FFleet-Package-Code-Review-Comments#defining-an-ecs-field-without-using-an-external-definition",[1102],"nofollow",[1104],{"type":47,"value":1105},"wiki reference",{"type":47,"value":1107},"). This applies across field files — ",{"type":42,"tag":72,"props":1109,"children":1111},{"className":1110},[],[1112],{"type":47,"value":88},{"type":47,"value":103},{"type":42,"tag":72,"props":1115,"children":1117},{"className":1116},[],[1118],{"type":47,"value":327},{"type":47,"value":1120},", and any file that defines an ECS field. You may override properties (e.g., ",{"type":42,"tag":72,"props":1122,"children":1124},{"className":1123},[],[1125],{"type":47,"value":1126},"type: constant_keyword",{"type":47,"value":103},{"type":42,"tag":72,"props":1129,"children":1131},{"className":1130},[],[1132],{"type":47,"value":1133},"value:",{"type":47,"value":1135},") while still using ",{"type":42,"tag":72,"props":1137,"children":1139},{"className":1138},[],[1140],{"type":47,"value":346},{"type":47,"value":1142}," — the description is inherited from ECS. Do not use ",{"type":42,"tag":72,"props":1144,"children":1146},{"className":1145},[],[1147],{"type":47,"value":346},{"type":47,"value":1149}," in ",{"type":42,"tag":72,"props":1151,"children":1153},{"className":1152},[],[1154],{"type":47,"value":1155},"fields.yml",{"type":47,"value":103},{"type":42,"tag":72,"props":1158,"children":1160},{"className":1159},[],[1161],{"type":47,"value":1162},"agent.yml",{"type":47,"value":1164},", or ",{"type":42,"tag":72,"props":1166,"children":1168},{"className":1167},[],[1169],{"type":47,"value":1170},"beats.yml",{"type":47,"value":1172}," — those files define non-ECS fields.",{"type":42,"tag":207,"props":1174,"children":1176},{"className":209,"code":1175,"language":211,"meta":212,"style":212},"- name: event.kind\n  external: ecs\n- name: event.category\n  external: ecs\n- name: event.type\n  external: ecs\n- name: event.outcome\n  external: ecs\n- name: event.action\n  external: ecs\n- name: source.ip\n  external: ecs\n- name: source.port\n  external: ecs\n- name: destination.ip\n  external: ecs\n- name: user.name\n  external: ecs\n- name: related.ip\n  external: ecs\n- name: related.user\n  external: ecs\n",[1177],{"type":42,"tag":72,"props":1178,"children":1179},{"__ignoreMap":212},[1180,1200,1215,1235,1250,1270,1285,1305,1320,1340,1355,1375,1390,1410,1425,1445,1460,1481,1497,1518,1534,1555],{"type":42,"tag":218,"props":1181,"children":1182},{"class":220,"line":221},[1183,1187,1191,1195],{"type":42,"tag":218,"props":1184,"children":1185},{"style":231},[1186],{"type":47,"value":386},{"type":42,"tag":218,"props":1188,"children":1189},{"style":225},[1190],{"type":47,"value":391},{"type":42,"tag":218,"props":1192,"children":1193},{"style":231},[1194],{"type":47,"value":260},{"type":42,"tag":218,"props":1196,"children":1197},{"style":268},[1198],{"type":47,"value":1199}," event.kind\n",{"type":42,"tag":218,"props":1201,"children":1202},{"class":220,"line":27},[1203,1207,1211],{"type":42,"tag":218,"props":1204,"children":1205},{"style":225},[1206],{"type":47,"value":408},{"type":42,"tag":218,"props":1208,"children":1209},{"style":231},[1210],{"type":47,"value":260},{"type":42,"tag":218,"props":1212,"children":1213},{"style":268},[1214],{"type":47,"value":417},{"type":42,"tag":218,"props":1216,"children":1217},{"class":220,"line":249},[1218,1222,1226,1230],{"type":42,"tag":218,"props":1219,"children":1220},{"style":231},[1221],{"type":47,"value":386},{"type":42,"tag":218,"props":1223,"children":1224},{"style":225},[1225],{"type":47,"value":391},{"type":42,"tag":218,"props":1227,"children":1228},{"style":231},[1229],{"type":47,"value":260},{"type":42,"tag":218,"props":1231,"children":1232},{"style":268},[1233],{"type":47,"value":1234}," event.category\n",{"type":42,"tag":218,"props":1236,"children":1237},{"class":220,"line":440},[1238,1242,1246],{"type":42,"tag":218,"props":1239,"children":1240},{"style":225},[1241],{"type":47,"value":408},{"type":42,"tag":218,"props":1243,"children":1244},{"style":231},[1245],{"type":47,"value":260},{"type":42,"tag":218,"props":1247,"children":1248},{"style":268},[1249],{"type":47,"value":417},{"type":42,"tag":218,"props":1251,"children":1252},{"class":220,"line":456},[1253,1257,1261,1265],{"type":42,"tag":218,"props":1254,"children":1255},{"style":231},[1256],{"type":47,"value":386},{"type":42,"tag":218,"props":1258,"children":1259},{"style":225},[1260],{"type":47,"value":391},{"type":42,"tag":218,"props":1262,"children":1263},{"style":231},[1264],{"type":47,"value":260},{"type":42,"tag":218,"props":1266,"children":1267},{"style":268},[1268],{"type":47,"value":1269}," event.type\n",{"type":42,"tag":218,"props":1271,"children":1272},{"class":220,"line":477},[1273,1277,1281],{"type":42,"tag":218,"props":1274,"children":1275},{"style":225},[1276],{"type":47,"value":408},{"type":42,"tag":218,"props":1278,"children":1279},{"style":231},[1280],{"type":47,"value":260},{"type":42,"tag":218,"props":1282,"children":1283},{"style":268},[1284],{"type":47,"value":417},{"type":42,"tag":218,"props":1286,"children":1287},{"class":220,"line":493},[1288,1292,1296,1300],{"type":42,"tag":218,"props":1289,"children":1290},{"style":231},[1291],{"type":47,"value":386},{"type":42,"tag":218,"props":1293,"children":1294},{"style":225},[1295],{"type":47,"value":391},{"type":42,"tag":218,"props":1297,"children":1298},{"style":231},[1299],{"type":47,"value":260},{"type":42,"tag":218,"props":1301,"children":1302},{"style":268},[1303],{"type":47,"value":1304}," event.outcome\n",{"type":42,"tag":218,"props":1306,"children":1307},{"class":220,"line":514},[1308,1312,1316],{"type":42,"tag":218,"props":1309,"children":1310},{"style":225},[1311],{"type":47,"value":408},{"type":42,"tag":218,"props":1313,"children":1314},{"style":231},[1315],{"type":47,"value":260},{"type":42,"tag":218,"props":1317,"children":1318},{"style":268},[1319],{"type":47,"value":417},{"type":42,"tag":218,"props":1321,"children":1322},{"class":220,"line":530},[1323,1327,1331,1335],{"type":42,"tag":218,"props":1324,"children":1325},{"style":231},[1326],{"type":47,"value":386},{"type":42,"tag":218,"props":1328,"children":1329},{"style":225},[1330],{"type":47,"value":391},{"type":42,"tag":218,"props":1332,"children":1333},{"style":231},[1334],{"type":47,"value":260},{"type":42,"tag":218,"props":1336,"children":1337},{"style":268},[1338],{"type":47,"value":1339}," event.action\n",{"type":42,"tag":218,"props":1341,"children":1342},{"class":220,"line":548},[1343,1347,1351],{"type":42,"tag":218,"props":1344,"children":1345},{"style":225},[1346],{"type":47,"value":408},{"type":42,"tag":218,"props":1348,"children":1349},{"style":231},[1350],{"type":47,"value":260},{"type":42,"tag":218,"props":1352,"children":1353},{"style":268},[1354],{"type":47,"value":417},{"type":42,"tag":218,"props":1356,"children":1357},{"class":220,"line":23},[1358,1362,1366,1370],{"type":42,"tag":218,"props":1359,"children":1360},{"style":231},[1361],{"type":47,"value":386},{"type":42,"tag":218,"props":1363,"children":1364},{"style":225},[1365],{"type":47,"value":391},{"type":42,"tag":218,"props":1367,"children":1368},{"style":231},[1369],{"type":47,"value":260},{"type":42,"tag":218,"props":1371,"children":1372},{"style":268},[1373],{"type":47,"value":1374}," source.ip\n",{"type":42,"tag":218,"props":1376,"children":1377},{"class":220,"line":586},[1378,1382,1386],{"type":42,"tag":218,"props":1379,"children":1380},{"style":225},[1381],{"type":47,"value":408},{"type":42,"tag":218,"props":1383,"children":1384},{"style":231},[1385],{"type":47,"value":260},{"type":42,"tag":218,"props":1387,"children":1388},{"style":268},[1389],{"type":47,"value":417},{"type":42,"tag":218,"props":1391,"children":1392},{"class":220,"line":602},[1393,1397,1401,1405],{"type":42,"tag":218,"props":1394,"children":1395},{"style":231},[1396],{"type":47,"value":386},{"type":42,"tag":218,"props":1398,"children":1399},{"style":225},[1400],{"type":47,"value":391},{"type":42,"tag":218,"props":1402,"children":1403},{"style":231},[1404],{"type":47,"value":260},{"type":42,"tag":218,"props":1406,"children":1407},{"style":268},[1408],{"type":47,"value":1409}," source.port\n",{"type":42,"tag":218,"props":1411,"children":1412},{"class":220,"line":618},[1413,1417,1421],{"type":42,"tag":218,"props":1414,"children":1415},{"style":225},[1416],{"type":47,"value":408},{"type":42,"tag":218,"props":1418,"children":1419},{"style":231},[1420],{"type":47,"value":260},{"type":42,"tag":218,"props":1422,"children":1423},{"style":268},[1424],{"type":47,"value":417},{"type":42,"tag":218,"props":1426,"children":1427},{"class":220,"line":635},[1428,1432,1436,1440],{"type":42,"tag":218,"props":1429,"children":1430},{"style":231},[1431],{"type":47,"value":386},{"type":42,"tag":218,"props":1433,"children":1434},{"style":225},[1435],{"type":47,"value":391},{"type":42,"tag":218,"props":1437,"children":1438},{"style":231},[1439],{"type":47,"value":260},{"type":42,"tag":218,"props":1441,"children":1442},{"style":268},[1443],{"type":47,"value":1444}," destination.ip\n",{"type":42,"tag":218,"props":1446,"children":1447},{"class":220,"line":665},[1448,1452,1456],{"type":42,"tag":218,"props":1449,"children":1450},{"style":225},[1451],{"type":47,"value":408},{"type":42,"tag":218,"props":1453,"children":1454},{"style":231},[1455],{"type":47,"value":260},{"type":42,"tag":218,"props":1457,"children":1458},{"style":268},[1459],{"type":47,"value":417},{"type":42,"tag":218,"props":1461,"children":1463},{"class":220,"line":1462},17,[1464,1468,1472,1476],{"type":42,"tag":218,"props":1465,"children":1466},{"style":231},[1467],{"type":47,"value":386},{"type":42,"tag":218,"props":1469,"children":1470},{"style":225},[1471],{"type":47,"value":391},{"type":42,"tag":218,"props":1473,"children":1474},{"style":231},[1475],{"type":47,"value":260},{"type":42,"tag":218,"props":1477,"children":1478},{"style":268},[1479],{"type":47,"value":1480}," user.name\n",{"type":42,"tag":218,"props":1482,"children":1484},{"class":220,"line":1483},18,[1485,1489,1493],{"type":42,"tag":218,"props":1486,"children":1487},{"style":225},[1488],{"type":47,"value":408},{"type":42,"tag":218,"props":1490,"children":1491},{"style":231},[1492],{"type":47,"value":260},{"type":42,"tag":218,"props":1494,"children":1495},{"style":268},[1496],{"type":47,"value":417},{"type":42,"tag":218,"props":1498,"children":1500},{"class":220,"line":1499},19,[1501,1505,1509,1513],{"type":42,"tag":218,"props":1502,"children":1503},{"style":231},[1504],{"type":47,"value":386},{"type":42,"tag":218,"props":1506,"children":1507},{"style":225},[1508],{"type":47,"value":391},{"type":42,"tag":218,"props":1510,"children":1511},{"style":231},[1512],{"type":47,"value":260},{"type":42,"tag":218,"props":1514,"children":1515},{"style":268},[1516],{"type":47,"value":1517}," related.ip\n",{"type":42,"tag":218,"props":1519,"children":1521},{"class":220,"line":1520},20,[1522,1526,1530],{"type":42,"tag":218,"props":1523,"children":1524},{"style":225},[1525],{"type":47,"value":408},{"type":42,"tag":218,"props":1527,"children":1528},{"style":231},[1529],{"type":47,"value":260},{"type":42,"tag":218,"props":1531,"children":1532},{"style":268},[1533],{"type":47,"value":417},{"type":42,"tag":218,"props":1535,"children":1537},{"class":220,"line":1536},21,[1538,1542,1546,1550],{"type":42,"tag":218,"props":1539,"children":1540},{"style":231},[1541],{"type":47,"value":386},{"type":42,"tag":218,"props":1543,"children":1544},{"style":225},[1545],{"type":47,"value":391},{"type":42,"tag":218,"props":1547,"children":1548},{"style":231},[1549],{"type":47,"value":260},{"type":42,"tag":218,"props":1551,"children":1552},{"style":268},[1553],{"type":47,"value":1554}," related.user\n",{"type":42,"tag":218,"props":1556,"children":1558},{"class":220,"line":1557},22,[1559,1563,1567],{"type":42,"tag":218,"props":1560,"children":1561},{"style":225},[1562],{"type":47,"value":408},{"type":42,"tag":218,"props":1564,"children":1565},{"style":231},[1566],{"type":47,"value":260},{"type":42,"tag":218,"props":1568,"children":1569},{"style":268},[1570],{"type":47,"value":417},{"type":42,"tag":56,"props":1572,"children":1573},{},[1574,1576,1581,1583,1588,1590,1595],{"type":47,"value":1575},"When attaching extra metadata to an ECS field (for example making a field a TSDB dimension or a constant_keyword with a fixed value), combine ",{"type":42,"tag":72,"props":1577,"children":1579},{"className":1578},[],[1580],{"type":47,"value":346},{"type":47,"value":1582}," with that metadata. The description is inherited from ECS. Place the definition in ",{"type":42,"tag":72,"props":1584,"children":1586},{"className":1585},[],[1587],{"type":47,"value":88},{"type":47,"value":1589}," (or ",{"type":42,"tag":72,"props":1591,"children":1593},{"className":1592},[],[1594],{"type":47,"value":327},{"type":47,"value":935},{"type":42,"tag":207,"props":1597,"children":1598},{"className":209,"code":938,"language":211,"meta":212,"style":212},[1599],{"type":42,"tag":72,"props":1600,"children":1601},{"__ignoreMap":212},[1602,1621,1636,1651],{"type":42,"tag":218,"props":1603,"children":1604},{"class":220,"line":221},[1605,1609,1613,1617],{"type":42,"tag":218,"props":1606,"children":1607},{"style":231},[1608],{"type":47,"value":386},{"type":42,"tag":218,"props":1610,"children":1611},{"style":225},[1612],{"type":47,"value":391},{"type":42,"tag":218,"props":1614,"children":1615},{"style":231},[1616],{"type":47,"value":260},{"type":42,"tag":218,"props":1618,"children":1619},{"style":268},[1620],{"type":47,"value":962},{"type":42,"tag":218,"props":1622,"children":1623},{"class":220,"line":27},[1624,1628,1632],{"type":42,"tag":218,"props":1625,"children":1626},{"style":225},[1627],{"type":47,"value":408},{"type":42,"tag":218,"props":1629,"children":1630},{"style":231},[1631],{"type":47,"value":260},{"type":42,"tag":218,"props":1633,"children":1634},{"style":268},[1635],{"type":47,"value":417},{"type":42,"tag":218,"props":1637,"children":1638},{"class":220,"line":249},[1639,1643,1647],{"type":42,"tag":218,"props":1640,"children":1641},{"style":225},[1642],{"type":47,"value":536},{"type":42,"tag":218,"props":1644,"children":1645},{"style":231},[1646],{"type":47,"value":260},{"type":42,"tag":218,"props":1648,"children":1649},{"style":268},[1650],{"type":47,"value":545},{"type":42,"tag":218,"props":1652,"children":1653},{"class":220,"line":440},[1654,1658,1662],{"type":42,"tag":218,"props":1655,"children":1656},{"style":225},[1657],{"type":47,"value":554},{"type":42,"tag":218,"props":1659,"children":1660},{"style":231},[1661],{"type":47,"value":260},{"type":42,"tag":218,"props":1663,"children":1664},{"style":268},[1665],{"type":47,"value":1008},{"type":42,"tag":318,"props":1667,"children":1669},{"id":1668},"fieldsyml",[1670],{"type":42,"tag":72,"props":1671,"children":1673},{"className":1672},[],[1674],{"type":47,"value":1155},{"type":42,"tag":56,"props":1676,"children":1677},{},[1678,1680,1686],{"type":47,"value":1679},"Integration-specific custom (non-ECS) fields only. Use a nested ",{"type":42,"tag":72,"props":1681,"children":1683},{"className":1682},[],[1684],{"type":47,"value":1685},"group",{"type":47,"value":1687}," hierarchy for the vendor namespace:",{"type":42,"tag":207,"props":1689,"children":1691},{"className":209,"code":1690,"language":211,"meta":212,"style":212},"- name: acme.firewall\n  type: group\n  fields:\n    - name: rule_id\n      type: keyword\n    - name: policy_name\n      type: keyword\n    - name: bytes_in\n      type: long\n      unit: byte\n      metric_type: gauge\n",[1692],{"type":42,"tag":72,"props":1693,"children":1694},{"__ignoreMap":212},[1695,1715,1731,1743,1764,1781,1801,1816,1836,1852,1869],{"type":42,"tag":218,"props":1696,"children":1697},{"class":220,"line":221},[1698,1702,1706,1710],{"type":42,"tag":218,"props":1699,"children":1700},{"style":231},[1701],{"type":47,"value":386},{"type":42,"tag":218,"props":1703,"children":1704},{"style":225},[1705],{"type":47,"value":391},{"type":42,"tag":218,"props":1707,"children":1708},{"style":231},[1709],{"type":47,"value":260},{"type":42,"tag":218,"props":1711,"children":1712},{"style":268},[1713],{"type":47,"value":1714}," acme.firewall\n",{"type":42,"tag":218,"props":1716,"children":1717},{"class":220,"line":27},[1718,1722,1726],{"type":42,"tag":218,"props":1719,"children":1720},{"style":225},[1721],{"type":47,"value":536},{"type":42,"tag":218,"props":1723,"children":1724},{"style":231},[1725],{"type":47,"value":260},{"type":42,"tag":218,"props":1727,"children":1728},{"style":268},[1729],{"type":47,"value":1730}," group\n",{"type":42,"tag":218,"props":1732,"children":1733},{"class":220,"line":249},[1734,1739],{"type":42,"tag":218,"props":1735,"children":1736},{"style":225},[1737],{"type":47,"value":1738},"  fields",{"type":42,"tag":218,"props":1740,"children":1741},{"style":231},[1742],{"type":47,"value":234},{"type":42,"tag":218,"props":1744,"children":1745},{"class":220,"line":440},[1746,1751,1755,1759],{"type":42,"tag":218,"props":1747,"children":1748},{"style":231},[1749],{"type":47,"value":1750},"    -",{"type":42,"tag":218,"props":1752,"children":1753},{"style":225},[1754],{"type":47,"value":391},{"type":42,"tag":218,"props":1756,"children":1757},{"style":231},[1758],{"type":47,"value":260},{"type":42,"tag":218,"props":1760,"children":1761},{"style":268},[1762],{"type":47,"value":1763}," rule_id\n",{"type":42,"tag":218,"props":1765,"children":1766},{"class":220,"line":456},[1767,1772,1776],{"type":42,"tag":218,"props":1768,"children":1769},{"style":225},[1770],{"type":47,"value":1771},"      type",{"type":42,"tag":218,"props":1773,"children":1774},{"style":231},[1775],{"type":47,"value":260},{"type":42,"tag":218,"props":1777,"children":1778},{"style":268},[1779],{"type":47,"value":1780}," keyword\n",{"type":42,"tag":218,"props":1782,"children":1783},{"class":220,"line":477},[1784,1788,1792,1796],{"type":42,"tag":218,"props":1785,"children":1786},{"style":231},[1787],{"type":47,"value":1750},{"type":42,"tag":218,"props":1789,"children":1790},{"style":225},[1791],{"type":47,"value":391},{"type":42,"tag":218,"props":1793,"children":1794},{"style":231},[1795],{"type":47,"value":260},{"type":42,"tag":218,"props":1797,"children":1798},{"style":268},[1799],{"type":47,"value":1800}," policy_name\n",{"type":42,"tag":218,"props":1802,"children":1803},{"class":220,"line":493},[1804,1808,1812],{"type":42,"tag":218,"props":1805,"children":1806},{"style":225},[1807],{"type":47,"value":1771},{"type":42,"tag":218,"props":1809,"children":1810},{"style":231},[1811],{"type":47,"value":260},{"type":42,"tag":218,"props":1813,"children":1814},{"style":268},[1815],{"type":47,"value":1780},{"type":42,"tag":218,"props":1817,"children":1818},{"class":220,"line":514},[1819,1823,1827,1831],{"type":42,"tag":218,"props":1820,"children":1821},{"style":231},[1822],{"type":47,"value":1750},{"type":42,"tag":218,"props":1824,"children":1825},{"style":225},[1826],{"type":47,"value":391},{"type":42,"tag":218,"props":1828,"children":1829},{"style":231},[1830],{"type":47,"value":260},{"type":42,"tag":218,"props":1832,"children":1833},{"style":268},[1834],{"type":47,"value":1835}," bytes_in\n",{"type":42,"tag":218,"props":1837,"children":1838},{"class":220,"line":530},[1839,1843,1847],{"type":42,"tag":218,"props":1840,"children":1841},{"style":225},[1842],{"type":47,"value":1771},{"type":42,"tag":218,"props":1844,"children":1845},{"style":231},[1846],{"type":47,"value":260},{"type":42,"tag":218,"props":1848,"children":1849},{"style":268},[1850],{"type":47,"value":1851}," long\n",{"type":42,"tag":218,"props":1853,"children":1854},{"class":220,"line":548},[1855,1860,1864],{"type":42,"tag":218,"props":1856,"children":1857},{"style":225},[1858],{"type":47,"value":1859},"      unit",{"type":42,"tag":218,"props":1861,"children":1862},{"style":231},[1863],{"type":47,"value":260},{"type":42,"tag":218,"props":1865,"children":1866},{"style":268},[1867],{"type":47,"value":1868}," byte\n",{"type":42,"tag":218,"props":1870,"children":1871},{"class":220,"line":23},[1872,1877,1881],{"type":42,"tag":218,"props":1873,"children":1874},{"style":225},[1875],{"type":47,"value":1876},"      metric_type",{"type":42,"tag":218,"props":1878,"children":1879},{"style":231},[1880],{"type":47,"value":260},{"type":42,"tag":218,"props":1882,"children":1883},{"style":268},[1884],{"type":47,"value":1885}," gauge\n",{"type":42,"tag":56,"props":1887,"children":1888},{},[1889,1891,1897,1899,1904,1906,1912],{"type":47,"value":1890},"Groups do not need to be declared as ",{"type":42,"tag":72,"props":1892,"children":1894},{"className":1893},[],[1895],{"type":47,"value":1896},"type: object",{"type":47,"value":1898}," — defining a ",{"type":42,"tag":72,"props":1900,"children":1902},{"className":1901},[],[1903],{"type":47,"value":1685},{"type":47,"value":1905}," with nested ",{"type":42,"tag":72,"props":1907,"children":1909},{"className":1908},[],[1910],{"type":47,"value":1911},"fields",{"type":47,"value":1913}," is sufficient. The object structure is implicit.",{"type":42,"tag":1915,"props":1916,"children":1918},"h4",{"id":1917},"labels-exception",[1919,1925],{"type":42,"tag":72,"props":1920,"children":1922},{"className":1921},[],[1923],{"type":47,"value":1924},"labels.