[RFC Stage-2] Process IO events (#2031)

* rfc 0035 fields added to schema as beta fields. Also, added two new fields to the process.tty object for tracking terminal window size * generator.py artifacts * changelog file updated * more build artifacts * renamed lines to rows * rebuilt * cleanup * cleanup * field rename consistency Co-authored-by: Karl Godard <[email protected]>
elastic · Aug 30, 2022 · e2107b7 · e2107b7
1 parent ad61000
commit e2107b7
Show file tree

Hide file tree

Showing 17 changed files with 461 additions and 117 deletions.
diff --git a/CHANGELOG.next.md b/CHANGELOG.next.md
@@ -49,6 +49,8 @@ Thanks, you're awesome :-) -->
 #### Added
 
 * Adding `risk.*` fields as experimental. #1994, #2010
+* Adding `process.io.*` as beta fields. #1956, #2031
+* Adding `process.tty.rows` and `process.tty.columns` as beta fields. #2031
 
 #### Improvements
 

diff --git a/docs/fields/field-details.asciidoc b/docs/fields/field-details.asciidoc
@@ -7609,13 +7609,13 @@ type: object
 
 a| beta:[ This field is beta and subject to change. ]
 
-The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0. For more details, please refer to the Linux kernel documentation.
+The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.
 
 type: long
 
 
 
-example: `1`
+example: `4`
 
 | extended
 
@@ -7633,7 +7633,47 @@ type: long
 
 
 
-example: `128`
+example: `1`
+
+| extended
+
+// ===============================================================
+
+|
+[[field-process-tty-columns]]
+<<field-process-tty-columns, process.tty.columns>>
+
+a| beta:[ This field is beta and subject to change. ]
+
+The number of character columns per line. e.g terminal width
+
+Terminal sizes can change, so this value reflects the maximum value for a given IO event. i.e. where event.action = 'text_output'
+
+type: long
+
+
+
+example: `80`
+
+| extended
+
+// ===============================================================
+
+|
+[[field-process-tty-rows]]
+<<field-process-tty-rows, process.tty.rows>>
+
+a| beta:[ This field is beta and subject to change. ]
+
+The number of character rows in the terminal. e.g terminal height
+
+Terminal sizes can change, so this value reflects the maximum value for a given IO event. i.e. where event.action = 'text_output'
+
+type: long
+
+
+
+example: `24`
 
 | extended
 

diff --git a/experimental/generated/beats/fields.ecs.yml b/experimental/generated/beats/fields.ecs.yml
@@ -5507,9 +5507,9 @@
       type: long
       description: The major number identifies the driver associated with the device.
         The character device's major and minor numbers can be algorithmically combined
-        to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0.
+        to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0".
         For more details, please refer to the Linux kernel documentation.
-      example: 1
+      example: 4
       default_field: false
     - name: entry_leader.tty.char_device.minor
       level: extended
@@ -5518,7 +5518,7 @@
         \ number; other parts of the kernel don\u2019t use it, and merely pass it\
         \ along to the driver. It is common for a driver to control several devices;\
         \ the minor number provides a way for the driver to differentiate among them."
-      example: 128
+      example: 1
       default_field: false
     - name: entry_leader.user.id
       level: core
@@ -5791,9 +5791,9 @@
       type: long
       description: The major number identifies the driver associated with the device.
         The character device's major and minor numbers can be algorithmically combined
-        to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0.
+        to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0".
         For more details, please refer to the Linux kernel documentation.
-      example: 1
+      example: 4
       default_field: false
     - name: group_leader.tty.char_device.minor
       level: extended
@@ -5802,7 +5802,7 @@
         \ number; other parts of the kernel don\u2019t use it, and merely pass it\
         \ along to the driver. It is common for a driver to control several devices;\
         \ the minor number provides a way for the driver to differentiate among them."
-      example: 128
+      example: 1
       default_field: false
     - name: group_leader.user.id
       level: core
@@ -6529,9 +6529,9 @@
       type: long
       description: The major number identifies the driver associated with the device.
         The character device's major and minor numbers can be algorithmically combined
-        to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0.
+        to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0".
         For more details, please refer to the Linux kernel documentation.
-      example: 1
+      example: 4
       default_field: false
     - name: parent.tty.char_device.minor
       level: extended
@@ -6540,7 +6540,7 @@
         \ number; other parts of the kernel don\u2019t use it, and merely pass it\
         \ along to the driver. It is common for a driver to control several devices;\
         \ the minor number provides a way for the driver to differentiate among them."
-      example: 128
+      example: 1
       default_field: false
     - name: parent.uptime
       level: extended
@@ -7012,9 +7012,9 @@
       type: long
       description: The major number identifies the driver associated with the device.
         The character device's major and minor numbers can be algorithmically combined
-        to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0.
+        to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0".
         For more details, please refer to the Linux kernel documentation.
-      example: 1
+      example: 4
       default_field: false
     - name: session_leader.tty.char_device.minor
       level: extended
@@ -7023,7 +7023,7 @@
         \ number; other parts of the kernel don\u2019t use it, and merely pass it\
         \ along to the driver. It is common for a driver to control several devices;\
         \ the minor number provides a way for the driver to differentiate among them."
-      example: 128
+      example: 1
       default_field: false
     - name: session_leader.user.id
       level: core
@@ -7104,9 +7104,9 @@
       type: long
       description: The major number identifies the driver associated with the device.
         The character device's major and minor numbers can be algorithmically combined
-        to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0.
+        to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0".
         For more details, please refer to the Linux kernel documentation.
-      example: 1
+      example: 4
       default_field: false
     - name: tty.char_device.minor
       level: extended
@@ -7115,7 +7115,25 @@
         \ number; other parts of the kernel don\u2019t use it, and merely pass it\
         \ along to the driver. It is common for a driver to control several devices;\
         \ the minor number provides a way for the driver to differentiate among them."
-      example: 128
+      example: 1
+      default_field: false
+    - name: tty.columns
+      level: extended
+      type: long
+      description: 'The number of character columns per line. e.g terminal width
+
+        Terminal sizes can change, so this value reflects the maximum value for a
+        given IO event. i.e. where event.action = ''text_output'''
+      example: 80
+      default_field: false
+    - name: tty.rows
+      level: extended
+      type: long
+      description: 'The number of character rows in the terminal. e.g terminal height
+
+        Terminal sizes can change, so this value reflects the maximum value for a
+        given IO event. i.e. where event.action = ''text_output'''
+      example: 24
       default_field: false
     - name: uptime
       level: extended

