Introducing the allowed values for the categorization fields

[webmat]

This issue is meant to track the work required to introduce the mandated values for the currently reserved fields (event.kind, event.category, event.type, event.outcome).

This public document lists all values being considered: https://ela.st/ecs-categories-draft. Please note that plan is to introduce the most well understood and stable subset of these values for ECS 1.4, and continue working to release additional official values in future releases. The community's feedback and comments are welcome.

Introduction for ECS 1.4

• Introducing doc section for the expected values in reserved fields #684 Initial plumbing (new pages, new YAML sections to list values & descriptions)
• Publish the public doc to capture feedback around the values being considered
• Introduce the initial values for ECS categorization #692, Backport #692 to 1.4: Introduce the initial values for ECS categorization #697 Final PR to introduce the initial values for ECS categorization

Follow-up work

• Output accepted values to a new file values.csv
• Allow for a free form asciidoc section for examples, at the bottom of each of the "Accepted Values" pages
• Introduce a diagram like Ross suggested in this comment to make the hierarchy more visual

[webmat]

Added the public feedback document (https://ela.st/ecs-categories-draft) to the body of the pull request.

[enotspe]

It is not very clear the difference of network from network_flow. Or what could be an only network event and not a network_flow event?

[webmat]

@enotspe That's why these specific values are not out yet. They're some of the most important ones we still have to finish clarifying (hence the gradual release of these values).

By the way, this public doc is meant to accept comments from everyone. Could you confirm whether you're allowed to comment on it? You don't need to actually enter a comment, just want to double check that permissions are correctly set :-)

[enotspe]

@webmat yes, i can see and comment the doc. Should we comment there instead of here?

[webmat]

@enotspe Yes, you can comment in there, especially around the still unpublished values.

My recommendation for feedback would be:

• any comment very specific to what's currently published in the official ECS docs on www.elastic.co should be via a Github issue or PR
• any general comment on the general approach, future values, missing values, etc. should for now be on the public feedback document.