*",{"type":47,"value":1926}," exception",{"type":42,"tag":56,"props":1928,"children":1929},{},[1930,1936,1938,1943,1944,1950,1952,1957,1959,1964],{"type":42,"tag":72,"props":1931,"children":1933},{"className":1932},[],[1934],{"type":47,"value":1935},"labels",{"type":47,"value":1937}," is a core ECS object (",{"type":42,"tag":72,"props":1939,"children":1941},{"className":1940},[],[1942],{"type":47,"value":1896},{"type":47,"value":103},{"type":42,"tag":72,"props":1945,"children":1947},{"className":1946},[],[1948],{"type":47,"value":1949},"object_type: keyword",{"type":47,"value":1951},") designed for ad-hoc key-value metadata. Subkeys under ",{"type":42,"tag":72,"props":1953,"children":1955},{"className":1954},[],[1956],{"type":47,"value":1924},{"type":47,"value":1958}," do ",{"type":42,"tag":283,"props":1960,"children":1961},{},[1962],{"type":47,"value":1963},"not",{"type":47,"value":1965}," require vendor namespacing — this is the one exception to the vendor-prefix rule.",{"type":42,"tag":56,"props":1967,"children":1968},{},[1969,1971,1976,1978,1984],{"type":47,"value":1970},"Use ",{"type":42,"tag":72,"props":1972,"children":1974},{"className":1973},[],[1975],{"type":47,"value":1924},{"type":47,"value":1977}," for simple keyword flags or integration-internal markers (e.g., ",{"type":42,"tag":72,"props":1979,"children":1981},{"className":1980},[],[1982],{"type":47,"value":1983},"labels.is_ioc_transform_source",{"type":47,"value":1985},"). Use the vendor namespace for structured or nested data from an upstream source.",{"type":42,"tag":1915,"props":1987,"children":1989},{"id":1988},"flags-vs-structured-data",[1990],{"type":47,"value":1991},"Flags vs structured data",{"type":42,"tag":56,"props":1993,"children":1994},{},[1995],{"type":47,"value":1996},"Boolean flags and simple tags can live flat under the vendor group:",{"type":42,"tag":207,"props":1998,"children":2000},{"className":209,"code":1999,"language":211,"meta":212,"style":212},"- name: acme.firewall\n  type: group\n  fields:\n    - name: is_encrypted\n      type: boolean\n    - name: policy_name\n      type: keyword\n",[2001],{"type":42,"tag":72,"props":2002,"children":2003},{"__ignoreMap":212},[2004,2023,2038,2049,2069,2085,2104],{"type":42,"tag":218,"props":2005,"children":2006},{"class":220,"line":221},[2007,2011,2015,2019],{"type":42,"tag":218,"props":2008,"children":2009},{"style":231},[2010],{"type":47,"value":386},{"type":42,"tag":218,"props":2012,"children":2013},{"style":225},[2014],{"type":47,"value":391},{"type":42,"tag":218,"props":2016,"children":2017},{"style":231},[2018],{"type":47,"value":260},{"type":42,"tag":218,"props":2020,"children":2021},{"style":268},[2022],{"type":47,"value":1714},{"type":42,"tag":218,"props":2024,"children":2025},{"class":220,"line":27},[2026,2030,2034],{"type":42,"tag":218,"props":2027,"children":2028},{"style":225},[2029],{"type":47,"value":536},{"type":42,"tag":218,"props":2031,"children":2032},{"style":231},[2033],{"type":47,"value":260},{"type":42,"tag":218,"props":2035,"children":2036},{"style":268},[2037],{"type":47,"value":1730},{"type":42,"tag":218,"props":2039,"children":2040},{"class":220,"line":249},[2041,2045],{"type":42,"tag":218,"props":2042,"children":2043},{"style":225},[2044],{"type":47,"value":1738},{"type":42,"tag":218,"props":2046,"children":2047},{"style":231},[2048],{"type":47,"value":234},{"type":42,"tag":218,"props":2050,"children":2051},{"class":220,"line":440},[2052,2056,2060,2064],{"type":42,"tag":218,"props":2053,"children":2054},{"style":231},[2055],{"type":47,"value":1750},{"type":42,"tag":218,"props":2057,"children":2058},{"style":225},[2059],{"type":47,"value":391},{"type":42,"tag":218,"props":2061,"children":2062},{"style":231},[2063],{"type":47,"value":260},{"type":42,"tag":218,"props":2065,"children":2066},{"style":268},[2067],{"type":47,"value":2068}," is_encrypted\n",{"type":42,"tag":218,"props":2070,"children":2071},{"class":220,"line":456},[2072,2076,2080],{"type":42,"tag":218,"props":2073,"children":2074},{"style":225},[2075],{"type":47,"value":1771},{"type":42,"tag":218,"props":2077,"children":2078},{"style":231},[2079],{"type":47,"value":260},{"type":42,"tag":218,"props":2081,"children":2082},{"style":268},[2083],{"type":47,"value":2084}," boolean\n",{"type":42,"tag":218,"props":2086,"children":2087},{"class":220,"line":477},[2088,2092,2096,2100],{"type":42,"tag":218,"props":2089,"children":2090},{"style":231},[2091],{"type":47,"value":1750},{"type":42,"tag":218,"props":2093,"children":2094},{"style":225},[2095],{"type":47,"value":391},{"type":42,"tag":218,"props":2097,"children":2098},{"style":231},[2099],{"type":47,"value":260},{"type":42,"tag":218,"props":2101,"children":2102},{"style":268},[2103],{"type":47,"value":1800},{"type":42,"tag":218,"props":2105,"children":2106},{"class":220,"line":493},[2107,2111,2115],{"type":42,"tag":218,"props":2108,"children":2109},{"style":225},[2110],{"type":47,"value":1771},{"type":42,"tag":218,"props":2112,"children":2113},{"style":231},[2114],{"type":47,"value":260},{"type":42,"tag":218,"props":2116,"children":2117},{"style":268},[2118],{"type":47,"value":1780},{"type":42,"tag":56,"props":2120,"children":2121},{},[2122],{"type":47,"value":2123},"Structured data from the source should use sub-groups for logical hierarchy:",{"type":42,"tag":207,"props":2125,"children":2127},{"className":209,"code":2126,"language":211,"meta":212,"style":212},"- name: acme.firewall\n  type: group\n  fields:\n    - name: rule\n      type: group\n      fields:\n        - name: id\n          type: keyword\n        - name: name\n          type: keyword\n        - name: action\n          type: keyword\n",[2128],{"type":42,"tag":72,"props":2129,"children":2130},{"__ignoreMap":212},[2131,2150,2165,2176,2196,2211,2223,2244,2260,2280,2295,2315],{"type":42,"tag":218,"props":2132,"children":2133},{"class":220,"line":221},[2134,2138,2142,2146],{"type":42,"tag":218,"props":2135,"children":2136},{"style":231},[2137],{"type":47,"value":386},{"type":42,"tag":218,"props":2139,"children":2140},{"style":225},[2141],{"type":47,"value":391},{"type":42,"tag":218,"props":2143,"children":2144},{"style":231},[2145],{"type":47,"value":260},{"type":42,"tag":218,"props":2147,"children":2148},{"style":268},[2149],{"type":47,"value":1714},{"type":42,"tag":218,"props":2151,"children":2152},{"class":220,"line":27},[2153,2157,2161],{"type":42,"tag":218,"props":2154,"children":2155},{"style":225},[2156],{"type":47,"value":536},{"type":42,"tag":218,"props":2158,"children":2159},{"style":231},[2160],{"type":47,"value":260},{"type":42,"tag":218,"props":2162,"children":2163},{"style":268},[2164],{"type":47,"value":1730},{"type":42,"tag":218,"props":2166,"children":2167},{"class":220,"line":249},[2168,2172],{"type":42,"tag":218,"props":2169,"children":2170},{"style":225},[2171],{"type":47,"value":1738},{"type":42,"tag":218,"props":2173,"children":2174},{"style":231},[2175],{"type":47,"value":234},{"type":42,"tag":218,"props":2177,"children":2178},{"class":220,"line":440},[2179,2183,2187,2191],{"type":42,"tag":218,"props":2180,"children":2181},{"style":231},[2182],{"type":47,"value":1750},{"type":42,"tag":218,"props":2184,"children":2185},{"style":225},[2186],{"type":47,"value":391},{"type":42,"tag":218,"props":2188,"children":2189},{"style":231},[2190],{"type":47,"value":260},{"type":42,"tag":218,"props":2192,"children":2193},{"style":268},[2194],{"type":47,"value":2195}," rule\n",{"type":42,"tag":218,"props":2197,"children":2198},{"class":220,"line":456},[2199,2203,2207],{"type":42,"tag":218,"props":2200,"children":2201},{"style":225},[2202],{"type":47,"value":1771},{"type":42,"tag":218,"props":2204,"children":2205},{"style":231},[2206],{"type":47,"value":260},{"type":42,"tag":218,"props":2208,"children":2209},{"style":268},[2210],{"type":47,"value":1730},{"type":42,"tag":218,"props":2212,"children":2213},{"class":220,"line":477},[2214,2219],{"type":42,"tag":218,"props":2215,"children":2216},{"style":225},[2217],{"type":47,"value":2218},"      fields",{"type":42,"tag":218,"props":2220,"children":2221},{"style":231},[2222],{"type":47,"value":234},{"type":42,"tag":218,"props":2224,"children":2225},{"class":220,"line":493},[2226,2231,2235,2239],{"type":42,"tag":218,"props":2227,"children":2228},{"style":231},[2229],{"type":47,"value":2230},"        -",{"type":42,"tag":218,"props":2232,"children":2233},{"style":225},[2234],{"type":47,"value":391},{"type":42,"tag":218,"props":2236,"children":2237},{"style":231},[2238],{"type":47,"value":260},{"type":42,"tag":218,"props":2240,"children":2241},{"style":268},[2242],{"type":47,"value":2243}," id\n",{"type":42,"tag":218,"props":2245,"children":2246},{"class":220,"line":514},[2247,2252,2256],{"type":42,"tag":218,"props":2248,"children":2249},{"style":225},[2250],{"type":47,"value":2251},"          type",{"type":42,"tag":218,"props":2253,"children":2254},{"style":231},[2255],{"type":47,"value":260},{"type":42,"tag":218,"props":2257,"children":2258},{"style":268},[2259],{"type":47,"value":1780},{"type":42,"tag":218,"props":2261,"children":2262},{"class":220,"line":530},[2263,2267,2271,2275],{"type":42,"tag":218,"props":2264,"children":2265},{"style":231},[2266],{"type":47,"value":2230},{"type":42,"tag":218,"props":2268,"children":2269},{"style":225},[2270],{"type":47,"value":391},{"type":42,"tag":218,"props":2272,"children":2273},{"style":231},[2274],{"type":47,"value":260},{"type":42,"tag":218,"props":2276,"children":2277},{"style":268},[2278],{"type":47,"value":2279}," name\n",{"type":42,"tag":218,"props":2281,"children":2282},{"class":220,"line":548},[2283,2287,2291],{"type":42,"tag":218,"props":2284,"children":2285},{"style":225},[2286],{"type":47,"value":2251},{"type":42,"tag":218,"props":2288,"children":2289},{"style":231},[2290],{"type":47,"value":260},{"type":42,"tag":218,"props":2292,"children":2293},{"style":268},[2294],{"type":47,"value":1780},{"type":42,"tag":218,"props":2296,"children":2297},{"class":220,"line":23},[2298,2302,2306,2310],{"type":42,"tag":218,"props":2299,"children":2300},{"style":231},[2301],{"type":47,"value":2230},{"type":42,"tag":218,"props":2303,"children":2304},{"style":225},[2305],{"type":47,"value":391},{"type":42,"tag":218,"props":2307,"children":2308},{"style":231},[2309],{"type":47,"value":260},{"type":42,"tag":218,"props":2311,"children":2312},{"style":268},[2313],{"type":47,"value":2314}," action\n",{"type":42,"tag":218,"props":2316,"children":2317},{"class":220,"line":586},[2318,2322,2326],{"type":42,"tag":218,"props":2319,"children":2320},{"style":225},[2321],{"type":47,"value":2251},{"type":42,"tag":218,"props":2323,"children":2324},{"style":231},[2325],{"type":47,"value":260},{"type":42,"tag":218,"props":2327,"children":2328},{"style":268},[2329],{"type":47,"value":1780},{"type":42,"tag":318,"props":2331,"children":2333},{"id":2332},"agentyml",[2334],{"type":42,"tag":72,"props":2335,"children":2337},{"className":2336},[],[2338],{"type":47,"value":1162},{"type":42,"tag":56,"props":2340,"children":2341},{},[2342,2344,2350,2351,2357,2358,2364,2365,2371,2372,2378,2379,2385,2386,2392],{"type":47,"value":2343},"Non-ECS fields populated by the Elastic Agent or Beats framework but not covered by ECS. Include only when the input type emits these fields. Typical fields: ",{"type":42,"tag":72,"props":2345,"children":2347},{"className":2346},[],[2348],{"type":47,"value":2349},"cloud.image.id",{"type":47,"value":103},{"type":42,"tag":72,"props":2352,"children":2354},{"className":2353},[],[2355],{"type":47,"value":2356},"cloud.instance.id",{"type":47,"value":103},{"type":42,"tag":72,"props":2359,"children":2361},{"className":2360},[],[2362],{"type":47,"value":2363},"host.containerized",{"type":47,"value":103},{"type":42,"tag":72,"props":2366,"children":2368},{"className":2367},[],[2369],{"type":47,"value":2370},"host.os.build",{"type":47,"value":103},{"type":42,"tag":72,"props":2373,"children":2375},{"className":2374},[],[2376],{"type":47,"value":2377},"host.os.codename",{"type":47,"value":103},{"type":42,"tag":72,"props":2380,"children":2382},{"className":2381},[],[2383],{"type":47,"value":2384},"input.type",{"type":47,"value":103},{"type":42,"tag":72,"props":2387,"children":2389},{"className":2388},[],[2390],{"type":47,"value":2391},"log.offset",{"type":47,"value":697},{"type":42,"tag":56,"props":2394,"children":2395},{},[2396,2398,2404],{"type":47,"value":2397},"See ",{"type":42,"tag":72,"props":2399,"children":2401},{"className":2400},[],[2402],{"type":47,"value":2403},"references\u002Froot-and-core-fields.md",{"type":47,"value":2405}," for full YAML samples.",{"type":42,"tag":318,"props":2407,"children":2409},{"id":2408},"beatsyml",[2410],{"type":42,"tag":72,"props":2411,"children":2413},{"className":2412},[],[2414],{"type":47,"value":1170},{"type":42,"tag":56,"props":2416,"children":2417},{},[2418,2420,2425,2426,2431,2433,2439,2441,2447],{"type":47,"value":2419},"Filebeat\u002FBeats-specific fields not covered by ECS. Minimal form contains ",{"type":42,"tag":72,"props":2421,"children":2423},{"className":2422},[],[2424],{"type":47,"value":2384},{"type":47,"value":355},{"type":42,"tag":72,"props":2427,"children":2429},{"className":2428},[],[2430],{"type":47,"value":2391},{"type":47,"value":2432},". Some inputs also emit ",{"type":42,"tag":72,"props":2434,"children":2436},{"className":2435},[],[2437],{"type":47,"value":2438},"log.flags",{"type":47,"value":2440}," or ",{"type":42,"tag":72,"props":2442,"children":2444},{"className":2443},[],[2445],{"type":47,"value":2446},"log.file.*",{"type":47,"value":2448}," sub-fields.",{"type":42,"tag":56,"props":2450,"children":2451},{},[2452,2453,2458],{"type":47,"value":2397},{"type":42,"tag":72,"props":2454,"children":2456},{"className":2455},[],[2457],{"type":47,"value":2403},{"type":47,"value":2405},{"type":42,"tag":49,"props":2460,"children":2462},{"id":2461},"ecs-field-selection",[2463],{"type":47,"value":2464},"ECS field selection",{"type":42,"tag":56,"props":2466,"children":2467},{},[2468,2470,2475],{"type":47,"value":2469},"Prefer ECS fields whenever semantics match. If no ECS field exists for the data, add it under the package namespace in ",{"type":42,"tag":72,"props":2471,"children":2473},{"className":2472},[],[2474],{"type":47,"value":1155},{"type":47,"value":697},{"type":42,"tag":318,"props":2477,"children":2479},{"id":2478},"categorization-quick-reference",[2480],{"type":47,"value":2481},"Categorization quick reference",{"type":42,"tag":729,"props":2483,"children":2484},{},[2485,2505],{"type":42,"tag":733,"props":2486,"children":2487},{},[2488],{"type":42,"tag":737,"props":2489,"children":2490},{},[2491,2495,2500],{"type":42,"tag":741,"props":2492,"children":2493},{},[2494],{"type":47,"value":745},{"type":42,"tag":741,"props":2496,"children":2497},{},[2498],{"type":47,"value":2499},"Type",{"type":42,"tag":741,"props":2501,"children":2502},{},[2503],{"type":47,"value":2504},"Notes",{"type":42,"tag":757,"props":2506,"children":2507},{},[2508,2529,2552,2575],{"type":42,"tag":737,"props":2509,"children":2510},{},[2511,2519,2524],{"type":42,"tag":764,"props":2512,"children":2513},{},[2514],{"type":42,"tag":72,"props":2515,"children":2517},{"className":2516},[],[2518],{"type":47,"value":101},{"type":42,"tag":764,"props":2520,"children":2521},{},[2522],{"type":47,"value":2523},"keyword",{"type":42,"tag":764,"props":2525,"children":2526},{},[2527],{"type":47,"value":2528},"Highest-level classification.",{"type":42,"tag":737,"props":2530,"children":2531},{},[2532,2540,2547],{"type":42,"tag":764,"props":2533,"children":2534},{},[2535],{"type":42,"tag":72,"props":2536,"children":2538},{"className":2537},[],[2539],{"type":47,"value":109},{"type":42,"tag":764,"props":2541,"children":2542},{},[2543,2544],{"type":47,"value":2523},{"type":42,"tag":218,"props":2545,"children":2546},{},[],{"type":42,"tag":764,"props":2548,"children":2549},{},[2550],{"type":47,"value":2551},"Broad domain buckets — always an array.",{"type":42,"tag":737,"props":2553,"children":2554},{},[2555,2563,2570],{"type":42,"tag":764,"props":2556,"children":2557},{},[2558],{"type":42,"tag":72,"props":2559,"children":2561},{"className":2560},[],[2562],{"type":47,"value":116},{"type":42,"tag":764,"props":2564,"children":2565},{},[2566,2567],{"type":47,"value":2523},{"type":42,"tag":218,"props":2568,"children":2569},{},[],{"type":42,"tag":764,"props":2571,"children":2572},{},[2573],{"type":47,"value":2574},"Sub-buckets within category — always an array.",{"type":42,"tag":737,"props":2576,"children":2577},{},[2578,2586,2590],{"type":42,"tag":764,"props":2579,"children":2580},{},[2581],{"type":42,"tag":72,"props":2582,"children":2584},{"className":2583},[],[2585],{"type":47,"value":124},{"type":42,"tag":764,"props":2587,"children":2588},{},[2589],{"type":47,"value":2523},{"type":42,"tag":764,"props":2591,"children":2592},{},[2593,2599,2600,2606,2607,2613],{"type":42,"tag":72,"props":2594,"children":2596},{"className":2595},[],[2597],{"type":47,"value":2598},"success",{"type":47,"value":103},{"type":42,"tag":72,"props":2601,"children":2603},{"className":2602},[],[2604],{"type":47,"value":2605},"failure",{"type":47,"value":103},{"type":42,"tag":72,"props":2608,"children":2610},{"className":2609},[],[2611],{"type":47,"value":2612},"unknown",{"type":47,"value":2614},"; only set when