diff --git a/experimental/generated/csv/fields.csv b/experimental/generated/csv/fields.csv
@@ -606,8 +606,8 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description
 8.6.0-dev+exp,true,process,process.entry_leader.supplemental_groups.id,keyword,extended,,,Unique identifier for the group on the system/platform.
 8.6.0-dev+exp,true,process,process.entry_leader.supplemental_groups.name,keyword,extended,,,Name of the group.
 8.6.0-dev+exp,true,process,process.entry_leader.tty,object,extended,,,Information about the controlling TTY device.
-8.6.0-dev+exp,true,process,process.entry_leader.tty.char_device.major,long,extended,,1,The TTY character device's major number.
-8.6.0-dev+exp,true,process,process.entry_leader.tty.char_device.minor,long,extended,,128,The TTY character device's minor number.
+8.6.0-dev+exp,true,process,process.entry_leader.tty.char_device.major,long,extended,,4,The TTY character device's major number.
+8.6.0-dev+exp,true,process,process.entry_leader.tty.char_device.minor,long,extended,,1,The TTY character device's minor number.
 8.6.0-dev+exp,true,process,process.entry_leader.user.id,keyword,core,,S-1-5-21-202424912787-2692429404-2351956786-1000,Unique identifier of the user.
 8.6.0-dev+exp,true,process,process.entry_leader.user.name,keyword,core,,a.einstein,Short name or login of the user.
 8.6.0-dev+exp,true,process,process.entry_leader.user.name.text,match_only_text,core,,a.einstein,Short name or login of the user.
@@ -645,8 +645,8 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description
 8.6.0-dev+exp,true,process,process.group_leader.supplemental_groups.id,keyword,extended,,,Unique identifier for the group on the system/platform.
 8.6.0-dev+exp,true,process,process.group_leader.supplemental_groups.name,keyword,extended,,,Name of the group.
 8.6.0-dev+exp,true,process,process.group_leader.tty,object,extended,,,Information about the controlling TTY device.
-8.6.0-dev+exp,true,process,process.group_leader.tty.char_device.major,long,extended,,1,The TTY character device's major number.
-8.6.0-dev+exp,true,process,process.group_leader.tty.char_device.minor,long,extended,,128,The TTY character device's minor number.
+8.6.0-dev+exp,true,process,process.group_leader.tty.char_device.major,long,extended,,4,The TTY character device's major number.
+8.6.0-dev+exp,true,process,process.group_leader.tty.char_device.minor,long,extended,,1,The TTY character device's minor number.
 8.6.0-dev+exp,true,process,process.group_leader.user.id,keyword,core,,S-1-5-21-202424912787-2692429404-2351956786-1000,Unique identifier of the user.
 8.6.0-dev+exp,true,process,process.group_leader.user.name,keyword,core,,a.einstein,Short name or login of the user.
 8.6.0-dev+exp,true,process,process.group_leader.user.name.text,match_only_text,core,,a.einstein,Short name or login of the user.
@@ -752,8 +752,8 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description
 8.6.0-dev+exp,true,process,process.parent.title,keyword,extended,,,Process title.
 8.6.0-dev+exp,true,process,process.parent.title.text,match_only_text,extended,,,Process title.
 8.6.0-dev+exp,true,process,process.parent.tty,object,extended,,,Information about the controlling TTY device.
-8.6.0-dev+exp,true,process,process.parent.tty.char_device.major,long,extended,,1,The TTY character device's major number.
-8.6.0-dev+exp,true,process,process.parent.tty.char_device.minor,long,extended,,128,The TTY character device's minor number.