meaningful.",{"type":42,"tag":62,"props":2616,"children":2617},{},[2618,2683,2831],{"type":42,"tag":66,"props":2619,"children":2620},{},[2621,2626,2628,2634,2635,2641,2642,2648,2649,2655,2656,2662,2663,2669,2670,2676,2677],{"type":42,"tag":72,"props":2622,"children":2624},{"className":2623},[],[2625],{"type":47,"value":101},{"type":47,"value":2627},": ",{"type":42,"tag":72,"props":2629,"children":2631},{"className":2630},[],[2632],{"type":47,"value":2633},"alert",{"type":47,"value":103},{"type":42,"tag":72,"props":2636,"children":2638},{"className":2637},[],[2639],{"type":47,"value":2640},"asset",{"type":47,"value":103},{"type":42,"tag":72,"props":2643,"children":2645},{"className":2644},[],[2646],{"type":47,"value":2647},"enrichment",{"type":47,"value":103},{"type":42,"tag":72,"props":2650,"children":2652},{"className":2651},[],[2653],{"type":47,"value":2654},"event",{"type":47,"value":103},{"type":42,"tag":72,"props":2657,"children":2659},{"className":2658},[],[2660],{"type":47,"value":2661},"metric",{"type":47,"value":103},{"type":42,"tag":72,"props":2664,"children":2666},{"className":2665},[],[2667],{"type":47,"value":2668},"pipeline_error",{"type":47,"value":103},{"type":42,"tag":72,"props":2671,"children":2673},{"className":2672},[],[2674],{"type":47,"value":2675},"signal",{"type":47,"value":103},{"type":42,"tag":72,"props":2678,"children":2680},{"className":2679},[],[2681],{"type":47,"value":2682},"state",{"type":42,"tag":66,"props":2684,"children":2685},{},[2686,2691,2692,2698,2699,2705,2706,2712,2713,2719,2720,2726,2727,2733,2734,2740,2741,2747,2748,2754,2755,2761,2762,2768,2769,2775,2776,2782,2783,2789,2790,2796,2797,2803,2804,2810,2811,2817,2818,2824,2825],{"type":42,"tag":72,"props":2687,"children":2689},{"className":2688},[],[2690],{"type":47,"value":109},{"type":47,"value":2627},{"type":42,"tag":72,"props":2693,"children":2695},{"className":2694},[],[2696],{"type":47,"value":2697},"api",{"type":47,"value":103},{"type":42,"tag":72,"props":2700,"children":2702},{"className":2701},[],[2703],{"type":47,"value":2704},"authentication",{"type":47,"value":103},{"type":42,"tag":72,"props":2707,"children":2709},{"className":2708},[],[2710],{"type":47,"value":2711},"configuration",{"type":47,"value":103},{"type":42,"tag":72,"props":2714,"children":2716},{"className":2715},[],[2717],{"type":47,"value":2718},"database",{"type":47,"value":103},{"type":42,"tag":72,"props":2721,"children":2723},{"className":2722},[],[2724],{"type":47,"value":2725},"driver",{"type":47,"value":103},{"type":42,"tag":72,"props":2728,"children":2730},{"className":2729},[],[2731],{"type":47,"value":2732},"email",{"type":47,"value":103},{"type":42,"tag":72,"props":2735,"children":2737},{"className":2736},[],[2738],{"type":47,"value":2739},"file",{"type":47,"value":103},{"type":42,"tag":72,"props":2742,"children":2744},{"className":2743},[],[2745],{"type":47,"value":2746},"host",{"type":47,"value":103},{"type":42,"tag":72,"props":2749,"children":2751},{"className":2750},[],[2752],{"type":47,"value":2753},"iam",{"type":47,"value":103},{"type":42,"tag":72,"props":2756,"children":2758},{"className":2757},[],[2759],{"type":47,"value":2760},"intrusion_detection",{"type":47,"value":103},{"type":42,"tag":72,"props":2763,"children":2765},{"className":2764},[],[2766],{"type":47,"value":2767},"library",{"type":47,"value":103},{"type":42,"tag":72,"props":2770,"children":2772},{"className":2771},[],[2773],{"type":47,"value":2774},"malware",{"type":47,"value":103},{"type":42,"tag":72,"props":2777,"children":2779},{"className":2778},[],[2780],{"type":47,"value":2781},"network",{"type":47,"value":103},{"type":42,"tag":72,"props":2784,"children":2786},{"className":2785},[],[2787],{"type":47,"value":2788},"package",{"type":47,"value":103},{"type":42,"tag":72,"props":2791,"children":2793},{"className":2792},[],[2794],{"type":47,"value":2795},"process",{"type":47,"value":103},{"type":42,"tag":72,"props":2798,"children":2800},{"className":2799},[],[2801],{"type":47,"value":2802},"registry",{"type":47,"value":103},{"type":42,"tag":72,"props":2805,"children":2807},{"className":2806},[],[2808],{"type":47,"value":2809},"session",{"type":47,"value":103},{"type":42,"tag":72,"props":2812,"children":2814},{"className":2813},[],[2815],{"type":47,"value":2816},"threat",{"type":47,"value":103},{"type":42,"tag":72,"props":2819,"children":2821},{"className":2820},[],[2822],{"type":47,"value":2823},"vulnerability",{"type":47,"value":103},{"type":42,"tag":72,"props":2826,"children":2828},{"className":2827},[],[2829],{"type":47,"value":2830},"web",{"type":42,"tag":66,"props":2832,"children":2833},{},[2834,2839,2840,2846,2847,2853,2854,2860,2861,2867,2868,2874,2875,2881,2882,2888,2889,2895,2896,2902,2903,2909,2910,2916,2917,2922,2923,2929,2930,2936,2937,2943,2944,2950,2951,2957,2958],{"type":42,"tag":72,"props":2835,"children":2837},{"className":2836},[],[2838],{"type":47,"value":116},{"type":47,"value":2627},{"type":42,"tag":72,"props":2841,"children":2843},{"className":2842},[],[2844],{"type":47,"value":2845},"access",{"type":47,"value":103},{"type":42,"tag":72,"props":2848,"children":2850},{"className":2849},[],[2851],{"type":47,"value":2852},"admin",{"type":47,"value":103},{"type":42,"tag":72,"props":2855,"children":2857},{"className":2856},[],[2858],{"type":47,"value":2859},"allowed",{"type":47,"value":103},{"type":42,"tag":72,"props":2862,"children":2864},{"className":2863},[],[2865],{"type":47,"value":2866},"change",{"type":47,"value":103},{"type":42,"tag":72,"props":2869,"children":2871},{"className":2870},[],[2872],{"type":47,"value":2873},"connection",{"type":47,"value":103},{"type":42,"tag":72,"props":2876,"children":2878},{"className":2877},[],[2879],{"type":47,"value":2880},"creation",{"type":47,"value":103},{"type":42,"tag":72,"props":2883,"children":2885},{"className":2884},[],[2886],{"type":47,"value":2887},"deletion",{"type":47,"value":103},{"type":42,"tag":72,"props":2890,"children":2892},{"className":2891},[],[2893],{"type":47,"value":2894},"denied",{"type":47,"value":103},{"type":42,"tag":72,"props":2897,"children":2899},{"className":2898},[],[2900],{"type":47,"value":2901},"device",{"type":47,"value":103},{"type":42,"tag":72,"props":2904,"children":2906},{"className":2905},[],[2907],{"type":47,"value":2908},"end",{"type":47,"value":103},{"type":42,"tag":72,"props":2911,"children":2913},{"className":2912},[],[2914],{"type":47,"value":2915},"error",{"type":47,"value":103},{"type":42,"tag":72,"props":2918,"children":2920},{"className":2919},[],[2921],{"type":47,"value":1685},{"type":47,"value":103},{"type":42,"tag":72,"props":2924,"children":2926},{"className":2925},[],[2927],{"type":47,"value":2928},"indicator",{"type":47,"value":103},{"type":42,"tag":72,"props":2931,"children":2933},{"className":2932},[],[2934],{"type":47,"value":2935},"info",{"type":47,"value":103},{"type":42,"tag":72,"props":2938,"children":2940},{"className":2939},[],[2941],{"type":47,"value":2942},"installation",{"type":47,"value":103},{"type":42,"tag":72,"props":2945,"children":2947},{"className":2946},[],[2948],{"type":47,"value":2949},"protocol",{"type":47,"value":103},{"type":42,"tag":72,"props":2952,"children":2954},{"className":2953},[],[2955],{"type":47,"value":2956},"start",{"type":47,"value":103},{"type":42,"tag":72,"props":2959,"children":2961},{"className":2960},[],[2962],{"type":47,"value":2963},"user",{"type":42,"tag":56,"props":2965,"children":2966},{},[2967],{"type":47,"value":2968},"Decision workflow:",{"type":42,"tag":2970,"props":2971,"children":2972},"ol",{},[2973,3015,3025,3035,3045],{"type":42,"tag":66,"props":2974,"children":2975},{},[2976,2981,2982,2987,2989,2994,2996,3001,3003,3008,3009],{"type":42,"tag":72,"props":2977,"children":2979},{"className":2978},[],[2980],{"type":47,"value":101},{"type":47,"value":2627},{"type":42,"tag":72,"props":2983,"children":2985},{"className":2984},[],[2986],{"type":47,"value":2654},{"type":47,"value":2988}," for normal logs, ",{"type":42,"tag":72,"props":2990,"children":2992},{"className":2991},[],[2993],{"type":47,"value":2661},{"type":47,"value":2995}," for measurements, ",{"type":42,"tag":72,"props":2997,"children":2999},{"className":2998},[],[3000],{"type":47,"value":2682},{"type":47,"value":3002}," for snapshots, ",{"type":42,"tag":72,"props":3004,"children":3006},{"className":3005},[],[3007],{"type":47,"value":2668},{"type":47,"value":1149},{"type":42,"tag":72,"props":3010,"children":3012},{"className":3011},[],[3013],{"type":47,"value":3014},"on_failure",{"type":42,"tag":66,"props":3016,"children":3017},{},[3018,3023],{"type":42,"tag":72,"props":3019,"children":3021},{"className":3020},[],[3022],{"type":47,"value":109},{"type":47,"value":3024},": one or more values (array) for the broad domain",{"type":42,"tag":66,"props":3026,"children":3027},{},[3028,3033],{"type":42,"tag":72,"props":3029,"children":3031},{"className":3030},[],[3032],{"type":47,"value":116},{"type":47,"value":3034},": one or more values (array) for operation style",{"type":42,"tag":66,"props":3036,"children":3037},{},[3038,3043],{"type":42,"tag":72,"props":3039,"children":3041},{"className":3040},[],[3042],{"type":47,"value":124},{"type":47,"value":3044},": only when a clear success\u002Ffailure\u002Funknown applies; omit for informational\u002Fmetric events",{"type":42,"tag":66,"props":3046,"children":3047},{},[3048],{"type":47,"value":3049},"If no allowed value fits, leave the field empty — do not invent values",{"type":42,"tag":56,"props":3051,"children":3052},{},[3053,3054,3060,3062,3068,3069,3075,3076,3082],{"type":47,"value":1970},{"type":42,"tag":72,"props":3055,"children":3057},{"className":3056},[],[3058],{"type":47,"value":3059},"event.action",{"type":47,"value":3061}," for source-specific verbs (",{"type":42,"tag":72,"props":3063,"children":3065},{"className":3064},[],[3066],{"type":47,"value":3067},"blocked",{"type":47,"value":103},{"type":42,"tag":72,"props":3070,"children":3072},{"className":3071},[],[3073],{"type":47,"value":3074},"dropped",{"type":47,"value":103},{"type":42,"tag":72,"props":3077,"children":3079},{"className":3078},[],[3080],{"type":47,"value":3081},"authenticated",{"type":47,"value":297},{"type":42,"tag":56,"props":3084,"children":3085},{},[3086,3087,3093],{"type":47,"value":2397},{"type":42,"tag":72,"props":3088,"children":3090},{"className":3089},[],[3091],{"type":47,"value":3092},"references\u002Fcategorization-cheatsheet.md",{"type":47,"value":3094}," for full worked examples.",{"type":42,"tag":318,"props":3096,"children":3098},{"id":3097},"timestamp-fields",[3099],{"type":47,"value":3100},"Timestamp fields",{"type":42,"tag":56,"props":3102,"children":3103},{},[3104],{"type":47,"value":3105},"ECS defines several timestamp fields with distinct semantics. Use them correctly:",{"type":42,"tag":729,"props":3107,"children":3108},{},[3109,3128],{"type":42,"tag":733,"props":3110,"children":3111},{},[3112],{"type":42,"tag":737,"props":3113,"children":3114},{},[3115,3119,3123],{"type":42,"tag":741,"props":3116,"children":3117},{},[3118],{"type":47,"value":745},{"type":42,"tag":741,"props":3120,"children":3121},{},[3122],{"type":47,"value":54},{"type":42,"tag":741,"props":3124,"children":3125},{},[3126],{"type":47,"value":3127},"Set by",{"type":42,"tag":757,"props":3129,"children":3130},{},[3131,3152,3179,3200,3221],{"type":42,"tag":737,"props":3132,"children":3133},{},[3134,3142,3147],{"type":42,"tag":764,"props":3135,"children":3136},{},[3137],{"type":42,"tag":72,"props":3138,"children":3140},{"className":3139},[],[3141],{"type":47,"value":338},{"type":42,"tag":764,"props":3143,"children":3144},{},[3145],{"type":47,"value":3146},"The primary event timestamp. Parse from the source event data. Required.",{"type":42,"tag":764,"props":3148,"children":3149},{},[3150],{"type":47,"value":3151},"Integration pipeline",{"type":42,"tag":737,"props":3153,"children":3154},{},[3155,3164,3175],{"type":42,"tag":764,"props":3156,"children":3157},{},[3158],{"type":42,"tag":72,"props":3159,"children":3161},{"className":3160},[],[3162],{"type":47,"value":3163},"event.created",{"type":42,"tag":764,"props":3165,"children":3166},{},[3167,3169,3174],{"type":47,"value":3168},"When the event was first created or recorded by the source system, if different from ",{"type":42,"tag":72,"props":3170,"children":3172},{"className":3171},[],[3173],{"type":47,"value":338},{"type":47,"value":697},{"type":42,"tag":764,"props":3176,"children":3177},{},[3178],{"type":47,"value":3151},{"type":42,"tag":737,"props":3180,"children":3181},{},[3182,3191,3196],{"type":42,"tag":764,"props":3183,"children":3184},{},[3185],{"type":42,"tag":72,"props":3186,"children":3188},{"className":3187},[],[3189],{"type":47,"value":3190},"event.start",{"type":42,"tag":764,"props":3192,"children":3193},{},[3194],{"type":47,"value":3195},"When an activity or period began (e.g., session start, connection start).",{"type":42,"tag":764,"props":3197,"children":3198},{},[3199],{"type":47,"value":3151},{"type":42,"tag":737,"props":3201,"children":3202},{},[3203,3212,3217],{"type":42,"tag":764,"props":3204,"children":3205},{},[3206],{"type":42,"tag":72,"props":3207,"children":3209},{"className":3208},[],[3210],{"type":47,"value":3211},"event.end",{"type":42,"tag":764,"props":3213,"children":3214},{},[3215],{"type":47,"value":3216},"When an activity or period ended (e.g., session end, connection close).",{"type":42,"tag":764,"props":3218,"children":3219},{},[3220],{"type":47,"value":3151},{"type":42,"tag":737,"props":3222,"children":3223},{},[3224,3233,3238],{"type":42,"tag":764,"props":3225,"children":3226},{},[3227],{"type":42,"tag":72,"props":3228,"children":3230},{"className":3229},[],[3231],{"type":47,"value":3232},"event.ingested",{"type":42,"tag":764,"props":3234,"children":3235},{},[3236],{"type":47,"value":3237},"When the event was ingested into Elasticsearch.",{"type":42,"tag":764,"props":3239,"children":3240},{},[3241],{"type":42,"tag":283,"props":3242,"children":3243},{},[3244],{"type":47,"value":3245},"Elasticsearch (outside the integration)",{"type":42,"tag":56,"props":3247,"children":3248},{},[3249,3259,3261,3267,3269,3274],{"type":42,"tag":283,"props":3250,"children":3251},{},[3252,3257],{"type":42,"tag":72,"props":3253,"children":3255},{"className":3254},[],[3256],{"type":47,"value":3232},{"type":47,"value":3258}," must NEVER be set by an integration pipeline.",{"type":47,"value":3260}," It is managed automatically by Elasticsearch's final pipeline. Do not add a ",{"type":42,"tag":72,"props":3262,"children":3264},{"className":3263},[],[3265],{"type":47,"value":3266},"set",{"type":47,"value":3268}," processor for ",{"type":42,"tag":72,"props":3270,"children":3272},{"className":3271},[],[3273],{"type":47,"value":3232},{"type":47,"value":697},{"type":42,"tag":56,"props":3276,"children":3277},{},[3278],{"type":47,"value":3279},"When the source data contains multiple timestamps:",{"type":42,"tag":2970,"props":3281,"children":3282},{},[3283,3294,3305,3322],{"type":42,"tag":66,"props":3284,"children":3285},{},[3286,3288,3293],{"type":47,"value":3287},"Map the primary event timestamp to ",{"type":42,"tag":72,"props":3289,"children":3291},{"className":3290},[],[3292],{"type":47,"value":338},{"type":47,"value":697},{"type":42,"tag":66,"props":3295,"children":3296},{},[3297,3299,3304],{"type":47,"value":3298},"If another timestamp represents when the event was first recorded\u002Fcreated, map it to ",{"type":42,"tag":72,"props":3300,"children":3302},{"className":3301},[],[3303],{"type":47,"value":3163},{"type":47,"value":697},{"type":42,"tag":66,"props":3306,"children":3307},{},[3308,3310,3315,3316,3321],{"type":47,"value":3309},"If timestamps represent the start or end of an activity, map them to ",{"type":42,"tag":72,"props":3311,"children":3313},{"className":3312},[],[3314],{"type":47,"value":3190},{"type":47,"value":355},{"type":42,"tag":72,"props":3317,"children":3319},{"className":3318},[],[3320],{"type":47,"value":3211},{"type":47,"value":697},{"type":42,"tag":66,"props":3323,"children":3324},{},[3325,3327,3333,3334,3339],{"type":47,"value":3326},"If a timestamp does not match the semantics of any of the above, map it to a custom field under the vendor namespace with ",{"type":42,"tag":72,"props":3328,"children":3330},{"className":3329},[],[3331],{"type":47,"value":3332},"type: date",{"type":47,"value":1149},{"type":42,"tag":72,"props":3335,"children":3337},{"className":3336},[],[3338],{"type":47,"value":1155},{"type":47,"value":697},{"type":42,"tag":318,"props":3341,"children":3343},{"id":3342},"reusable-fieldset-nesting-rules",[3344],{"type":47,"value":3345},"Reusable fieldset nesting rules",{"type":42,"tag":56,"props":3347,"children":3348},{},[3349],{"type":47,"value":3350},"Some ECS field sets must be nested under a parent entity — they are not valid at document root.",{"type":42,"tag":56,"props":3352,"children":3353},{},[3354,3363,3365,3371,3372,3378,3379,3385,3386,3392,3393,3399,3400,3406,3407],{"type":42,"tag":283,"props":3355,"children":3356},{},[3357],{"type":42,"tag":72,"props":3358,"children":3360},{"className":3359},[],[3361],{"type":47,"value":3362},"geo",{"type":47,"value":3364}," — must be nested under: ",{"type":42,"tag":72,"props":3366,"children":3368},{"className":3367},[],[3369],{"type":47,"value":3370},"client.geo",{"type":47,"value":103},{"type":42,"tag":72,"props":3373,"children":3375},{"className":3374},[],[3376],{"type":47,"value":3377},"destination.geo",{"type":47,"value":103},{"type":42,"tag":72,"props":3380,"children":3382},{"className":3381},[],[3383],{"type":47,"value":3384},"host.geo",{"type":47,"value":103},{"type":42,"tag":72,"props":3387,"children":3389},{"className":3388},[],[3390],{"type":47,"value":3391},"observer.geo",{"type":47,"value":103},{"type":42,"tag":72,"props":3394,"children":3396},{"className":3395},[],[3397],{"type":47,"value":3398},"server.geo",{"type":47,"value":103},{"type":42,"tag":72,"props":3401,"children":3403},{"className":3402},[],[3404],{"type":47,"value":3405},"source.geo",{"type":47,"value":103},{"type":42,"tag":72,"props":3408,"children":3410},{"className":3409},[],[3411],{"type":47,"value":3412},"threat.indicator.geo",{"type":42,"tag":56,"props":3414,"children":3415},{},[3416,3418,3424,3426,3432,3434,3440],{"type":47,"value":3417},"Root-level ",{"type":42,"tag":72,"props":3419,"children":3421},{"className":3420},[],[3422],{"type":47,"value":3423},"geo.*",{"type":47,"value":3425}," fields are not recognized and will appear unmapped. Always set ",{"type":42,"tag":72,"props":3427,"children":3429},{"className":3428},[],[3430],{"type":47,"value":3431},"target_field",{"type":47,"value":3433}," on the ",{"type":42,"tag":72,"props":3435,"children":3437},{"className":3436},[],[3438],{"type":47,"value":3439},"geoip",{"type":47,"value":3441}," processor:",{"type":42,"tag":207,"props":3443,"children":3445},{"className":209,"code":3444,"language":211,"meta":212,"style":212},"- geoip:\n    field: source.ip\n    target_field: source.geo\n    ignore_missing: true\n",[3446],{"type":42,"tag":72,"props":3447,"children":3448},{"__ignoreMap":212},[3449,3465,3481,3498],{"type":42,"tag":218,"props":3450,"children":3451},{"class":220,"line":221},[3452,3456,3461],{"type":42,"tag":218,"props":3453,"children":3454},{"style":231},[3455],{"type":47,"value":386},{"type":42,"tag":218,"props":3457,"children":3458},{"style":225},[3459],{"type":47,"value":3460}," geoip",{"type":42,"tag":218,"props":3462,"children":3463},{"style":231},[3464],{"type":47,"value":234},{"type":42,"tag":218,"props":3466,"children":3467},{"class":220,"line":27},[3468,3473,3477],{"type":42,"tag":218,"props":3469,"children":3470},{"style":225},[3471],{"type":47,"value":3472},"    field",{"type":42,"tag":218,"props":3474,"children":3475},{"style":231},[3476],{"type":47,"value":260},{"type":42,"tag":218,"props":3478,"children":3479},{"style":268},[3480],{"type":47,"value":1374},{"type":42,"tag":218,"props":3482,"children":3483},{"class":220,"line":249},[3484,3489,3493],{"type":42,"tag":218,"props":3485,"children":3486},{"style":225},[3487],{"type":47,"value":3488},"    target_field",{"type":42,"tag":218,"props":3490,"children":3491},{"style":231},[3492],{"type":47,"value":260},{"type":42,"tag":218,"props":3494,"children":3495},{"style":268},[3496],{"type":47,"value":3497}," source.geo\n",{"type":42,"tag":218,"props":3499,"children":3500},{"class":220,"line":440},[3501,3506,3510],{"type":42,"tag":218,"props":3502,"children":3503},{"style":225},[3504],{"type":47,"value":3505},"    ignore_missing",{"type":42,"tag":218,"props":3507,"children":3508},{"style":231},[3509],{"type":47,"value":260},{"type":42,"tag":218,"props":3511,"children":3513},{"style":3512},"--shiki-light:#FF5370;--shiki-default:#FF9CAC;--shiki-dark:#FF9CAC",[3514],{"type":47,"value":3515}," true\n",{"type":42,"tag":56,"props":3517,"children":3518},{},[3519,3528,3530,3536,3537,3543,3544,3550,3551],{"type":42,"tag":283,"props":3520,"children":3521},{},[3522],{"type":42,"tag":72,"props":3523,"children":3525},{"className":3524},[],[3526],{"type":47,"value":3527},"as",{"type":47,"value":3529}," (Autonomous System) — nested under: ",{"type":42,"tag":72,"props":3531,"children":3533},{"className":3532},[],[3534],{"type":47,"value":3535},"client.as",{"type":47,"value":103},{"type":42,"tag":72,"props":3538,"children":3540},{"className":3539},[],[3541],{"type":47,"value":3542},"destination.as",{"type":47,"value":103},{"type":42,"tag":72,"props":3545,"children":3547},{"className":3546},[],[3548],{"type":47,"value":3549},"server.as",{"type":47,"value":103},{"type":42,"tag":72,"props":3552,"children":3554},{"className":3553},[],[3555],{"type":47,"value":3556},"source.as",{"type":42,"tag":56,"props":3558,"children":3559},{},[3560,3562,3567,3569,3575,3577,3582,3584,3590,3591,3597,3599,3605,3606,3612],{"type":47,"value":3561},"When using ",{"type":42,"tag":72,"props":3563,"children":3565},{"className":3564},[],[3566],{"type":47,"value":3439},{"type":47,"value":3568}," for geolocation, always also perform an ASN lookup using ",{"type":42,"tag":72,"props":3570,"children":3572},{"className":3571},[],[3573],{"type":47,"value":3574},"GeoLite2-ASN.mmdb",{"type":47,"value":3576}," and rename the raw output fields to ECS names. The ",{"type":42,"tag":72,"props":3578,"children":3580},{"className":3579},[],[3581],{"type":47,"value":3439},{"type":47,"value":3583}," ASN processor outputs ",{"type":42,"tag":72,"props":3585,"children":3587},{"className":3586},[],[3588],{"type":47,"value":3589},"asn",{"type":47,"value":355},{"type":42,"tag":72,"props":3592,"children":3594},{"className":3593},[],[3595],{"type":47,"value":3596},"organization_name",{"type":47,"value":3598},", which must be renamed to ",{"type":42,"tag":72,"props":3600,"children":3602},{"className":3601},[],[3603],{"type":47,"value":3604},"as.number",{"type":47,"value":355},{"type":42,"tag":72,"props":3607,"children":3609},{"className":3608},[],[3610],{"type":47,"value":3611},"as.organization.name",{"type":47,"value":260},{"type":42,"tag":207,"props":3614,"children":3616},{"className":209,"code":3615,"language":211,"meta":212,"style":212},"- geoip:\n    database_file: GeoLite2-ASN.mmdb\n    field: source.ip\n    target_field: source.as\n    properties:\n      - asn\n      - organization_name\n    ignore_missing: true\n- rename:\n    field: source.as.asn\n    target_field: source.as.number\n    ignore_missing: true\n- rename:\n    field: source.as.organization_name\n    target_field: source.as.organization.name\n    ignore_missing: true\n",[3617],{"type":42,"tag":72,"props":3618,"children":3619},{"__ignoreMap":212},[3620,3635,3652,3667,3683,3695,3708,3720,3735,3751,3767,3783,3798,3813,3829,3845],{"type":42,"tag":218,"props":3621,"children":3622},{"class":220,"line":221},[3623,3627,3631],{"type":42,"tag":218,"props":3624,"children":3625},{"style":231},[3626],{"type":47,"value":386},{"type":42,"tag":218,"props":3628,"children":3629},{"style":225},[3630],{"type":47,"value":3460},{"type":42,"tag":218,"props":3632,"children":3633},{"style":231},[3634],{"type":47,"value":234},{"type":42,"tag":218,"props":3636,"children":3637},{"class":220,"line":27},[3638,3643,3647],{"type":42,"tag":218,"props":3639,"children":3640},{"style":225},[3641],{"type":47,"value":3642},"    database_file",{"type":42,"tag":218,"props":3644,"children":3645},{"style":231},[3646],{"type":47,"value":260},{"type":42,"tag":218,"props":3648,"children":3649},{"style":268},[3650],{"type":47,"value":3651}," GeoLite2-ASN.mmdb\n",{"type":42,"tag":218,"props":3653,"children":3654},{"class":220,"line":249},[3655,3659,3663],{"type":42,"tag":218,"props":3656,"children":3657},{"style":225},[3658],{"type":47,"value":3472},{"type":42,"tag":218,"props":3660,"children":3661},{"style":231},[3662],{"type":47,"value":260},{"type":42,"tag":218,"props":3664,"children":3665},{"style":268},[3666],{"type":47,"value":1374},{"type":42,"tag":218,"props":3668,"children":3669},{"class":220,"line":440},[3670,3674,3678],{"type":42,"tag":218,"props":3671,"children":3672},{"style":225},[3673],{"type":47,"value":3488},{"type":42,"tag":218,"props":3675,"children":3676},{"style":231},[3677],{"type":47,"value":260},{"type":42,"tag":218,"props":3679,"children":3680},{"style":268},[3681],{"type":47,"value":3682}," source.as\n",{"type":42,"tag":218,"props":3684,"children":3685},{"class":220,"line":456},[3686,3691],{"type":42,"tag":218,"props":3687,"children":3688},{"style":225},[3689],{"type":47,"value":3690},"    properties",{"type":42,"tag":218,"props":3692,"children":3693},{"style":231},[3694],{"type":47,"value":234},{"type":42,"tag":218,"props":3696,"children":3697},{"class":220,"line":477},[3698,3703],{"type":42,"tag":218,"props":3699,"children":3700},{"style":231},[3701],{"type":47,"value":3702},"      -",{"type":42,"tag":218,"props":3704,"children":3705},{"style":268},[3706],{"type":47,"value":3707}," asn\n",{"type":42,"tag":218,"props":3709,"children":3710},{"class":220,"line":493},[3711,3715],{"type":42,"tag":218,"props":3712,"children":3713},{"style":231},[3714],{"type":47,"value":3702},{"type":42,"tag":218,"props":3716,"children":3717},{"style":268},[3718],{"type":47,"value":3719}," organization_name\n",{"type":42,"tag":218,"props":3721,"children":3722},{"class":220,"line":514},[3723,3727,3731],{"type":42,"tag":218,"props":3724,"children":3725},{"style":225},[3726],{"type":47,"value":3505},{"type":42,"tag":218,"props":3728,"children":3729},{"style":231},[3730],{"type":47,"value":260},{"type":42,"tag":218,"props":3732,"children":3733},{"style":3512},[3734],{"type":47,"value":3515},{"type":42,"tag":218,"props":3736,"children":3737},{"class":220,"line":530},[3738,3742,3747],{"type":42,"tag":218,"props":3739,"children":3740},{"style":231},[3741],{"type":47,"value":386},{"type":42,"tag":218,"props":3743,"children":3744},{"style":225},[3745],{"type":47,"value":3746}," rename",{"type":42,"tag":218,"props":3748,"children":3749},{"style":231},[3750],{"type":47,"value":234},{"type":42,"tag":218,"props":3752,"children":3753},{"class":220,"line":548},[3754,3758,3762],{"type":42,"tag":218,"props":3755,"children":3756},{"style":225},[3757],{"type":47,"value":3472},{"type":42,"tag":218,"props":3759,"children":3760},{"style":231},[3761],{"type":47,"value":260},{"type":42,"tag":218,"props":3763,"children":3764},{"style":268},[3765],{"type":47,"value":3766}," source.as.asn\n",{"type":42,"tag":218,"props":3768,"children":3769},{"class":220,"line":23},[3770,3774,3778],{"type":42,"tag":218,"props":3771,"children":3772},{"style":225},[3773],{"type":47,"value":3488},{"type":42,"tag":218,"props":3775,"children":3776},{"style":231},[3777],{"type":47,"value":260},{"type":42,"tag":218,"props":3779,"children":3780},{"style":268},[3781],{"type":47,"value":3782}," source.as.number\n",{"type":42,"tag":218,"props":3784,"children":3785},{"class":220,"line":586},[3786,3790,3794],{"type":42,"tag":218,"props":3787,"children":3788},{"style":225},[3789],{"type":47,"value":3505},{"type":42,"tag":218,"props":3791,"children":3792},{"style":231},[3793],{"type":47,"value":260},{"type":42,"tag":218,"props":3795,"children":3796},{"style":3512},[3797],{"type":47,"value":3515},{"type":42,"tag":218,"props":3799,"children":3800},{"class":220,"line":602},[3801,3805,3809],{"type":42,"tag":218,"props":3802,"children":3803},{"style":231},[3804],{"type":47,"value":386},{"type":42,"tag":218,"props":3806,"children":3807},{"style":225},[3808],{"type":47,"value":3746},{"type":42,"tag":218,"props":3810,"children":3811},{"style":231},[3812],{"type":47,"value":234},{"type":42,"tag":218,"props":3814,"children":3815},{"class":220,"line":618},[3816,3820,3824],{"type":42,"tag":218,"props":3817,"children":3818},{"style":225},[3819],{"type":47,"value":3472},{"type":42,"tag":218,"props":3821,"children":3822},{"style":231},[3823],{"type":47,"value":260},{"type":42,"tag":218,"props":3825,"children":3826},{"style":268},[3827],{"type":47,"value":3828}," source.as.organization_name\n",{"type":42,"tag":218,"props":3830,"children":3831},{"class":220,"line":635},[3832,3836,3840],{"type":42,"tag":218,"props":3833,"children":3834},{"style":225},[3835],{"type":47,"value":3488},{"type":42,"tag":218,"props":3837,"children":3838},{"style":231},[3839],{"type":47,"value":260},{"type":42,"tag":218,"props":3841,"children":3842},{"style":268},[3843],{"type":47,"value":3844}," source.as.organization.name\n",{"type":42,"tag":218,"props":3846,"children":3847},{"class":220,"line":665},[3848,3852,3856],{"type":42,"tag":218,"props":3849,"children":3850},{"style":225},[3851],{"type":47,"value":3505},{"type":42,"tag":218,"props":3853,"children":3854},{"style":231},[3855],{"type":47,"value":260},{"type":42,"tag":218,"props":3857,"children":3858},{"style":3512},[3859],{"type":47,"value":3515},{"type":42,"tag":56,"props":3861,"children":3862},{},[3863,3865,3871,3873,3879],{"type":47,"value":3864},"See the ",{"type":42,"tag":72,"props":3866,"children":3868},{"className":3867},[],[3869],{"type":47,"value":3870},"ingest-pipelines",{"type":47,"value":3872}," skill → ",{"type":42,"tag":72,"props":3874,"children":3876},{"className":3875},[],[3877],{"type":47,"value":3878},"references\u002Fprocessor-cookbook.md",{"type":47,"value":3880}," for the full geo+ASN pattern with both source and destination.",{"type":42,"tag":56,"props":3882,"children":3883},{},[3884,3893,3895,3901,3902,3908,3909],{"type":42,"tag":283,"props":3885,"children":3886},{},[3887],{"type":42,"tag":72,"props":3888,"children":3890},{"className":3889},[],[3891],{"type":47,"value":3892},"os",{"type":47,"value":3894}," — nested under: ",{"type":42,"tag":72,"props":3896,"children":3898},{"className":3897},[],[3899],{"type":47,"value":3900},"host.os",{"type":47,"value":103},{"type":42,"tag":72,"props":3903,"children":3905},{"className":3904},[],[3906],{"type":47,"value":3907},"observer.os",{"type":47,"value":103},{"type":42,"tag":72,"props":3910,"children":3912},{"className":3911},[],[3913],{"type":47,"value":3914},"user_agent.os",{"type":42,"tag":318,"props":3916,"children":3918},{"id":3917},"nested-array-of-objects-ecs-fields",[3919],{"type":47,"value":3920},"Nested (array-of-objects) ECS fields",{"type":42,"tag":56,"props":3922,"children":3923},{},[3924,3926,3932,3934,3939,3941,3945],{"type":47,"value":3925},"Some ECS fields use ",{"type":42,"tag":72,"props":3927,"children":3929},{"className":3928},[],[3930],{"type":47,"value":3931},"type: nested",{"type":47,"value":3933},", meaning they hold an ",{"type":42,"tag":283,"props":3935,"children":3936},{},[3937],{"type":47,"value":3938},"array of objects",{"type":47,"value":3940}," where each object groups related sub-fields together. The pipeline must produce this structure — do ",{"type":42,"tag":283,"props":3942,"children":3943},{},[3944],{"type":47,"value":1963},{"type":47,"value":3946}," flatten these into parallel scalar arrays.",{"type":42,"tag":56,"props":3948,"children":3949},{},[3950],{"type":42,"tag":283,"props":3951,"children":3952},{},[3953,3955,3961],{"type":47,"value":3954},"ECS fields that use ",{"type":42,"tag":72,"props":3956,"children":3958},{"className":3957},[],[3959],{"type":47,"value":3960},"nested",{"type":47,"value":3962}," type:",{"type":42,"tag":729,"props":3964,"children":3965},{},[3966,3981],{"type":42,"tag":733,"props":3967,"children":3968},{},[3969],{"type":42,"tag":737,"props":3970,"children":3971},{},[3972,3976],{"type":42,"tag":741,"props":3973,"children":3974},{},[3975],{"type":47,"value":745},{"type":42,"tag":741,"props":3977,"children":3978},{},[3979],{"type":47,"value":3980},"Contains",{"type":42,"tag":757,"props":3982,"children":3983},{},[3984,4033,4061,4097,4130,4163],{"type":42,"tag":737,"props":3985,"children":3986},{},[3987,3996],{"type":42,"tag":764,"props":3988,"children":3989},{},[3990],{"type":42,"tag":72,"props":3991,"children":3993},{"className":3992},[],[3994],{"type":47,"value":3995},"email.attachments",{"type":42,"tag":764,"props":3997,"children":3998},{},[3999,4005,4006,4012,4013,4019,4020,4026,4027],{"type":42,"tag":72,"props":4000,"children":4002},{"className":4001},[],[4003],{"type":47,"value":4004},"file.name",{"type":47,"value":103},{"type":42,"tag":72,"props":4007,"children":4009},{"className":4008},[],[4010],{"type":47,"value":4011},"file.size",{"type":47,"value":103},{"type":42,"tag":72,"props":4014,"children":4016},{"className":4015},[],[4017],{"type":47,"value":4018},"file.extension",{"type":47,"value":103},{"type":42,"tag":72,"props":4021,"children":4023},{"className":4022},[],[4024],{"type":47,"value":4025},"file.mime_type",{"type":47,"value":103},{"type":42,"tag":72,"props":4028,"children":4030},{"className":4029},[],[4031],{"type":47,"value":4032},"file.hash.*",{"type":42,"tag":737,"props":4034,"children":4035},{},[4036,4045],{"type":42,"tag":764,"props":4037,"children":4038},{},[4039],{"type":42,"tag":72,"props":4040,"children":4042},{"className":4041},[],[4043],{"type":47,"value":4044},"threat.enrichments",{"type":42,"tag":764,"props":4046,"children":4047},{},[4048,4054,4055],{"type":42,"tag":72,"props":4049,"children":4051},{"className":4050},[],[4052],{"type":47,"value":4053},"indicator.*",{"type":47,"value":103},{"type":42,"tag":72,"props":4056,"children":4058},{"className":4057},[],[4059],{"type":47,"value":4060},"matched.*",{"type":42,"tag":737,"props":4062,"children":4063},{},[4064,4073],{"type":42,"tag":764,"props":4065,"children":4066},{},[4067],{"type":42,"tag":72,"props":4068,"children":4070},{"className":4069},[],[4071],{"type":47,"value":4072},"threat.indicator.file.elf.sections",{"type":42,"tag":764,"props":4074,"children":4075},{},[4076,4081,4082,4088,4089,4095],{"type":42,"tag":72,"props":4077,"children":4079},{"className":4078},[],[4080],{"type":47,"value":1072},{"type":47,"value":103},{"type":42,"tag":72,"props":4083,"children":4085},{"className":4084},[],[4086],{"type":47,"value":4087},"physical_size",{"type":47,"value":103},{"type":42,"tag":72,"props":4090,"children":4092},{"className":4091},[],[4093],{"type":47,"value":4094},"virtual_size",{"type":47,"value":4096},", etc.",{"type":42,"tag":737,"props":4098,"children":4099},{},[4100,4109],{"type":42,"tag":764,"props":4101,"children":4102},{},[4103],{"type":42,"tag":72,"props":4104,"children":4106},{"className":4105},[],[4107],{"type":47,"value":4108},"threat.indicator.file.pe.sections",{"type":42,"tag":764,"props":4110,"children":4111},{},[4112,4117,4118,4123,4124,4129],{"type":42,"tag":72,"props":4113,"children":4115},{"className":4114},[],[4116],{"type":47,"value":1072},{"type":47,"value":103},{"type":42,"tag":72,"props":4119,"children":4121},{"className":4120},[],[4122],{"type":47,"value":4087},{"type":47,"value":103},{"type":42,"tag":72,"props":4125,"children":4127},{"className":4126},[],[4128],{"type":47,"value":4094},{"type":47,"value":4096},{"type":42,"tag":737,"props":4131,"children":4132},{},[4133,4142],{"type":42,"tag":764,"props":4134,"children":4135},{},[4136],{"type":42,"tag":72,"props":4137,"children":4139},{"className":4138},[],[4140],{"type":47,"value":4141},"process.elf.sections",{"type":42,"tag":764,"props":4143,"children":4144},{},[4145,4150,4151,4156,4157,4162],{"type":42,"tag":72,"props":4146,"children":4148},{"className":4147},[],[4149],{"type":47,"value":1072},{"type":47,"value":103},{"type":42,"tag":72,"props":4152,"children":4154},{"className":4153},[],[4155],{"type":47,"value":4087},{"type":47,"value":103},{"type":42,"tag":72,"props":4158,"children":4160},{"className":4159},[],[4161],{"type":47,"value":4094},{"type":47,"value":4096},{"type":42,"tag":737,"props":4164,"children":4165},{},[4166,4175],{"type":42,"tag":764,"props":4167,"children":4168},{},[4169],{"type":42,"tag":72,"props":4170,"children":4172},{"className":4171},[],[4173],{"type":47,"value":4174},"process.pe.sections",{"type":42,"tag":764,"props":4176,"children":4177},{},[4178,4183,4184,4189,4190,4195],{"type":42,"tag":72,"props":4179,"children":4181},{"className":4180},[],[4182],{"type":47,"value":1072},{"type":47,"value":103},{"type":42,"tag":72,"props":4185,"children":4187},{"className":4186},[],[4188],{"type":47,"value":4087},{"type":47,"value":103},{"type":42,"tag":72,"props":4191,"children":4193},{"className":4192},[],[4194],{"type":47,"value":4094},{"type":47,"value":4096},{"type":42,"tag":56,"props":4197,"children":4198},{},[4199],{"type":42,"tag":283,"props":4200,"children":4201},{},[4202],{"type":47,"value":4203},"Anti-pattern — parallel arrays (WRONG):",{"type":42,"tag":207,"props":4205,"children":4209},{"className":4206,"code":4207,"language":4208,"meta":212,"style":212},"language-json shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","{\n  \"email\": {\n    \"attachments\": {\n      \"file\": {\n        \"name\": [\"a.pdf\", \"b.pdf\"],\n        \"size\": [1024, 2048]\n      }\n    }\n  }\n}\n","json",[4210],{"type":42,"tag":72,"props":4211,"children":4212},{"__ignoreMap":212},[4213,4221,4248,4274,4299,4360,4403,4411,4419,4427],{"type":42,"tag":218,"props":4214,"children":4215},{"class":220,"line":221},[4216],{"type":42,"tag":218,"props":4217,"children":4218},{"style":231},[4219],{"type":47,"value":4220},"{\n",{"type":42,"tag":218,"props":4222,"children":4223},{"class":220,"line":27},[4224,4229,4234,4239,4243],{"type":42,"tag":218,"props":4225,"children":4226},{"style":231},[4227],{"type":47,"value":4228},"  \"",{"type":42,"tag":218,"props":4230,"children":4232},{"style":4231},"--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA",[4233],{"type":47,"value":2732},{"type":42,"tag":218,"props":4235,"children":4236},{"style":231},[4237],{"type":47,"value":4238},"\"",{"type":42,"tag":218,"props":4240,"children":4241},{"style":231},[4242],{"type":47,"value":260},{"type":42,"tag":218,"props":4244,"children":4245},{"style":231},[4246],{"type":47,"value":4247}," {\n",{"type":42,"tag":218,"props":4249,"children":4250},{"class":220,"line":249},[4251,4256,4262,4266,4270],{"type":42,"tag":218,"props":4252,"children":4253},{"style":231},[4254],{"type":47,"value":4255},"    \"",{"type":42,"tag":218,"props":4257,"children":4259},{"style":4258},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[4260],{"type":47,"value":4261},"attachments",{"type":42,"tag":218,"props":4263,"children":4264},{"style":231},[4265],{"type":47,"value":4238},{"type":42,"tag":218,"props":4267,"children":4268},{"style":231},[4269],{"type":47,"value":260},{"type":42,"tag":218,"props":4271,"children":4272},{"style":231},[4273],{"type":47,"value":4247},{"type":42,"tag":218,"props":4275,"children":4276},{"class":220,"line":440},[4277,4282,4287,4291,4295],{"type":42,"tag":218,"props":4278,"children":4279},{"style":231},[4280],{"type":47,"value":4281},"      \"",{"type":42,"tag":218,"props":4283,"children":4285},{"style":4284},"--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C",[4286],{"type":47,"value":2739},{"type":42,"tag":218,"props":4288,"children":4289},{"style":231},[4290],{"type":47,"value":4238},{"type":42,"tag":218,"props":4292,"children":4293},{"style":231},[4294],{"type":47,"value":260},{"type":42,"tag":218,"props":4296,"children":4297},{"style":231},[4298],{"type":47,"value":4247},{"type":42,"tag":218,"props":4300,"children":4301},{"class":220,"line":456},[4302,4307,4311,4315,4319,4324,4328,4333,4337,4342,4346,4351,4355],{"type":42,"tag":218,"props":4303,"children":4304},{"style":231},[4305],{"type":47,"value":4306},"        \"",{"type":42,"tag":218,"props":4308,"children":4309},{"style":225},[4310],{"type":47,"value":1072},{"type":42,"tag":218,"props":4312,"children":4313},{"style":231},[4314],{"type":47,"value":4238},{"type":42,"tag":218,"props":4316,"children":4317},{"style":231},[4318],{"type":47,"value":260},{"type":42,"tag":218,"props":4320,"children":4321},{"style":231},[4322],{"type":47,"value":4323}," [",{"type":42,"tag":218,"props":4325,"children":4326},{"style":231},[4327],{"type":47,"value":4238},{"type":42,"tag":218,"props":4329,"children":4330},{"style":268},[4331],{"type":47,"value":4332},"a.pdf",{"type":42,"tag":218,"props":4334,"children":4335},{"style":231},[4336],{"type":47,"value":4238},{"type":42,"tag":218,"props":4338,"children":4339},{"style":231},[4340],{"type":47,"value":4341},",",{"type":42,"tag":218,"props":4343,"children":4344},{"style":231},[4345],{"type":47,"value":265},{"type":42,"tag":218,"props":4347,"children":4348},{"style":268},[4349],{"type":47,"value":4350},"b.pdf",{"type":42,"tag":218,"props":4352,"children":4353},{"style":231},[4354],{"type":47,"value":4238},{"type":42,"tag":218,"props":4356,"children":4357},{"style":231},[4358],{"type":47,"value":4359},"],\n",{"type":42,"tag":218,"props":4361,"children":4362},{"class":220,"line":477},[4363,4367,4372,4376,4380,4384,4389,4393,4398],{"type":42,"tag":218,"props":4364,"children":4365},{"style":231},[4366],{"type":47,"value":4306},{"type":42,"tag":218,"props":4368,"children":4369},{"style":225},[4370],{"type":47,"value":4371},"size",{"type":42,"tag":218,"props":4373,"children":4374},{"style":231},[4375],{"type":47,"value":4238},{"type":42,"tag":218,"props":4377,"children":4378},{"style":231},[4379],{"type":47,"value":260},{"type":42,"tag":218,"props":4381,"children":4382},{"style":231},[4383],{"type":47,"value":4323},{"type":42,"tag":218,"props":4385,"children":4386},{"style":4284},[4387],{"type":47,"value":4388},"1024",{"type":42,"tag":218,"props":4390,"children":4391},{"style":231},[4392],{"type":47,"value":4341},{"type":42,"tag":218,"props":4394,"children":4395},{"style":4284},[4396],{"type":47,"value":4397}," 