+8.6.0-dev+exp,true,process,process.parent.tty.char_device.major,long,extended,,4,The TTY character device's major number.
+8.6.0-dev+exp,true,process,process.parent.tty.char_device.minor,long,extended,,1,The TTY character device's minor number.
 8.6.0-dev+exp,true,process,process.parent.uptime,long,extended,,1325,Seconds the process has been up.
 8.6.0-dev+exp,true,process,process.parent.user.id,keyword,core,,S-1-5-21-202424912787-2692429404-2351956786-1000,Unique identifier of the user.
 8.6.0-dev+exp,true,process,process.parent.user.name,keyword,core,,a.einstein,Short name or login of the user.
@@ -818,8 +818,8 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description
 8.6.0-dev+exp,true,process,process.session_leader.supplemental_groups.id,keyword,extended,,,Unique identifier for the group on the system/platform.
 8.6.0-dev+exp,true,process,process.session_leader.supplemental_groups.name,keyword,extended,,,Name of the group.
 8.6.0-dev+exp,true,process,process.session_leader.tty,object,extended,,,Information about the controlling TTY device.
-8.6.0-dev+exp,true,process,process.session_leader.tty.char_device.major,long,extended,,1,The TTY character device's major number.
-8.6.0-dev+exp,true,process,process.session_leader.tty.char_device.minor,long,extended,,128,The TTY character device's minor number.
+8.6.0-dev+exp,true,process,process.session_leader.tty.char_device.major,long,extended,,4,The TTY character device's major number.
+8.6.0-dev+exp,true,process,process.session_leader.tty.char_device.minor,long,extended,,1,The TTY character device's minor number.
 8.6.0-dev+exp,true,process,process.session_leader.user.id,keyword,core,,S-1-5-21-202424912787-2692429404-2351956786-1000,Unique identifier of the user.
 8.6.0-dev+exp,true,process,process.session_leader.user.name,keyword,core,,a.einstein,Short name or login of the user.
 8.6.0-dev+exp,true,process,process.session_leader.user.name.text,match_only_text,core,,a.einstein,Short name or login of the user.
@@ -833,8 +833,10 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description
 8.6.0-dev+exp,true,process,process.title,keyword,extended,,,Process title.
 8.6.0-dev+exp,true,process,process.title.text,match_only_text,extended,,,Process title.
 8.6.0-dev+exp,true,process,process.tty,object,extended,,,Information about the controlling TTY device.
-8.6.0-dev+exp,true,process,process.tty.char_device.major,long,extended,,1,The TTY character device's major number.
-8.6.0-dev+exp,true,process,process.tty.char_device.minor,long,extended,,128,The TTY character device's minor number.
+8.6.0-dev+exp,true,process,process.tty.char_device.major,long,extended,,4,The TTY character device's major number.
+8.6.0-dev+exp,true,process,process.tty.char_device.minor,long,extended,,1,The TTY character device's minor number.
+8.6.0-dev+exp,true,process,process.tty.columns,long,extended,,80,The number of character columns per line. e.g terminal width
+8.6.0-dev+exp,true,process,process.tty.rows,long,extended,,24,The number of character rows in the terminal. e.g terminal height
 8.6.0-dev+exp,true,process,process.uptime,long,extended,,1325,Seconds the process has been up.
 8.6.0-dev+exp,true,process,process.user.id,keyword,core,,S-1-5-21-202424912787-2692429404-2351956786-1000,Unique identifier of the user.
 8.6.0-dev+exp,true,process,process.user.name,keyword,core,,a.einstein,Short name or login of the user.