2048",{"type":42,"tag":218,"props":4399,"children":4400},{"style":231},[4401],{"type":47,"value":4402},"]\n",{"type":42,"tag":218,"props":4404,"children":4405},{"class":220,"line":493},[4406],{"type":42,"tag":218,"props":4407,"children":4408},{"style":231},[4409],{"type":47,"value":4410},"      }\n",{"type":42,"tag":218,"props":4412,"children":4413},{"class":220,"line":514},[4414],{"type":42,"tag":218,"props":4415,"children":4416},{"style":231},[4417],{"type":47,"value":4418},"    }\n",{"type":42,"tag":218,"props":4420,"children":4421},{"class":220,"line":530},[4422],{"type":42,"tag":218,"props":4423,"children":4424},{"style":231},[4425],{"type":47,"value":4426},"  }\n",{"type":42,"tag":218,"props":4428,"children":4429},{"class":220,"line":548},[4430],{"type":42,"tag":218,"props":4431,"children":4432},{"style":231},[4433],{"type":47,"value":4434},"}\n",{"type":42,"tag":56,"props":4436,"children":4437},{},[4438],{"type":47,"value":4439},"This loses the association between each attachment's name and size. Queries cannot isolate individual objects.",{"type":42,"tag":56,"props":4441,"children":4442},{},[4443],{"type":42,"tag":283,"props":4444,"children":4445},{},[4446],{"type":47,"value":4447},"Correct — array of objects:",{"type":42,"tag":207,"props":4449,"children":4451},{"className":4206,"code":4450,"language":4208,"meta":212,"style":212},"{\n  \"email\": {\n    \"attachments\": [\n      { \"file\": { \"name\": \"a.pdf\", \"size\": 1024 } },\n      { \"file\": { \"name\": \"b.pdf\", \"size\": 2048 } }\n    ]\n  }\n}\n",[4452],{"type":42,"tag":72,"props":4453,"children":4454},{"__ignoreMap":212},[4455,4462,4485,4509,4601,4689,4697,4704],{"type":42,"tag":218,"props":4456,"children":4457},{"class":220,"line":221},[4458],{"type":42,"tag":218,"props":4459,"children":4460},{"style":231},[4461],{"type":47,"value":4220},{"type":42,"tag":218,"props":4463,"children":4464},{"class":220,"line":27},[4465,4469,4473,4477,4481],{"type":42,"tag":218,"props":4466,"children":4467},{"style":231},[4468],{"type":47,"value":4228},{"type":42,"tag":218,"props":4470,"children":4471},{"style":4231},[4472],{"type":47,"value":2732},{"type":42,"tag":218,"props":4474,"children":4475},{"style":231},[4476],{"type":47,"value":4238},{"type":42,"tag":218,"props":4478,"children":4479},{"style":231},[4480],{"type":47,"value":260},{"type":42,"tag":218,"props":4482,"children":4483},{"style":231},[4484],{"type":47,"value":4247},{"type":42,"tag":218,"props":4486,"children":4487},{"class":220,"line":249},[4488,4492,4496,4500,4504],{"type":42,"tag":218,"props":4489,"children":4490},{"style":231},[4491],{"type":47,"value":4255},{"type":42,"tag":218,"props":4493,"children":4494},{"style":4258},[4495],{"type":47,"value":4261},{"type":42,"tag":218,"props":4497,"children":4498},{"style":231},[4499],{"type":47,"value":4238},{"type":42,"tag":218,"props":4501,"children":4502},{"style":231},[4503],{"type":47,"value":260},{"type":42,"tag":218,"props":4505,"children":4506},{"style":231},[4507],{"type":47,"value":4508}," [\n",{"type":42,"tag":218,"props":4510,"children":4511},{"class":220,"line":440},[4512,4517,4521,4525,4529,4533,4538,4542,4546,4550,4554,4558,4562,4566,4570,4574,4578,4582,4586,4591,4596],{"type":42,"tag":218,"props":4513,"children":4514},{"style":231},[4515],{"type":47,"value":4516},"      {",{"type":42,"tag":218,"props":4518,"children":4519},{"style":231},[4520],{"type":47,"value":265},{"type":42,"tag":218,"props":4522,"children":4523},{"style":4284},[4524],{"type":47,"value":2739},{"type":42,"tag":218,"props":4526,"children":4527},{"style":231},[4528],{"type":47,"value":4238},{"type":42,"tag":218,"props":4530,"children":4531},{"style":231},[4532],{"type":47,"value":260},{"type":42,"tag":218,"props":4534,"children":4535},{"style":231},[4536],{"type":47,"value":4537}," {",{"type":42,"tag":218,"props":4539,"children":4540},{"style":231},[4541],{"type":47,"value":265},{"type":42,"tag":218,"props":4543,"children":4544},{"style":225},[4545],{"type":47,"value":1072},{"type":42,"tag":218,"props":4547,"children":4548},{"style":231},[4549],{"type":47,"value":4238},{"type":42,"tag":218,"props":4551,"children":4552},{"style":231},[4553],{"type":47,"value":260},{"type":42,"tag":218,"props":4555,"children":4556},{"style":231},[4557],{"type":47,"value":265},{"type":42,"tag":218,"props":4559,"children":4560},{"style":268},[4561],{"type":47,"value":4332},{"type":42,"tag":218,"props":4563,"children":4564},{"style":231},[4565],{"type":47,"value":4238},{"type":42,"tag":218,"props":4567,"children":4568},{"style":231},[4569],{"type":47,"value":4341},{"type":42,"tag":218,"props":4571,"children":4572},{"style":231},[4573],{"type":47,"value":265},{"type":42,"tag":218,"props":4575,"children":4576},{"style":225},[4577],{"type":47,"value":4371},{"type":42,"tag":218,"props":4579,"children":4580},{"style":231},[4581],{"type":47,"value":4238},{"type":42,"tag":218,"props":4583,"children":4584},{"style":231},[4585],{"type":47,"value":260},{"type":42,"tag":218,"props":4587,"children":4588},{"style":4284},[4589],{"type":47,"value":4590}," 1024",{"type":42,"tag":218,"props":4592,"children":4593},{"style":231},[4594],{"type":47,"value":4595}," }",{"type":42,"tag":218,"props":4597,"children":4598},{"style":231},[4599],{"type":47,"value":4600}," },\n",{"type":42,"tag":218,"props":4602,"children":4603},{"class":220,"line":456},[4604,4608,4612,4616,4620,4624,4628,4632,4636,4640,4644,4648,4652,4656,4660,4664,4668,4672,4676,4680,4684],{"type":42,"tag":218,"props":4605,"children":4606},{"style":231},[4607],{"type":47,"value":4516},{"type":42,"tag":218,"props":4609,"children":4610},{"style":231},[4611],{"type":47,"value":265},{"type":42,"tag":218,"props":4613,"children":4614},{"style":4284},[4615],{"type":47,"value":2739},{"type":42,"tag":218,"props":4617,"children":4618},{"style":231},[4619],{"type":47,"value":4238},{"type":42,"tag":218,"props":4621,"children":4622},{"style":231},[4623],{"type":47,"value":260},{"type":42,"tag":218,"props":4625,"children":4626},{"style":231},[4627],{"type":47,"value":4537},{"type":42,"tag":218,"props":4629,"children":4630},{"style":231},[4631],{"type":47,"value":265},{"type":42,"tag":218,"props":4633,"children":4634},{"style":225},[4635],{"type":47,"value":1072},{"type":42,"tag":218,"props":4637,"children":4638},{"style":231},[4639],{"type":47,"value":4238},{"type":42,"tag":218,"props":4641,"children":4642},{"style":231},[4643],{"type":47,"value":260},{"type":42,"tag":218,"props":4645,"children":4646},{"style":231},[4647],{"type":47,"value":265},{"type":42,"tag":218,"props":4649,"children":4650},{"style":268},[4651],{"type":47,"value":4350},{"type":42,"tag":218,"props":4653,"children":4654},{"style":231},[4655],{"type":47,"value":4238},{"type":42,"tag":218,"props":4657,"children":4658},{"style":231},[4659],{"type":47,"value":4341},{"type":42,"tag":218,"props":4661,"children":4662},{"style":231},[4663],{"type":47,"value":265},{"type":42,"tag":218,"props":4665,"children":4666},{"style":225},[4667],{"type":47,"value":4371},{"type":42,"tag":218,"props":4669,"children":4670},{"style":231},[4671],{"type":47,"value":4238},{"type":42,"tag":218,"props":4673,"children":4674},{"style":231},[4675],{"type":47,"value":260},{"type":42,"tag":218,"props":4677,"children":4678},{"style":4284},[4679],{"type":47,"value":4397},{"type":42,"tag":218,"props":4681,"children":4682},{"style":231},[4683],{"type":47,"value":4595},{"type":42,"tag":218,"props":4685,"children":4686},{"style":231},[4687],{"type":47,"value":4688}," }\n",{"type":42,"tag":218,"props":4690,"children":4691},{"class":220,"line":477},[4692],{"type":42,"tag":218,"props":4693,"children":4694},{"style":231},[4695],{"type":47,"value":4696},"    ]\n",{"type":42,"tag":218,"props":4698,"children":4699},{"class":220,"line":493},[4700],{"type":42,"tag":218,"props":4701,"children":4702},{"style":231},[4703],{"type":47,"value":4426},{"type":42,"tag":218,"props":4705,"children":4706},{"class":220,"line":514},[4707],{"type":42,"tag":218,"props":4708,"children":4709},{"style":231},[4710],{"type":47,"value":4434},{"type":42,"tag":56,"props":4712,"children":4713},{},[4714,4724,4726,4731,4733,4738,4740,4746],{"type":42,"tag":283,"props":4715,"children":4716},{},[4717,4722],{"type":42,"tag":72,"props":4718,"children":4720},{"className":4719},[],[4721],{"type":47,"value":88},{"type":47,"value":4723}," declaration:",{"type":47,"value":4725}," declare only the parent ",{"type":42,"tag":72,"props":4727,"children":4729},{"className":4728},[],[4730],{"type":47,"value":3960},{"type":47,"value":4732}," field with ",{"type":42,"tag":72,"props":4734,"children":4736},{"className":4735},[],[4737],{"type":47,"value":346},{"type":47,"value":4739},". Child fields (",{"type":42,"tag":72,"props":4741,"children":4743},{"className":4742},[],[4744],{"type":47,"value":4745},"email.attachments.file.name",{"type":47,"value":4747},", etc.) inherit their types from the ECS schema — do not redeclare them individually.",{"type":42,"tag":207,"props":4749,"children":4751},{"className":209,"code":4750,"language":211,"meta":212,"style":212},"- name: email.attachments\n  external: ecs\n",[4752],{"type":42,"tag":72,"props":4753,"children":4754},{"__ignoreMap":212},[4755,4775],{"type":42,"tag":218,"props":4756,"children":4757},{"class":220,"line":221},[4758,4762,4766,4770],{"type":42,"tag":218,"props":4759,"children":4760},{"style":231},[4761],{"type":47,"value":386},{"type":42,"tag":218,"props":4763,"children":4764},{"style":225},[4765],{"type":47,"value":391},{"type":42,"tag":218,"props":4767,"children":4768},{"style":231},[4769],{"type":47,"value":260},{"type":42,"tag":218,"props":4771,"children":4772},{"style":268},[4773],{"type":47,"value":4774}," email.attachments\n",{"type":42,"tag":218,"props":4776,"children":4777},{"class":220,"line":27},[4778,4782,4786],{"type":42,"tag":218,"props":4779,"children":4780},{"style":225},[4781],{"type":47,"value":408},{"type":42,"tag":218,"props":4783,"children":4784},{"style":231},[4785],{"type":47,"value":260},{"type":42,"tag":218,"props":4787,"children":4788},{"style":268},[4789],{"type":47,"value":417},{"type":42,"tag":56,"props":4791,"children":4792},{},[4793,4798,4800,4806,4808,4813,4815,4821,4823,4828,4829,4834],{"type":42,"tag":283,"props":4794,"children":4795},{},[4796],{"type":47,"value":4797},"Pipeline construction:",{"type":47,"value":4799}," when source data delivers attachment metadata as separate parallel arrays (e.g., a comma-separated list of filenames and a separate list of sizes), use a ",{"type":42,"tag":72,"props":4801,"children":4803},{"className":4802},[],[4804],{"type":47,"value":4805},"script",{"type":47,"value":4807}," processor to zip them into an array of objects. See ",{"type":42,"tag":72,"props":4809,"children":4811},{"className":4810},[],[4812],{"type":47,"value":3870},{"type":47,"value":4814}," → ",{"type":42,"tag":72,"props":4816,"children":4818},{"className":4817},[],[4819],{"type":47,"value":4820},"references\u002Fpainless-patterns.md",{"type":47,"value":4822}," for array construction patterns and ",{"type":42,"tag":72,"props":4824,"children":4826},{"className":4825},[],[4827],{"type":47,"value":3878},{"type":47,"value":4814},{"type":42,"tag":283,"props":4830,"children":4831},{},[4832],{"type":47,"value":4833},"Foreach semantics",{"type":47,"value":4835}," for iterating over array elements.",{"type":42,"tag":207,"props":4837,"children":4839},{"className":209,"code":4838,"language":211,"meta":212,"style":212},"- script:\n    tag: build_email_attachments\n    description: Build email.attachments as array of nested objects from parallel source arrays.\n    lang: painless\n    if: ctx.json?.file_names instanceof List && ctx.json?.file_sizes instanceof List\n    source: |-\n      def names = ctx.json.file_names;\n      def sizes = ctx.json.file_sizes;\n      int len = Math.min(names.size(), sizes.size());\n      def attachments = new ArrayList(len);\n      for (int i = 0; i \u003C len; i++) {\n        def attachment = new HashMap();\n        def file = new HashMap();\n        file.put('name', names.get(i));\n        file.put('size', sizes.get(i));\n        attachment.put('file', file);\n        attachments.add(attachment);\n      }\n      ctx.email = ctx.email ?: [:];\n      ctx.email.attachments = attachments;\n",[4840],{"type":42,"tag":72,"props":4841,"children":4842},{"__ignoreMap":212},[4843,4859,4876,4893,4910,4927,4950,4958,4966,4974,4982,4990,4998,5006,5014,5022,5030,5038,5045,5053],{"type":42,"tag":218,"props":4844,"children":4845},{"class":220,"line":221},[4846,4850,4855],{"type":42,"tag":218,"props":4847,"children":4848},{"style":231},[4849],{"type":47,"value":386},{"type":42,"tag":218,"props":4851,"children":4852},{"style":225},[4853],{"type":47,"value":4854}," script",{"type":42,"tag":218,"props":4856,"children":4857},{"style":231},[4858],{"type":47,"value":234},{"type":42,"tag":218,"props":4860,"children":4861},{"class":220,"line":27},[4862,4867,4871],{"type":42,"tag":218,"props":4863,"children":4864},{"style":225},[4865],{"type":47,"value":4866},"    tag",{"type":42,"tag":218,"props":4868,"children":4869},{"style":231},[4870],{"type":47,"value":260},{"type":42,"tag":218,"props":4872,"children":4873},{"style":268},[4874],{"type":47,"value":4875}," build_email_attachments\n",{"type":42,"tag":218,"props":4877,"children":4878},{"class":220,"line":249},[4879,4884,4888],{"type":42,"tag":218,"props":4880,"children":4881},{"style":225},[4882],{"type":47,"value":4883},"    description",{"type":42,"tag":218,"props":4885,"children":4886},{"style":231},[4887],{"type":47,"value":260},{"type":42,"tag":218,"props":4889,"children":4890},{"style":268},[4891],{"type":47,"value":4892}," Build email.attachments as array of nested objects from parallel source arrays.\n",{"type":42,"tag":218,"props":4894,"children":4895},{"class":220,"line":440},[4896,4901,4905],{"type":42,"tag":218,"props":4897,"children":4898},{"style":225},[4899],{"type":47,"value":4900},"    lang",{"type":42,"tag":218,"props":4902,"children":4903},{"style":231},[4904],{"type":47,"value":260},{"type":42,"tag":218,"props":4906,"children":4907},{"style":268},[4908],{"type":47,"value":4909}," painless\n",{"type":42,"tag":218,"props":4911,"children":4912},{"class":220,"line":456},[4913,4918,4922],{"type":42,"tag":218,"props":4914,"children":4915},{"style":225},[4916],{"type":47,"value":4917},"    if",{"type":42,"tag":218,"props":4919,"children":4920},{"style":231},[4921],{"type":47,"value":260},{"type":42,"tag":218,"props":4923,"children":4924},{"style":268},[4925],{"type":47,"value":4926}," ctx.json?.file_names instanceof List && ctx.json?.file_sizes instanceof List\n",{"type":42,"tag":218,"props":4928,"children":4929},{"class":220,"line":477},[4930,4935,4939,4945],{"type":42,"tag":218,"props":4931,"children":4932},{"style":225},[4933],{"type":47,"value":4934},"    source",{"type":42,"tag":218,"props":4936,"children":4937},{"style":231},[4938],{"type":47,"value":260},{"type":42,"tag":218,"props":4940,"children":4942},{"style":4941},"--shiki-light:#39ADB5;--shiki-light-font-style:italic;--shiki-default:#89DDFF;--shiki-default-font-style:italic;--shiki-dark:#89DDFF;--shiki-dark-font-style:italic",[4943],{"type":47,"value":4944}," |",{"type":42,"tag":218,"props":4946,"children":4947},{"style":4231},[4948],{"type":47,"value":4949},"-\n",{"type":42,"tag":218,"props":4951,"children":4952},{"class":220,"line":493},[4953],{"type":42,"tag":218,"props":4954,"children":4955},{"style":268},[4956],{"type":47,"value":4957},"      def names = ctx.json.file_names;\n",{"type":42,"tag":218,"props":4959,"children":4960},{"class":220,"line":514},[4961],{"type":42,"tag":218,"props":4962,"children":4963},{"style":268},[4964],{"type":47,"value":4965},"      def sizes = ctx.json.file_sizes;\n",{"type":42,"tag":218,"props":4967,"children":4968},{"class":220,"line":530},[4969],{"type":42,"tag":218,"props":4970,"children":4971},{"style":268},[4972],{"type":47,"value":4973},"      int len = Math.min(names.size(), sizes.size());\n",{"type":42,"tag":218,"props":4975,"children":4976},{"class":220,"line":548},[4977],{"type":42,"tag":218,"props":4978,"children":4979},{"style":268},[4980],{"type":47,"value":4981},"      def attachments = new ArrayList(len);\n",{"type":42,"tag":218,"props":4983,"children":4984},{"class":220,"line":23},[4985],{"type":42,"tag":218,"props":4986,"children":4987},{"style":268},[4988],{"type":47,"value":4989},"      for (int i = 0; i \u003C len; i++) {\n",{"type":42,"tag":218,"props":4991,"children":4992},{"class":220,"line":586},[4993],{"type":42,"tag":218,"props":4994,"children":4995},{"style":268},[4996],{"type":47,"value":4997},"        def attachment = new HashMap();\n",{"type":42,"tag":218,"props":4999,"children":5000},{"class":220,"line":602},[5001],{"type":42,"tag":218,"props":5002,"children":5003},{"style":268},[5004],{"type":47,"value":5005},"        def file = new HashMap();\n",{"type":42,"tag":218,"props":5007,"children":5008},{"class":220,"line":618},[5009],{"type":42,"tag":218,"props":5010,"children":5011},{"style":268},[5012],{"type":47,"value":5013},"        file.put('name', names.get(i));\n",{"type":42,"tag":218,"props":5015,"children":5016},{"class":220,"line":635},[5017],{"type":42,"tag":218,"props":5018,"children":5019},{"style":268},[5020],{"type":47,"value":5021},"        file.put('size', sizes.get(i));\n",{"type":42,"tag":218,"props":5023,"children":5024},{"class":220,"line":665},[5025],{"type":42,"tag":218,"props":5026,"children":5027},{"style":268},[5028],{"type":47,"value":5029},"        attachment.put('file', file);\n",{"type":42,"tag":218,"props":5031,"children":5032},{"class":220,"line":1462},[5033],{"type":42,"tag":218,"props":5034,"children":5035},{"style":268},[5036],{"type":47,"value":5037},"        attachments.add(attachment);\n",{"type":42,"tag":218,"props":5039,"children":5040},{"class":220,"line":1483},[5041],{"type":42,"tag":218,"props":5042,"children":5043},{"style":268},[5044],{"type":47,"value":4410},{"type":42,"tag":218,"props":5046,"children":5047},{"class":220,"line":1499},[5048],{"type":42,"tag":218,"props":5049,"children":5050},{"style":268},[5051],{"type":47,"value":5052},"      ctx.email = ctx.email ?: [:];\n",{"type":42,"tag":218,"props":5054,"children":5055},{"class":220,"line":1520},[5056],{"type":42,"tag":218,"props":5057,"children":5058},{"style":268},[5059],{"type":47,"value":5060},"      ctx.email.attachments = attachments;\n",{"type":42,"tag":56,"props":5062,"children":5063},{},[5064,5066,5072,5073,5078,5080,5086,5088,5093],{"type":47,"value":5065},"When source data already delivers each attachment as a separate object (e.g., a JSON array of attachment objects), no zipping is needed — use ",{"type":42,"tag":72,"props":5067,"children":5069},{"className":5068},[],[5070],{"type":47,"value":5071},"rename",{"type":47,"value":2440},{"type":42,"tag":72,"props":5074,"children":5076},{"className":5075},[],[5077],{"type":47,"value":3266},{"type":47,"value":5079}," with ",{"type":42,"tag":72,"props":5081,"children":5083},{"className":5082},[],[5084],{"type":47,"value":5085},"copy_from",{"type":47,"value":5087}," to place the array at ",{"type":42,"tag":72,"props":5089,"children":5091},{"className":5090},[],[5092],{"type":47,"value":3995},{"type":47,"value":5094}," directly.",{"type":42,"tag":49,"props":5096,"children":5098},{"id":5097},"custom-field-types",[5099],{"type":47,"value":5100},"Custom field types",{"type":42,"tag":56,"props":5102,"children":5103},{},[5104,5106,5111],{"type":47,"value":5105},"For non-ECS fields in ",{"type":42,"tag":72,"props":5107,"children":5109},{"className":5108},[],[5110],{"type":47,"value":1155},{"type":47,"value":260},{"type":42,"tag":62,"props":5113,"children":5114},{},[5115,5125,5135,5160,5186,5197,5208,5219,5243,5254,5264],{"type":42,"tag":66,"props":5116,"children":5117},{},[5118,5123],{"type":42,"tag":72,"props":5119,"children":5121},{"className":5120},[],[5122],{"type":47,"value":2523},{"type":47,"value":5124}," for identifiers and exact-match strings",{"type":42,"tag":66,"props":5126,"children":5127},{},[5128,5133],{"type":42,"tag":72,"props":5129,"children":5131},{"className":5130},[],[5132],{"type":47,"value":369},{"type":47,"value":5134}," for fixed values (dataset\u002Fmodule constants)",{"type":42,"tag":66,"props":5136,"children":5137},{},[5138,5144,5145,5151,5152,5158],{"type":42,"tag":72,"props":5139,"children":5141},{"className":5140},[],[5142],{"type":47,"value":5143},"long",{"type":47,"value":103},{"type":42,"tag":72,"props":5146,"children":5148},{"className":5147},[],[5149],{"type":47,"value":5150},"double",{"type":47,"value":103},{"type":42,"tag":72,"props":5153,"children":5155},{"className":5154},[],[5156],{"type":47,"value":5157},"scaled_float",{"type":47,"value":5159}," for metrics and numeric values",{"type":42,"tag":66,"props":5161,"children":5162},{},[5163,5169,5171,5177,5179,5184],{"type":42,"tag":72,"props":5164,"children":5166},{"className":5165},[],[5167],{"type":47,"value":5168},"date",{"type":47,"value":5170}," \u002F ",{"type":42,"tag":72,"props":5172,"children":5174},{"className":5173},[],[5175],{"type":47,"value":5176},"date_nanos",{"type":47,"value":5178}," for timestamps (",{"type":42,"tag":72,"props":5180,"children":5182},{"className":5181},[],[5183],{"type":47,"value":5176},{"type":47,"value":5185}," only when sub-millisecond precision is truly needed)",{"type":42,"tag":66,"props":5187,"children":5188},{},[5189,5195],{"type":42,"tag":72,"props":5190,"children":5192},{"className":5191},[],[5193],{"type":47,"value":5194},"ip",{"type":47,"value":5196}," for IP addresses",{"type":42,"tag":66,"props":5198,"children":5199},{},[5200,5206],{"type":42,"tag":72,"props":5201,"children":5203},{"className":5202},[],[5204],{"type":47,"value":5205},"boolean",{"type":47,"value":5207}," for true\u002Ffalse (avoid string booleans in pipelines)",{"type":42,"tag":66,"props":5209,"children":5210},{},[5211,5217],{"type":42,"tag":72,"props":5212,"children":5214},{"className":5213},[],[5215],{"type":47,"value":5216},"geo_point",{"type":47,"value":5218}," for lat\u002Flon coordinates",{"type":42,"tag":66,"props":5220,"children":5221},{},[5222,5227,5228,5233,5235,5241],{"type":42,"tag":72,"props":5223,"children":5225},{"className":5224},[],[5226],{"type":47,"value":1685},{"type":47,"value":1905},{"type":42,"tag":72,"props":5229,"children":5231},{"className":5230},[],[5232],{"type":47,"value":1911},{"type":47,"value":5234}," for logical structure — no need to separately declare intermediate ",{"type":42,"tag":72,"props":5236,"children":5238},{"className":5237},[],[5239],{"type":47,"value":5240},"object",{"type":47,"value":5242}," nodes",{"type":42,"tag":66,"props":5244,"children":5245},{},[5246,5252],{"type":42,"tag":72,"props":5247,"children":5249},{"className":5248},[],[5250],{"type":47,"value":5251},"flattened",{"type":47,"value":5253}," for arbitrary key\u002Fvalue blobs with unknown keys",{"type":42,"tag":66,"props":5255,"children":5256},{},[5257,5262],{"type":42,"tag":72,"props":5258,"children":5260},{"className":5259},[],[5261],{"type":47,"value":3960},{"type":47,"value":5263}," for arrays of objects requiring per-object query isolation (heavier than group)",{"type":42,"tag":66,"props":5265,"children":5266},{},[5267,5272,5273,5279,5281,5286,5288,5293],{"type":42,"tag":72,"props":5268,"children":5270},{"className":5269},[],[5271],{"type":47,"value":47},{"type":47,"value":5170},{"type":42,"tag":72,"props":5274,"children":5276},{"className":5275},[],[5277],{"type":47,"value":5278},"match_only_text",{"type":47,"value":5280}," for full-text content; add a ",{"type":42,"tag":72,"props":5282,"children":5284},{"className":5283},[],[5285],{"type":47,"value":2523},{"type":47,"value":5287}," sub-field via ",{"type":42,"tag":72,"props":5289,"children":5291},{"className":5290},[],[5292],{"type":47,"value":159},{"type":47,"value":5294}," when aggregation is also needed",{"type":42,"tag":56,"props":5296,"children":5297},{},[5298,5300,5305,5307,5313,5314,5320,5322,5328,5330,5336,5337,5343,5344,5350,5351,5356],{"type":47,"value":5299},"Useful properties on numeric fields: ",{"type":42,"tag":72,"props":5301,"children":5303},{"className":5302},[],[5304],{"type":47,"value":145},{"type":47,"value":5306}," (",{"type":42,"tag":72,"props":5308,"children":5310},{"className":5309},[],[5311],{"type":47,"value":5312},"gauge",{"type":47,"value":2440},{"type":42,"tag":72,"props":5315,"children":5317},{"className":5316},[],[5318],{"type":47,"value":5319},"counter",{"type":47,"value":5321},"), ",{"type":42,"tag":72,"props":5323,"children":5325},{"className":5324},[],[5326],{"type":47,"value":5327},"unit",{"type":47,"value":5329}," (e.g., ",{"type":42,"tag":72,"props":5331,"children":5333},{"className":5332},[],[5334],{"type":47,"value":5335},"byte",{"type":47,"value":103},{"type":42,"tag":72,"props":5338,"children":5340},{"className":5339},[],[5341],{"type":47,"value":5342},"percent",{"type":47,"value":103},{"type":42,"tag":72,"props":5345,"children":5347},{"className":5346},[],[5348],{"type":47,"value":5349},"ms",{"type":47,"value":5321},{"type":42,"tag":72,"props":5352,"children":5354},{"className":5353},[],[5355],{"type":47,"value":152},{"type":47,"value":5357}," for low-cardinality TSDB fields.",{"type":42,"tag":56,"props":5359,"children":5360},{},[5361,5362,5368],{"type":47,"value":2397},{"type":42,"tag":72,"props":5363,"children":5365},{"className":5364},[],[5366],{"type":47,"value":5367},"references\u002Fmapping-type-matrix.md",{"type":47,"value":5369}," for the full type reference.",{"type":42,"tag":49,"props":5371,"children":5373},{"id":5372},"field-naming-conventions",[5374],{"type":47,"value":5375},"Field naming conventions",{"type":42,"tag":729,"props":5377,"children":5378},{},[5379,5400],{"type":42,"tag":733,"props":5380,"children":5381},{},[5382],{"type":42,"tag":737,"props":5383,"children":5384},{},[5385,5390,5395],{"type":42,"tag":741,"props":5386,"children":5387},{},[5388],{"type":47,"value":5389},"Rule",{"type":42,"tag":741,"props":5391,"children":5392},{},[5393],{"type":47,"value":5394},"DO",{"type":42,"tag":741,"props":5396,"children":5397},{},[5398],{"type":47,"value":5399},"DON'T",{"type":42,"tag":757,"props":5401,"children":5402},{},[5403,5443,5469,5497],{"type":42,"tag":737,"props":5404,"children":5405},{},[5406,5411,5427],{"type":42,"tag":764,"props":5407,"children":5408},{},[5409],{"type":47,"value":5410},"Use snake_case",{"type":42,"tag":764,"props":5412,"children":5413},{},[5414,5420,5421],{"type":42,"tag":72,"props":5415,"children":5417},{"className":5416},[],[5418],{"type":47,"value":5419},"user_name",{"type":47,"value":103},{"type":42,"tag":72,"props":5422,"children":5424},{"className":5423},[],[5425],{"type":47,"value":5426},"request_count",{"type":42,"tag":764,"props":5428,"children":5429},{},[5430,5436,5437],{"type":42,"tag":72,"props":5431,"children":5433},{"className":5432},[],[5434],{"type":47,"value":5435},"userName",{"type":47,"value":103},{"type":42,"tag":72,"props":5438,"children":5440},{"className":5439},[],[5441],{"type":47,"value":5442},"RequestCount",{"type":42,"tag":737,"props":5444,"children":5445},{},[5446,5451,5460],{"type":42,"tag":764,"props":5447,"children":5448},{},[5449],{"type":47,"value":5450},"Use lowercase",{"type":42,"tag":764,"props":5452,"children":5453},{},[5454],{"type":42,"tag":72,"props":5455,"children":5457},{"className":5456},[],[5458],{"type":47,"value":5459},"source_ip",{"type":42,"tag":764,"props":5461,"children":5462},{},[5463],{"type":42,"tag":72,"props":5464,"children":5466},{"className":5465},[],[5467],{"type":47,"value":5468},"Source_IP",{"type":42,"tag":737,"props":5470,"children":5471},{},[5472,5477,5486],{"type":42,"tag":764,"props":5473,"children":5474},{},[5475],{"type":47,"value":5476},"No asterisks in names",{"type":42,"tag":764,"props":5478,"children":5479},{},[5480],{"type":42,"tag":72,"props":5481,"children":5483},{"className":5482},[],[5484],{"type":47,"value":5485},"network.bytes",{"type":42,"tag":764,"props":5487,"children":5488},{},[5489,5495],{"type":42,"tag":72,"props":5490,"children":5492},{"className":5491},[],[5493],{"type":47,"value":5494},"network.*",{"type":47,"value":5496}," (literal asterisk)",{"type":42,"tag":737,"props":5498,"children":5499},{},[5500,5505,5516],{"type":42,"tag":764,"props":5501,"children":5502},{},[5503],{"type":47,"value":5504},"Use groups for hierarchy",{"type":42,"tag":764,"props":5506,"children":5507},{},[5508,5514],{"type":42,"tag":72,"props":5509,"children":5511},{"className":5510},[],[5512],{"type":47,"value":5513},"vendor.module.field",{"type":47,"value":5515}," as nested group",{"type":42,"tag":764,"props":5517,"children":5518},{},[5519,5524],{"type":42,"tag":72,"props":5520,"children":5522},{"className":5521},[],[5523],{"type":47,"value":5513},{"type":47,"value":5525}," as flat dotted name",{"type":42,"tag":56,"props":5527,"children":5528},{},[5529,5531,5537,5539,5544,5546,5551],{"type":47,"value":5530},"Field names must never contain literal ",{"type":42,"tag":72,"props":5532,"children":5534},{"className":5533},[],[5535],{"type":47,"value":5536},"*",{"type":47,"value":5538}," characters. An asterisk in a field name is almost always a copy-paste error from documentation or wildcard patterns. Use a ",{"type":42,"tag":72,"props":5540,"children":5542},{"className":5541},[],[5543],{"type":47,"value":1685},{"type":47,"value":5545}," with known subfields or ",{"type":42,"tag":72,"props":5547,"children":5549},{"className":5548},[],[5550],{"type":47,"value":5251},{"type":47,"value":5552}," for dynamic keys instead.",{"type":42,"tag":49,"props":5554,"children":5556},{"id":5555},"dotted-field-names-vs-nested-groups",[5557],{"type":47,"value":5558},"Dotted field names vs nested groups",{"type":42,"tag":56,"props":5560,"children":5561},{},[5562],{"type":47,"value":5563},"Both styles are valid in field files:",{"type":42,"tag":207,"props":5565,"children":5567},{"className":209,"code":5566,"language":211,"meta":212,"style":212},"# Dotted (flat) — common for ECS fields in ecs.yml\n- name: source.ip\n  external: ecs\n\n# Nested group — common for custom fields\n- name: acme.firewall\n  type: group\n  fields:\n    - name: rule_id\n      type: keyword\n",[5568],{"type":42,"tag":72,"props":5569,"children":5570},{"__ignoreMap":212},[5571,5580,5599,5614,5623,5631,5650,5665,5676,5695],{"type":42,"tag":218,"props":5572,"children":5573},{"class":220,"line":221},[5574],{"type":42,"tag":218,"props":5575,"children":5577},{"style":5576},"--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic",[5578],{"type":47,"value":5579},"# Dotted (flat) — common for ECS fields in ecs.yml\n",{"type":42,"tag":218,"props":5581,"children":5582},{"class":220,"line":27},[5583,5587,5591,5595],{"type":42,"tag":218,"props":5584,"children":5585},{"style":231},[5586],{"type":47,"value":386},{"type":42,"tag":218,"props":5588,"children":5589},{"style":225},[5590],{"type":47,"value":391},{"type":42,"tag":218,"props":5592,"children":5593},{"style":231},[5594],{"type":47,"value":260},{"type":42,"tag":218,"props":5596,"children":5597},{"style":268},[5598],{"type":47,"value":1374},{"type":42,"tag":218,"props":5600,"children":5601},{"class":220,"line":249},[5602,5606,5610],{"type":42,"tag":218,"props":5603,"children":5604},{"style":225},[5605],{"type":47,"value":408},{"type":42,"tag":218,"props":5607,"children":5608},{"style":231},[5609],{"type":47,"value":260},{"type":42,"tag":218,"props":5611,"children":5612},{"style":268},[5613],{"type":47,"value":417},{"type":42,"tag":218,"props":5615,"children":5616},{"class":220,"line":440},[5617],{"type":42,"tag":218,"props":5618,"children":5620},{"emptyLinePlaceholder":5619},true,[5621],{"type":47,"value":5622},"\n",{"type":42,"tag":218,"props":5624,"children":5625},{"class":220,"line":456},[5626],{"type":42,"tag":218,"props":5627,"children":5628},{"style":5576},[5629],{"type":47,"value":5630},"# Nested group — common for custom fields\n",{"type":42,"tag":218,"props":5632,"children":5633},{"class":220,"line":477},[5634,5638,5642,5646],{"type":42,"tag":218,"props":5635,"children":5636},{"style":231},[5637],{"type":47,"value":386},{"type":42,"tag":218,"props":5639,"children":5640},{"style":225},[5641],{"type":47,"value":391},{"type":42,"tag":218,"props":5643,"children":5644},{"style":231},[5645],{"type":47,"value":260},{"type":42,"tag":218,"props":5647,"children":5648},{"style":268},[5649],{"type":47,"value":1714},{"type":42,"tag":218,"props":5651,"children":5652},{"class":220,"line":493},[5653,5657,5661],{"type":42,"tag":218,"props":5654,"children":5655},{"style":225},[5656],{"type":47,"value":536},{"type":42,"tag":218,"props":5658,"children":5659},{"style":231},[5660],{"type":47,"value":260},{"type":42,"tag":218,"props":5662,"children":5663},{"style":268},[5664],{"type":47,"value":1730},{"type":42,"tag":218,"props":5666,"children":5667},{"class":220,"line":514},[5668,5672],{"type":42,"tag":218,"props":5669,"children":5670},{"style":225},[5671],{"type":47,"value":1738},{"type":42,"tag":218,"props":5673,"children":5674},{"style":231},[5675],{"type":47,"value":234},{"type":42,"tag":218,"props":5677,"children":5678},{"class":220,"line":530},[5679,5683,5687,5691],{"type":42,"tag":218,"props":5680,"children":5681},{"style":231},[5682],{"type":47,"value":1750},{"type":42,"tag":218,"props":5684,"children":5685},{"style":225},[5686],{"type":47,"value":391},{"type":42,"tag":218,"props":5688,"children":5689},{"style":231},[5690],{"type":47,"value":260},{"type":42,"tag":218,"props":5692,"children":5693},{"style":268},[5694],{"type":47,"value":1763},{"type":42,"tag":218,"props":5696,"children":5697},{"class":220,"line":548},[5698,5702,5706],{"type":42,"tag":218,"props":5699,"children":5700},{"style":225},[5701],{"type":47,"value":1771},{"type":42,"tag":218,"props":5703,"children":5704},{"style":231},[5705],{"type":47,"value":260},{"type":42,"tag":218,"props":5707,"children":5708},{"style":268},[5709],{"type":47,"value":1780},{"type":42,"tag":56,"props":5711,"children":5712},{},[5713,5715,5721,5723,5729,5731,5737],{"type":47,"value":5714},"Pipeline expected output (",{"type":42,"tag":72,"props":5716,"children":5718},{"className":5717},[],[5719],{"type":47,"value":5720},"*-expected.json",{"type":47,"value":5722},") always uses nested object form regardless of how the source data represented the field. A source ",{"type":42,"tag":72,"props":5724,"children":5726},{"className":5725},[],[5727],{"type":47,"value":5728},"\"host.name\": \"myhost\"",{"type":47,"value":5730}," produces ",{"type":42,"tag":72,"props":5732,"children":5734},{"className":5733},[],[5735],{"type":47,"value":5736},"{\"host\": {\"name\": \"myhost\"}}",{"type":47,"value":5738}," in the output.",{"type":42,"tag":56,"props":5740,"children":5741},{},[5742,5744,5750],{"type":47,"value":5743},"When source data contains literal dotted keys that Elasticsearch would otherwise expand, use ",{"type":42,"tag":72,"props":5745,"children":5747},{"className":5746},[],[5748],{"type":47,"value":5749},"dot_expander",{"type":47,"value":260},{"type":42,"tag":207,"props":5752,"children":5754},{"className":209,"code":5753,"language":211,"meta":212,"style":212},"- dot_expander:\n    field: \"*\"\n    override: true\n",[5755],{"type":42,"tag":72,"props":5756,"children":5757},{"__ignoreMap":212},[5758,5774,5797],{"type":42,"tag":218,"props":5759,"children":5760},{"class":220,"line":221},[5761,5765,5770],{"type":42,"tag":218,"props":5762,"children":5763},{"style":231},[5764],{"type":47,"value":386},{"type":42,"tag":218,"props":5766,"children":5767},{"style":225},[5768],{"type":47,"value":5769}," dot_expander",{"type":42,"tag":218,"props":5771,"children":5772},{"style":231},[5773],{"type":47,"value":234},{"type":42,"tag":218,"props":5775,"children":5776},{"class":220,"line":27},[5777,5781,5785,5789,5793],{"type":42,"tag":218,"props":5778,"children":5779},{"style":225},[5780],{"type":47,"value":3472},{"type":42,"tag":218,"props":5782,"children":5783},{"style":231},[5784],{"type":47,"value":260},{"type":42,"tag":218,"props":5786,"children":5787},{"style":231},[5788],{"type":47,"value":265},{"type":42,"tag":218,"props":5790,"children":5791},{"style":268},[5792],{"type":47,"value":5536},{"type":42,"tag":218,"props":5794,"children":5795},{"style":231},[5796],{"type":47,"value":276},{"type":42,"tag":218,"props":5798,"children":5799},{"class":220,"line":249},[5800,5805,5809],{"type":42,"tag":218,"props":5801,"children":5802},{"style":225},[5803],{"type":47,"value":5804},"    override",{"type":42,"tag":218,"props":5806,"children":5807},{"style":231},[5808],{"type":47,"value":260},{"type":42,"tag":218,"props":5810,"children":5811},{"style":3512},[5812],{"type":47,"value":3515},{"type":42,"tag":49,"props":5814,"children":5816},{"id":5815},"geo_point-field-handling",[5817],{"type":47,"value":5818},"geo_point field handling",{"type":42,"tag":56,"props":5820,"children":5821},{},[5822,5824,5829,5831,5837,5838,5844],{"type":47,"value":5823},"In pipeline test expected outputs, ",{"type":42,"tag":72,"props":5825,"children":5827},{"className":5826},[],[5828],{"type":47,"value":5216},{"type":47,"value":5830}," fields appear as objects with ",{"type":42,"tag":72,"props":5832,"children":5834},{"className":5833},[],[5835],{"type":47,"value":5836},"lat",{"type":47,"value":355},{"type":42,"tag":72,"props":5839,"children":5841},{"className":5840},[],[5842],{"type":47,"value":5843},"lon",{"type":47,"value":5845}," keys:",{"type":42,"tag":207,"props":5847,"children":5849},{"className":4206,"code":5848,"language":4208,"meta":212,"style":212},"\"source\": {\n  \"geo\": {\n    \"location\": { \"lat\": 51.5142, \"lon\": -0.0931 },\n    \"city_name\": \"London\",\n    \"country_iso_code\": \"GB\"\n  }\n}\n",[5850],{"type":42,"tag":72,"props":5851,"children":5852},{"__ignoreMap":212},[5853,5878,5901,5975,6013,6046,6053],{"type":42,"tag":218,"props":5854,"children":5855},{"class":220,"line":221},[5856,5860,5865,5869,5874],{"type":42,"tag":218,"props":5857,"children":5858},{"style":231},[5859],{"type":47,"value":4238},{"type":42,"tag":218,"props":5861,"children":5862},{"style":268},[5863],{"type":47,"value":5864},"source",{"type":42,"tag":218,"props":5866,"children":5867},{"style":231},[5868],{"type":47,"value":4238},{"type":42,"tag":218,"props":5870,"children":5872},{"style":5871},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[5873],{"type":47,"value":2627},{"type":42,"tag":218,"props":5875,"children":5876},{"style":231},[5877],{"type":47,"value":4220},{"type":42,"tag":218,"props":5879,"children":5880},{"class":220,"line":27},[5881,5885,5889,5893,5897],{"type":42,"tag":218,"props":5882,"children":5883},{"style":231},[5884],{"type":47,"value":4228},{"type":42,"tag":218,"props":5886,"children":5887},{"style":4231},[5888],{"type":47,"value":3362},{"type":42,"tag":218,"props":5890,"children":5891},{"style":231},[5892],{"type":47,"value":4238},{"type":42,"tag":218,"props":5894,"children":5895},{"style":231},[5896],{"type":47,"value":260},{"type":42,"tag":218,"props":5898,"children":5899},{"style":231},[5900],{"type":47,"value":4247},{"type":42,"tag":218,"props":5902,"children":5903},{"class":220,"line":249},[5904,5908,5913,5917,5921,5925,5929,5933,5937,5941,5946,5950,5954,5958,5962,5966,5971],{"type":42,"tag":218,"props":5905,"children":5906},{"style":231},[5907],{"type":47,"value":4255},{"type":42,"tag":218,"props":5909,"children":5910},{"style":4258},[5911],{"type":47,"value":5912},"location",{"type":42,"tag":218,"props":5914,"children":5915},{"style":231},[5916],{"type":47,"value":4238},{"type":42,"tag":218,"props":5918,"children":5919},{"style":231},[5920],{"type":47,"value":260},{"type":42,"tag":218,"props":5922,"children":5923},{"style":231},[5924],{"type":47,"value":4537},{"type":42,"tag":218,"props":5926,"children":5927},{"style":231},[5928],{"type":47,"value":265},{"type":42,"tag":218,"props":5930,"children":5931},{"style":4284},[5932],{"type":47,"value":5836},{"type":42,"tag":218,"props":5934,"children":5935},{"style":231},[5936],{"type":47,"value":4238},{"type":42,"tag":218,"props":5938,"children":5939},{"style":231},[5940],{"type":47,"value":260},{"type":42,"tag":218,"props":5942,"children":5943},{"style":4284},[5944],{"type":47,"value":5945}," 51.5142",{"type":42,"tag":218,"props":5947,"children":5948},{"style":231},[5949],{"type":47,"value":4341},{"type":42,"tag":218,"props":5951,"children":5952},{"style":231},[5953],{"type":47,"value":265},{"type":42,"tag":218,"props":5955,"children":5956},{"style":4284},[5957],{"type":47,"value":5843},{"type":42,"tag":218,"props":5959,"children":5960},{"style":231},[5961],{"type":47,"value":4238},{"type":42,"tag":218,"props":5963,"children":5964},{"style":231},[5965],{"type":47,"value":260},{"type":42,"tag":218,"props":5967,"children":5968},{"style":4284},[5969],{"type":47,"value":5970}," -0.0931",{"type":42,"tag":218,"props":5972,"children":5973},{"style":231},[5974],{"type":47,"value":4600},{"type":42,"tag":218,"props":5976,"children":5977},{"class":220,"line":440},[5978,5982,5987,5991,5995,5999,6004,6008],{"type":42,"tag":218,"props":5979,"children":5980},{"style":231},[5981],{"type":47,"value":4255},{"type":42,"tag":218,"props":5983,"children":5984},{"style":4258},[5985],{"type":47,"value":5986},"city_name",{"type":42,"tag":218,"props":5988,"children":5989},{"style":231},[5990],{"type":47,"value":4238},{"type":42,"tag":218,"props":5992,"children":5993},{"style":231},[5994],{"type":47,"value":260},{"type":42,"tag":218,"props":5996,"children":5997},{"style":231},[5998],{"type":47,"value":265},{"type":42,"tag":218,"props":6000,"children":6001},{"style":268},[6002],{"type":47,"value":6003},"London",{"type":42,"tag":218,"props":6005,"children":6006},{"style":231},[6007],{"type":47,"value":4238},{"type":42,"tag":218,"props":6009,"children":6010},{"style":231},[6011],{"type":47,"value":6012},",\n",{"type":42,"tag":218,"props":6014,"children":6015},{"class":220,"line":456},[6016,6020,6025,6029,6033,6037,6042],{"type":42,"tag":218,"props":6017,"children":6018},{"style":231},[6019],{"type":47,"value":4255},{"type":42,"tag":218,"props":6021,"children":6022},{"style":4258},[6023],{"type":47,"value":6024},"country_iso_code",{"type":42,"tag":218,"props":6026,"children":6027},{"style":231},[6028],{"type":47,"value":4238},{"type":42,"tag":218,"props":6030,"children":6031},{"style":231},[6032],{"type":47,"value":260},{"type":42,"tag":218,"props":6034,"children":6035},{"style":231},[6036],{"type":47,"value":265},{"type":42,"tag":218,"props":6038,"children":6039},{"style":268},[6040],{"type":47,"value":6041},"GB",{"type":42,"tag":218,"props":6043,"children":6044},{"style":231},[6045],{"type":47,"value":276},{"type":42,"tag":218,"props":6047,"children":6048},{"class":220,"line":477},[6049],{"type":42,"tag":218,"props":6050,"children":6051},{"style":231},[6052],{"type":47,"value":4426},{"type":42,"tag":218,"props":6054,"children":6055},{"class":220,"line":493},[6056],{"type":42,"tag":218,"props":6057,"children":6058},{"style":231},[6059],{"type":47,"value":4434},{"type":42,"tag":56,"props":6061,"children":6062},{},[6063,6065,6070,6072,6077,6079,6085,6087,6092,6094,6099,6101,6107],{"type":47,"value":6064},"These sub-fields do not need entries in ",{"type":42,"tag":72,"props":6066,"children":6068},{"className":6067},[],[6069],{"type":47,"value":1155},{"type":47,"value":6071}," — they are part of the ",{"type":42,"tag":72,"props":6073,"children":6075},{"className":6074},[],[6076],{"type":47,"value":5216},{"type":47,"value":6078}," type mapping. Only the ",{"type":42,"tag":72,"props":6080,"children":6082},{"className":6081},[],[6083],{"type":47,"value":6084},"*.geo.location",{"type":47,"value":6086}," field (type ",{"type":42,"tag":72,"props":6088,"children":6090},{"className":6089},[],[6091],{"type":47,"value":5216},{"type":47,"value":6093},") needs to be in ",{"type":42,"tag":72,"props":6095,"children":6097},{"className":6096},[],[6098],{"type":47,"value":88},{"type":47,"value":6100}," for non-standard parent prefixes where ",{"type":42,"tag":72,"props":6102,"children":6104},{"className":6103},[],[6105],{"type":47,"value":6106},"ecs@mappings",{"type":47,"value":6108}," does not apply.",{"type":42,"tag":49,"props":6110,"children":6112},{"id":6111},"common-pipeline-categorization-patterns",[6113],{"type":47,"value":6114},"Common pipeline categorization patterns",{"type":42,"tag":318,"props":6116,"children":6118},{"id":6117},"web-access",[6119],{"type":47,"value":6120},"Web access",{"type":42,"tag":207,"props":6122,"children":6124},{"className":209,"code":6123,"language":211,"meta":212,"style":212},"- set:\n    field: event.kind\n    value: event\n- append:\n    field: event.category\n    value: web\n- append:\n    field: event.type\n    value: access\n",[6125],{"type":42,"tag":72,"props":6126,"children":6127},{"__ignoreMap":212},[6128,6144,6159,6176,6192,6207,6223,6238,6253],{"type":42,"tag":218,"props":6129,"children":6130},{"class":220,"line":221},[6131,6135,6140],{"type":42,"tag":218,"props":6132,"children":6133},{"style":231},[6134],{"type":47,"value":386},{"type":42,"tag":218,"props":6136,"children":6137},{"style":225},[6138],{"type":47,"value":6139}," set",{"type":42,"tag":218,"props":6141,"children":6142},{"style":231},[6143],{"type":47,"value":234},{"type":42,"tag":218,"props":6145,"children":6146},{"class":220,"line":27},[6147,6151,6155],{"type":42,"tag":218,"props":6148,"children":6149},{"style":225},[6150],{"type":47,"value":3472},{"type":42,"tag":218,"props":6152,"children":6153},{"style":231},[6154],{"type":47,"value":260},{"type":42,"tag":218,"props":6156,"children":6157},{"style":268},[6158],{"type":47,"value":1199},{"type":42,"tag":218,"props":6160,"children":6161},{"class":220,"line":249},[6162,6167,6171],{"type":42,"tag":218,"props":6163,"children":6164},{"style":225},[6165],{"type":47,"value":6166},"    value",{"type":42,"tag":218,"props":6168,"children":6169},{"style":231},[6170],{"type":47,"value":260},{"type":42,"tag":218,"props":6172,"children":6173},{"style":268},[6174],{"type":47,"value":6175}," event\n",{"type":42,"tag":218,"props":6177,"children":6178},{"class":220,"line":440},[6179,6183,6188],{"type":42,"tag":218,"props":6180,"children":6181},{"style":231},[6182],{"type":47,"value":386},{"type":42,"tag":218,"props":6184,"children":6185},{"style":225},[6186],{"type":47,"value":6187}," append",{"type":42,"tag":218,"props":6189,"children":6190},{"style":231},[6191],{"type":47,"value":234},{"type":42,"tag":218,"props":6193,"children":6194},{"class":220,"line":456},[6195,6199,6203],{"type":42,"tag":218,"props":6196,"children":6197},{"style":225},[6198],{"type":47,"value":3472},{"type":42,"tag":218,"props":6200,"children":6201},{"style":231},[6202],{"type":47,"value":260},{"type":42,"tag":218,"props":6204,"children":6205},{"style":268},[6206],{"type":47,"value":1234},{"type":42,"tag":218,"props":6208,"children":6209},{"class":220,"line":477},[6210,6214,6218],{"type":42,"tag":218,"props":6211,"children":6212},{"style":225},[6213],{"type":47,"value":6166},{"type":42,"tag":218,"props":6215,"children":6216},{"style":231},[6217],{"type":47,"value":260},{"type":42,"tag":218,"props":6219,"children":6220},{"style":268},[6221],{"type":47,"value":6222}," web\n",{"type":42,"tag":218,"props":6224,"children":6225},{"class":220,"line":493},[6226,6230,6234],{"type":42,"tag":218,"props":6227,"children":6228},{"style":231},[6229],{"type":47,"value":386},{"type":42,"tag":218,"props":6231,"children":6232},{"style":225},[6233],{"type":47,"value":6187},{"type":42,"tag":218,"props":6235,"children":6236},{"style":231},[6237],{"type":47,"value":234},{"type":42,"tag":218,"props":6239,"children":6240},{"class":220,"line":514},[6241,6245,6249],{"type":42,"tag":218,"props":6242,"children":6243},{"style":225},[6244],{"type":47,"value":3472},{"type":42,"tag":218,"props":6246,"children":6247},{"style":231},[6248],{"type":47,"value":260},{"type":42,"tag":218,"props":6250,"children":6251},{"style":268},[6252],{"type":47,"value":1269},{"type":42,"tag":218,"props":6254,"children":6255},{"class":220,"line":530},[6256,6260,6264],{"type":42,"tag":218,"props":6257,"children":6258},{"style":225},[6259],{"type":47,"value":6166},{"type":42,"tag":218,"props":6261,"children":6262},{"style":231},[6263],{"type":47,"value":260},{"type":42,"tag":218,"props":6265,"children":6266},{"style":268},[6267],{"type":47,"value":6268}," access\n",{"type":42,"tag":318,"props":6270,"children":6272},{"id":6271},"outcome-from-http-status",[6273],{"type":47,"value":6274},"Outcome from HTTP status",{"type":42,"tag":207,"props":6276,"children":6278},{"className":209,"code":6277,"language":211,"meta":212,"style":212},"- set:\n    field: event.outcome\n    value: success\n    if: \"ctx?.http?.response?.status_code != null && ctx.http.response.status_code \u003C 400\"\n- set:\n    field: event.outcome\n    value: failure\n    if: \"ctx?.http?.response?.status_code != null && ctx.http.response.status_code >= 400\"\n",[6279],{"type":42,"tag":72,"props":6280,"children":6281},{"__ignoreMap":212},[6282,6297,6312,6328,6352,6367,6382,6398],{"type":42,"tag":218,"props":6283,"children":6284},{"class":220,"line":221},[6285,6289,6293],{"type":42,"tag":218,"props":6286,"children":6287},{"style":231},[6288],{"type":47,"value":386},{"type":42,"tag":218,"props":6290,"children":6291},{"style":225},[6292],{"type":47,"value":6139},{"type":42,"tag":218,"props":6294,"children":6295},{"style":231},[6296],{"type":47,"value":234},{"type":42,"tag":218,"props":6298,"children":6299},{"class":220,"line":27},[6300,6304,6308],{"type":42,"tag":218,"props":6301,"children":6302},{"style":225},[6303],{"type":47,"value":3472},{"type":42,"tag":218,"props":6305,"children":6306},{"style":231},[6307],{"type":47,"value":260},{"type":42,"tag":218,"props":6309,"children":6310},{"style":268},[6311],{"type":47,"value":1304},{"type":42,"tag":218,"props":6313,"children":6314},{"class":220,"line":249},[6315,6319,6323],{"type":42,"tag":218,"props":6316,"children":6317},{"style":225},[6318],{"type":47,"value":6166},{"type":42,"tag":218,"props":6320,"children":6321},{"style":231},[6322],{"type":47,"value":260},{"type":42,"tag":218,"props":6324,"children":6325},{"style":268},[6326],{"type":47,"value":6327}," success\n",{"type":42,"tag":218,"props":6329,"children":6330},{"class":220,"line":440},[6331,6335,6339,6343,6348],{"type":42,"tag":218,"props":6332,"children":6333},{"style":225},[6334],{"type":47,"value":4917},{"type":42,"tag":218,"props":6336,"children":6337},{"style":231},[6338],{"type":47,"value":260},{"type":42,"tag":218,"props":6340,"children":6341},{"style":231},[6342],{"type":47,"value":265},{"type":42,"tag":218,"props":6344,"children":6345},{"style":268},[6346],{"type":47,"value":6347},"ctx?.http?.response?.status_code != null && ctx.http.response.status_code \u003C 400",{"type":42,"tag":218,"props":6349,"children":6350},{"style":231},[6351],{"type":47,"value":276},{"type":42,"tag":218,"props":6353,"children":6354},{"class":220,"line":456},[6355,6359,6363],{"type":42,"tag":218,"props":6356,"children":6357},{"style":231},[6358],{"type":47,"value":386},{"type":42,"tag":218,"props":6360,"children":6361},{"style":225},[6362],{"type":47,"value":6139},{"type":42,"tag":218,"props":6364,"children":6365},{"style":231},[6366],{"type":47,"value":234},{"type":42,"tag":218,"props":6368,"children":6369},{"class":220,"line":477},[6370,6374,6378],{"type":42,"tag":218,"props":6371,"children":6372},{"style":225},[6373],{"type":47,"value":3472},{"type":42,"tag":218,"props":6375,"children":6376},{"style":231},[6377],{"type":47,"value":260},{"type":42,"tag":218,"props":6379,"children":6380},{"style":268},[6381],{"type":47,"value":1304},{"type":42,"tag":218,"props":6383,"children":6384},{"class":220,"line":493},[6385,6389,6393],{"type":42,"tag":218,"props":6386,"children":6387},{"style":225},[6388],{"type":47,"value":6166},{"type":42,"tag":218,"props":6390,"children":6391},{"style":231},[6392],{"type":47,"value":260},{"type":42,"tag":218,"props":6394,"children":6395},{"style":268},[6396],{"type":47,"value":6397}," failure\n",{"type":42,"tag":218,"props":6399,"children":6400},{"class":220,"line":514},[6401,6405,6409,6413,6418],{"type":42,"tag":218,"props":6402,"children":6403},{"style":225},[6404],{"type":47,"value":4917},{"type":42,"tag":218,"props":6406,"children":6407},{"style":231},[6408],{"type":47,"value":260},{"type":42,"tag":218,"props":6410,"children":6411},{"style":231},[6412],{"type":47,"value":265},{"type":42,"tag":218,"props":6414,"children":6415},{"style":268},[6416],{"type":47,"value":6417},"ctx?.http?.response?.status_code != null && ctx.http.response.status_code >= 400",{"type":42,"tag":218,"props":6419,"children":6420},{"style":231},[6421],{"type":47,"value":276},{"type":42,"tag":318,"props":6423,"children":6425},{"id":6424},"pipeline-error-fallback",[6426],{"type":47,"value":6427},"Pipeline error fallback",{"type":42,"tag":207,"props":6429,"children":6431},{"className":209,"code":6430,"language":211,"meta":212,"style":212},"on_failure:\n  - set:\n      field: event.kind\n      value: pipeline_error\n",[6432],{"type":42,"tag":72,"props":6433,"children":6434},{"__ignoreMap":212},[6435,6446,6462,6478],{"type":42,"tag":218,"props":6436,"children":6437},{"class":220,"line":221},[6438,6442],{"type":42,"tag":218,"props":6439,"children":6440},{"style":225},[6441],{"type":47,"value":3014},{"type":42,"tag":218,"props":6443,"children":6444},{"style":231},[6445],{"type":47,"value":234},{"type":42,"tag":218,"props":6447,"children":6448},{"class":220,"line":27},[6449,6454,6458],{"type":42,"tag":218,"props":6450,"children":6451},{"style":231},[6452],{"type":47,"value":6453},"  -",{"type":42,"tag":218,"props":6455,"children":6456},{"style":225},[6457],{"type":47,"value":6139},{"type":42,"tag":218,"props":6459,"children":6460},{"style":231},[6461],{"type":47,"value":234},{"type":42,"tag":218,"props":6463,"children":6464},{"class":220,"line":249},[6465,6470,6474],{"type":42,"tag":218,"props":6466,"children":6467},{"style":225},[6468],{"type":47,"value":6469},"      field",{"type":42,"tag":218,"props":6471,"children":6472},{"style":231},[6473],{"type":47,"value":260},{"type":42,"tag":218,"props":6475,"children":6476},{"style":268},[6477],{"type":47,"value":1199},{"type":42,"tag":218,"props":6479,"children":6480},{"class":220,"line":440},[6481,6486,6490],{"type":42,"tag":218,"props":6482,"children":6483},{"style":225},[6484],{"type":47,"value":6485},"      value",{"type":42,"tag":218,"props":6487,"children":6488},{"style":231},[6489],{"type":47,"value":260},{"type":42,"tag":218,"props":6491,"children":6492},{"style":268},[6493],{"type":47,"value":6494}," pipeline_error\n",{"type":42,"tag":49,"props":6496,"children":6498},{"id":6497},"troubleshooting-field-x-is-undefined-for-ecs-fields",[6499],{"type":47,"value":6500},"Troubleshooting: \"field X is undefined\" for ECS fields",{"type":42,"tag":56,"props":6502,"children":6503},{},[6504,6506,6511],{"type":47,"value":6505},"When tests report ",{"type":42,"tag":72,"props":6507,"children":6509},{"className":6508},[],[6510],{"type":47,"value":295},{"type":47,"value":6512}," for standard ECS fields:",{"type":42,"tag":2970,"props":6514,"children":6515},{},[6516,6528,6546],{"type":42,"tag":66,"props":6517,"children":6518},{},[6519,6521,6526],{"type":47,"value":6520},"Check ",{"type":42,"tag":72,"props":6522,"children":6524},{"className":6523},[],[6525],{"type":47,"value":203},{"type":47,"value":6527}," exists at the package root",{"type":42,"tag":66,"props":6529,"children":6530},{},[6531,6532,6538,6540,6545],{"type":47,"value":6520},{"type":42,"tag":72,"props":6533,"children":6535},{"className":6534},[],[6536],{"type":47,"value":6537},"dependencies.ecs.reference",{"type":47,"value":6539}," is set (use ",{"type":42,"tag":72,"props":6541,"children":6543},{"className":6542},[],[6544],{"type":47,"value":271},{"type":47,"value":827},{"type":42,"tag":66,"props":6547,"children":6548},{},[6549,6551,6556,6557],{"type":47,"value":6550},"Check the field is listed in ",{"type":42,"tag":72,"props":6552,"children":6554},{"className":6553},[],[6555],{"type":47,"value":88},{"type":47,"value":5079},{"type":42,"tag":72,"props":6558,"children":6560},{"className":6559},[],[6561],{"type":47,"value":346},{"type":42,"tag":56,"props":6563,"children":6564},{},[6565],{"type":47,"value":6566},"Fix the root cause. Do not work around it by:",{"type":42,"tag":62,"props":6568,"children":6569},{},[6570,6587],{"type":42,"tag":66,"props":6571,"children":6572},{},[6573,6575,6580,6582],{"type":47,"value":6574},"Adding ECS fields with full type definitions to ",{"type":42,"tag":72,"props":6576,"children":6578},{"className":6577},[],[6579],{"type":47,"value":1155},{"type":47,"value":6581}," without ",{"type":42,"tag":72,"props":6583,"children":6585},{"className":6584},[],[6586],{"type":47,"value":346},{"type":42,"tag":66,"props":6588,"children":6589},{},[6590,6592,6597],{"type":47,"value":6591},"Skipping ",{"type":42,"tag":72,"props":6593,"children":6595},{"className":6594},[],[6596],{"type":47,"value":346},{"type":47,"value":6598}," and defining ECS field types\u002Fdescriptions manually",{"type":42,"tag":56,"props":6600,"children":6601},{},[6602,6607,6609,6614],{"type":42,"tag":283,"props":6603,"children":6604},{},[6605],{"type":47,"value":6606},"Exception:",{"type":47,"value":6608}," Custom (non-ECS) fields reported as undefined must be defined in ",{"type":42,"tag":72,"props":6610,"children":6612},{"className":6611},[],[6613],{"type":47,"value":1155},{"type":47,"value":697},{"type":42,"tag":49,"props":6616,"children":6618},{"id":6617},"common-failure-patterns",[6619],{"type":47,"value":6620},"Common failure patterns",{"type":42,"tag":62,"props":6622,"children":6623},{},[6624,6644,6665,6685,6707,6722,6737,6771],{"type":42,"tag":66,"props":6625,"children":6626},{},[6627,6637,6639],{"type":42,"tag":283,"props":6628,"children":6629},{},[6630,6632],{"type":47,"value":6631},"missing ",{"type":42,"tag":72,"props":6633,"children":6635},{"className":6634},[],[6636],{"type":47,"value":203},{"type":47,"value":6638}," — all ECS fields reported undefined; create with ",{"type":42,"tag":72,"props":6640,"children":6642},{"className":6641},[],[6643],{"type":47,"value":6537},{"type":42,"tag":66,"props":6645,"children":6646},{},[6647,6658,6660],{"type":42,"tag":283,"props":6648,"children":6649},{},[6650,6652],{"type":47,"value":6651},"outdated ECS version in ",{"type":42,"tag":72,"props":6653,"children":6655},{"className":6654},[],[6656],{"type":47,"value":6657},"build.yml",{"type":47,"value":6659}," — fields from newer ECS versions undefined; update reference to ",{"type":42,"tag":72,"props":6661,"children":6663},{"className":6662},[],[6664],{"type":47,"value":271},{"type":42,"tag":66,"props":6666,"children":6667},{},[6668,6678,6680],{"type":42,"tag":283,"props":6669,"children":6670},{},[6671,6673],{"type":47,"value":6672},"ECS field set in pipeline but missing from ",{"type":42,"tag":72,"props":6674,"children":6676},{"className":6675},[],[6677],{"type":47,"value":88},{"type":47,"value":6679}," — field is undefined in test schema validation; add it to ",{"type":42,"tag":72,"props":6681,"children":6683},{"className":6682},[],[6684],{"type":47,"value":88},{"type":42,"tag":66,"props":6686,"children":6687},{},[6688,6698,6700,6705],{"type":42,"tag":283,"props":6689,"children":6690},{},[6691,6693],{"type":47,"value":6692},"ECS field defined without ",{"type":42,"tag":72,"props":6694,"children":6696},{"className":6695},[],[6697],{"type":47,"value":346},{"type":47,"value":6699}," — descriptions and types diverge from ECS; always use ",{"type":42,"tag":72,"props":6701,"children":6703},{"className":6702},[],[6704],{"type":47,"value":346},{"type":47,"value":6706}," for ECS fields, with overrides as needed",{"type":42,"tag":66,"props":6708,"children":6709},{},[6710,6720],{"type":42,"tag":283,"props":6711,"children":6712},{},[6713,6718],{"type":42,"tag":72,"props":6714,"children":6716},{"className":6715},[],[6717],{"type":47,"value":145},{"type":47,"value":6719}," on non-numeric field",{"type":47,"value":6721}," — lint error",{"type":42,"tag":66,"props":6723,"children":6724},{},[6725,6735],{"type":42,"tag":283,"props":6726,"children":6727},{},[6728,6733],{"type":42,"tag":72,"props":6729,"children":6731},{"className":6730},[],[6732],{"type":47,"value":3423},{"type":47,"value":6734}," at document root",{"type":47,"value":6736}," — unmapped; always nest under a parent entity",{"type":42,"tag":66,"props":6738,"children":6739},{},[6740,6756,6758,6764,6766],{"type":42,"tag":283,"props":6741,"children":6742},{},[6743,6748,6749,6754],{"type":42,"tag":72,"props":6744,"children":6746},{"className":6745},[],[6747],{"type":47,"value":109},{"type":47,"value":2440},{"type":42,"tag":72,"props":6750,"children":6752},{"className":6751},[],[6753],{"type":47,"value":116},{"type":47,"value":6755}," set as scalar",{"type":47,"value":6757}," — must use ",{"type":42,"tag":72,"props":6759,"children":6761},{"className":6760},[],[6762],{"type":47,"value":6763},"append",{"type":47,"value":6765}," processor, not ",{"type":42,"tag":72,"props":6767,"children":6769},{"className":6768},[],[6770],{"type":47,"value":3266},{"type":42,"tag":66,"props":6772,"children":6773},{},[6774,6784,6786,6791,6792,6797,6799,6804,6806,6811],{"type":42,"tag":283,"props":6775,"children":6776},{},[6777,6782],{"type":42,"tag":72,"props":6778,"children":6780},{"className":6779},[],[6781],{"type":47,"value":3960},{"type":47,"value":6783}," ECS field mapped as parallel arrays",{"type":47,"value":6785}," — ",{"type":42,"tag":72,"props":6787,"children":6789},{"className":6788},[],[6790],{"type":47,"value":3995},{"type":47,"value":103},{"type":42,"tag":72,"props":6793,"children":6795},{"className":6794},[],[6796],{"type":47,"value":4044},{"type":47,"value":6798},", and similar ",{"type":42,"tag":72,"props":6800,"children":6802},{"className":6801},[],[6803],{"type":47,"value":3960},{"type":47,"value":6805}," fields must be arrays of objects, not objects with parallel scalar arrays; see the ",{"type":42,"tag":6807,"props":6808,"children":6809},"em",{},[6810],{"type":47,"value":3920},{"type":47,"value":6812}," section above",{"type":42,"tag":49,"props":6814,"children":6816},{"id":6815},"validation-loop",[6817],{"type":47,"value":6818},"Validation loop",{"type":42,"tag":207,"props":6820,"children":6824},{"className":6821,"code":6822,"language":6823,"meta":212,"style":212},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","elastic-package lint\nelastic-package check\nelastic-package test pipeline --data-streams \u003Cstream>\n","bash",[6825],{"type":42,"tag":72,"props":6826,"children":6827},{"__ignoreMap":212},[6828,6841,6853],{"type":42,"tag":218,"props":6829,"children":6830},{"class":220,"line":221},[6831,6836],{"type":42,"tag":218,"props":6832,"children":6833},{"style":4258},[6834],{"type":47,"value":6835},"elastic-package",{"type":42,"tag":218,"props":6837,"children":6838},{"style":268},[6839],{"type":47,"value":6840}," lint\n",{"type":42,"tag":218,"props":6842,"children":6843},{"class":220,"line":27},[6844,6848],{"type":42,"tag":218,"props":6845,"children":6846},{"style":4258},[6847],{"type":47,"value":6835},{"type":42,"tag":218,"props":6849,"children":6850},{"style":268},[6851],{"type":47,"value":6852}," check\n",{"type":42,"tag":218,"props":6854,"children":6855},{"class":220,"line":249},[6856,6860,6865,6870,6875,6880,6885,6890],{"type":42,"tag":218,"props":6857,"children":6858},{"style":4258},[6859],{"type":47,"value":6835},{"type":42,"tag":218,"props":6861,"children":6862},{"style":268},[6863],{"type":47,"value":6864}," test",{"type":42,"tag":218,"props":6866,"children":6867},{"style":268},[6868],{"type":47,"value":6869}," pipeline",{"type":42,"tag":218,"props":6871,"children":6872},{"style":268},[6873],{"type":47,"value":6874}," --data-streams",{"type":42,"tag":218,"props":6876,"children":6877},{"style":231},[6878],{"type":47,"value":6879}," \u003C",{"type":42,"tag":218,"props":6881,"children":6882},{"style":268},[6883],{"type":47,"value":6884},"strea",{"type":42,"tag":218,"props":6886,"children":6887},{"style":5871},[6888],{"type":47,"value":6889},"m",{"type":42,"tag":218,"props":6891,"children":6892},{"style":231},[6893],{"type":47,"value":6894},">\n",{"type":42,"tag":49,"props":6896,"children":6898},{"id":6897},"references",[6899],{"type":47,"value":6900},"References",{"type":42,"tag":62,"props":6902,"children":6903},{},[6904,6912,6920,6928,6937],{"type":42,"tag":66,"props":6905,"children":6906},{},[6907],{"type":42,"tag":72,"props":6908,"children":6910},{"className":6909},[],[6911],{"type":47,"value":5367},{"type":42,"tag":66,"props":6913,"children":6914},{},[6915],{"type":42,"tag":72,"props":6916,"children":6918},{"className":6917},[],[6919],{"type":47,"value":3092},{"type":42,"tag":66,"props":6921,"children":6922},{},[6923],{"type":42,"tag":72,"props":6924,"children":6926},{"className":6925},[],[6927],{"type":47,"value":2403},{"type":42,"tag":66,"props":6929,"children":6930},{},[6931],{"type":42,"tag":72,"props":6932,"children":6934},{"className":6933},[],[6935],{"type":47,"value":6936},"references\u002Ffieldset-links.md",{"type":42,"tag":66,"props":6938,"children":6939},{},[6940],{"type":42,"tag":1098,"props":6941,"children":6944},{"href":6942,"rel":6943},"https:\u002F\u002Fwww.elastic.co\u002Fdocs\u002Freference\u002Fecs\u002Fecs-field-reference",[1102],[6945],{"type":47,"value":6946},"ECS field reference",{"type":42,"tag":6948,"props":6949,"children":6950},"style",{},[6951],{"type":47,"value":6952},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":6954,"total":7124},[6955,6974,6991,7006,7025,7037,7047,7062,7073,7087,7098,7111],{"slug":6956,"name":6956,"fn":6957,"description":6958,"org":6959,"tags":6960,"stars":6971,"repoUrl":6972,"updatedAt":6973},"accessing-benchmark-results","retrieve and analyze Rally benchmark results","Retrieve Rally benchmark results from an external Elasticsearch metrics store. Use to list past races, get a single race's overall (per-task) results, chart a metric's trend across multiple runs, compare two races, or check whether a run converged — e.g. \"show me recent geonames races\", \"what's the service_time trend for nyc_taxis over the last 30 days?\", \"compare these two race-ids\". Applies when datastore.type = elasticsearch is set in ~\u002F.rally\u002Frally.ini.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[6961,6964,6967,6968],{"name":6962,"slug":6963,"type":15},"Analytics","analytics",{"name":6965,"slug":6966,"type":15},"Data Analysis","data-analysis",{"name":9,"slug":8,"type":15},{"name":6969,"slug":6970,"type":15},"Performance","performance",2027,"https:\u002F\u002Fgithub.com\u002Felastic\u002Frally","2026-07-12T07:46:38.54144",{"slug":6975,"name":6975,"fn":6976,"description":6977,"org":6978,"tags":6979,"stars":6971,"repoUrl":6972,"updatedAt":6990},"developing-rally","develop and debug Rally source code","Work on Rally's own codebase, not running benchmarks with it. Use when setting up the dev environment, running Rally's tests or linters, navigating its source, debugging Rally's own code, or making changes to Rally itself.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[6980,6983,6984,6987],{"name":6981,"slug":6982,"type":15},"Debugging","debugging",{"name":9,"slug":8,"type":15},{"name":6985,"slug":6986,"type":15},"Engineering","engineering",{"name":6988,"slug":6989,"type":15},"Local Development","local-development","2026-07-12T07:46:35.976807",{"slug":6992,"name":6992,"fn":6993,"description":6994,"org":6995,"tags":6996,"stars":6971,"repoUrl":6972,"updatedAt":7005},"running-benchmarks","run Rally benchmarks against Elasticsearch","Run Rally benchmarks (races) against Elasticsearch — an existing\u002Fexternal cluster or a Rally-provisioned distribution — and read the summary report. Use when running a race (any pipeline, track, challenge, target-hosts, or auth) or when interpreting throughput, latency, and service_time results.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[6997,6998,7001,7002],{"name":9,"slug":8,"type":15},{"name":6999,"slug":7000,"type":15},"Elasticsearch","elasticsearch",{"name":6969,"slug":6970,"type":15},{"name":7003,"slug":7004,"type":15},"Testing","testing","2026-07-12T07:46:37.277964",{"slug":7007,"name":7007,"fn":7008,"description":7009,"org":7010,"tags":7011,"stars":7022,"repoUrl":7023,"updatedAt":7024},"cloud-access-management","manage Elastic Cloud organization access","Manage Elastic Cloud organization access: invite users, assign roles to Serverless projects, and create or revoke Cloud API keys. Use when granting, modifying, or auditing user access.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[7012,7015,7016,7019],{"name":7013,"slug":7014,"type":15},"Cloud","cloud",{"name":9,"slug":8,"type":15},{"name":7017,"slug":7018,"type":15},"Operations","operations",{"name":7020,"slug":7021,"type":15},"Permissions","permissions",531,"https:\u002F\u002Fgithub.com\u002Felastic\u002Fagent-skills","2026-07-12T07:46:44.946285",{"slug":7026,"name":7026,"fn":7027,"description":7028,"org":7029,"tags":7030,"stars":7022,"repoUrl":7023,"updatedAt":7036},"cloud-create-project","create Elastic Cloud Serverless projects","Creates Elastic Cloud Serverless projects (Elasticsearch, Observability, or Security) via the REST API, saves credentials to file, and bootstraps a scoped Elasticsearch API key. Use when creating a new serverless project, provisioning a search or observability environment, or spinning up a new Elastic Cloud project.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[7031,7032,7035],{"name":7013,"slug":7014,"type":15},{"name":7033,"slug":7034,"type":15},"Deployment","deployment",{"name":6999,"slug":7000,"type":15},"2026-07-12T07:46:42.353362",{"slug":7038,"name":7038,"fn":7039,"description":7040,"org":7041,"tags":7042,"stars":7022,"repoUrl":7023,"updatedAt":7046},"cloud-manage-project","manage Elastic Cloud Serverless projects","Manages existing Elastic Cloud Serverless projects: list, get, update, delete, reset credentials, resume, and load saved credentials. Connects to existing projects by resolving endpoints and acquiring scoped Elasticsearch API keys. Use when performing day-2 operations on serverless projects, connecting to an existing project, loading or resetting project credentials, or looking up project details.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[7043,7044,7045],{"name":7013,"slug":7014,"type":15},{"name":6999,"slug":7000,"type":15},{"name":7017,"slug":7018,"type":15},"2026-07-12T07:46:41.097412",{"slug":7048,"name":7048,"fn":7049,"description":7050,"org":7051,"tags":7052,"stars":7022,"repoUrl":7023,"updatedAt":7061},"cloud-network-security","manage Elastic Cloud network security","Manage Serverless network security (traffic filters): create, update, and delete IP filters and AWS PrivateLink VPC filters. Use when restricting network access or configuring private connectivity.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[7053,7054,7055,7058],{"name":7013,"slug":7014,"type":15},{"name":6999,"slug":7000,"type":15},{"name":7056,"slug":7057,"type":15},"Networking","networking",{"name":7059,"slug":7060,"type":15},"Security","security","2026-07-12T07:46:43.675992",{"slug":7063,"name":7063,"fn":7064,"description":7065,"org":7066,"tags":7067,"stars":7022,"repoUrl":7023,"updatedAt":7072},"cloud-setup","configure Elastic Cloud authentication","Configures Elastic Cloud authentication and environment defaults. Use when setting up EC_API_KEY, configuring Cloud API access, or when another cloud skill requires credentials.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[7068,7070,7071],{"name":7069,"slug":2704,"type":15},"Authentication",{"name":7013,"slug":7014,"type":15},{"name":6999,"slug":7000,"type":15},"2026-07-12T07:46:39.783105",{"slug":7074,"name":7074,"fn":7075,"description":7076,"org":7077,"tags":7078,"stars":7022,"repoUrl":7023,"updatedAt":7086},"elasticsearch-audit","configure Elasticsearch security audit logs","Enable, configure, and query Elasticsearch security audit logs. Use when the task involves audit logging setup, event filtering, or investigating security incidents like failed logins.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[7079,7082,7083,7085],{"name":7080,"slug":7081,"type":15},"Audit","audit",{"name":6999,"slug":7000,"type":15},{"name":7084,"slug":817,"type":15},"Logs",{"name":7059,"slug":7060,"type":15},"2026-07-12T07:47:35.092599",{"slug":7088,"name":7088,"fn":7089,"description":7090,"org":7091,"tags":7092,"stars":7022,"repoUrl":7023,"updatedAt":7097},"elasticsearch-authn","configure Elasticsearch authentication realms","Authenticate to Elasticsearch using native, file-based, LDAP\u002FAD, SAML, OIDC, Kerberos, JWT, or certificate realms. Use when connecting with credentials, choosing a realm, or managing API keys. Assumes the target realms are already configured.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[7093,7094,7095,7096],{"name":7069,"slug":2704,"type":15},{"name":9,"slug":8,"type":15},{"name":6999,"slug":7000,"type":15},{"name":7059,"slug":7060,"type":15},"2026-07-12T07:47:41.474547",{"slug":7099,"name":7099,"fn":7100,"description":7101,"org":7102,"tags":7103,"stars":7022,"repoUrl":7023,"updatedAt":7110},"elasticsearch-authz","manage Elasticsearch RBAC and security roles","Manage Elasticsearch RBAC: native users, roles, role mappings, document- and field-level security. Use when creating users or roles, assigning privileges, or mapping external realms like LDAP\u002FSAML.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[7104,7105,7106,7109],{"name":9,"slug":8,"type":15},{"name":6999,"slug":7000,"type":15},{"name":7107,"slug":7108,"type":15},"RBAC","rbac",{"name":7059,"slug":7060,"type":15},"2026-07-12T07:47:36.394177",{"slug":7112,"name":7112,"fn":7113,"description":7114,"org":7115,"tags":7116,"stars":7022,"repoUrl":7023,"updatedAt":7123},"elasticsearch-esql","query Elasticsearch data with ES|QL","Execute ES|QL (Elasticsearch Query Language) queries, use when the user wants to query Elasticsearch data, analyze logs, aggregate metrics, explore data, or create charts and dashboards from ES|QL results.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[7117,7118,7119,7120],{"name":6962,"slug":6963,"type":15},{"name":6965,"slug":6966,"type":15},{"name":6999,"slug":7000,"type":15},{"name":7121,"slug":7122,"type":15},"SQL","sql","2026-07-12T07:47:40.249533",86,{"items":7126,"total":618},[7127,7142,7157,7166,7183,7196,7203],{"slug":7128,"name":7128,"fn":7129,"description":7130,"org":7131,"tags":7132,"stars":23,"repoUrl":24,"updatedAt":7141},"anonymize-logs","anonymize sensitive log data","Anonymize and sanitize customer-provided log files before they are committed as pipeline test fixtures or sample events. Performs a line-by-line review and replaces all sensitive values inline, preserving log structure and format exactly — never reformats, re-indents, or restructures content. Invoke manually with \u002Fanonymize-logs.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[7133,7136,7137,7140],{"name":7134,"slug":7135,"type":15},"Data Cleaning","data-cleaning",{"name":7084,"slug":817,"type":15},{"name":7138,"slug":7139,"type":15},"Privacy","privacy",{"name":7059,"slug":7060,"type":15},"2026-07-18T05:13:04.420121",{"slug":7143,"name":7143,"fn":7144,"description":7145,"org":7146,"tags":7147,"stars":23,"repoUrl":24,"updatedAt":7156},"cel-programs","write CEL programs for data collection","Use for all CEL and mito work on integrations that collect from APIs — writing CEL programs, cel.yml.hbs templates, manifest configuration, mock-first development with the mito CLI, system test mock setup, and answering CEL\u002Fmito questions. Load this skill whenever any data stream uses the cel input type.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[7148,7151,7154,7155],{"name":7149,"slug":7150,"type":15},"API Development","api-development",{"name":7152,"slug":7153,"type":15},"Data Engineering","data-engineering",{"name":9,"slug":8,"type":15},{"name":17,"slug":18,"type":15},"2026-07-12T07:47:10.207064",{"slug":7158,"name":7158,"fn":7159,"description":7160,"org":7161,"tags":7162,"stars":23,"repoUrl":24,"updatedAt":7165},"create-integration","create Elastic integration packages","Use when creating a new Elastic integration package, scaffolding data streams, answering package layout or structure questions, or running the end-to-end integration build workflow. Covers package topology, scaffold commands, post-scaffold edits, and full orchestration of CEL\u002Fpipeline\u002Ftest subagents.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[7163,7164],{"name":6999,"slug":7000,"type":15},{"name":17,"slug":18,"type":15},"2026-07-12T07:46:56.318866",{"slug":7167,"name":7167,"fn":7168,"description":7169,"org":7170,"tags":7171,"stars":23,"repoUrl":24,"updatedAt":7182},"dashboard-guidelines","create and review Kibana dashboard assets","Use when creating or reviewing Kibana assets in packages, including dashboard export structure, naming, and data stream alignment.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[7172,7175,7176,7179],{"name":7173,"slug":7174,"type":15},"Dashboards","dashboards",{"name":6999,"slug":7000,"type":15},{"name":7177,"slug":7178,"type":15},"Kibana","kibana",{"name":7180,"slug":7181,"type":15},"UI Components","ui-components","2026-07-12T07:47:07.702332",{"slug":7184,"name":7184,"fn":7185,"description":7186,"org":7187,"tags":7188,"stars":23,"repoUrl":24,"updatedAt":7195},"dashboard-review","review Elastic dashboard JSON changes","Use when reviewing dashboard JSON changes in a PR or branch. Extracts structured descriptions with kbdash, compares before\u002Fafter, and checks guideline compliance.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[7189,7192,7193,7194],{"name":7190,"slug":7191,"type":15},"Code Review","code-review",{"name":7173,"slug":7174,"type":15},{"name":9,"slug":8,"type":15},{"name":7177,"slug":7178,"type":15},"2026-07-12T07:47:06.493988",{"slug":4,"name":4,"fn":5,"description":6,"org":7197,"tags":7198,"stars":23,"repoUrl":24,"updatedAt":25},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[7199,7200,7201,7202],{"name":21,"slug":22,"type":15},{"name":13,"slug":14,"type":15},{"name":9,"slug":8,"type":15},{"name":17,"slug":18,"type":15},{"slug":7204,"name":7204,"fn":7205,"description":7206,"org":7207,"tags":7208,"stars":23,"repoUrl":24,"updatedAt":7215},"elastic-package-cli","develop and validate Elastic integrations","Use when developing or validating Elastic integrations with elastic-package commands such as build, check, lint, format, test, stack, service, install, profiles, and benchmark.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[7209,7212,7213,7214],{"name":7210,"slug":7211,"type":15},"CLI","cli",{"name":9,"slug":8,"type":15},{"name":17,"slug":18,"type":15},{"name":7003,"slug":7004,"type":15},"2026-07-12T07:46:57.647395"]