Implement proposed changes from RFC 00300 - linux event model fields #1842
Conversation
| The entry type for the entry session leader. | ||
| Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console | ||
|
|
||
| - name: entry_meta.source |
There was a problem hiding this comment.
Just realized we have this defined here as well as in source.yml. I would guess we should omit from process.yml?
There was a problem hiding this comment.
do we need a -name: entry_meta to replace it? so source.yml has something to attach to? kinda like below with the 'tty' field?
There was a problem hiding this comment.
Good catch, I will remove it from process
We can define it if you want to be explicit, but it isn't necessary
|
Just a few notes, but overall looking good! Did you want me to merge my PR instead of making changes to rfcs/text/0030/* stuff? I guess it's not a big deal to resolve those conflicts though. |
So these changes are to the actual schema, so we can get your fields out there as beta and officially into ECS. I think we hold off on your PR for now just since stage 3 signifies the addition is finished. Unless, you wanted to change it to a stage 2 update and we hold that Stage 3 label for a little longer. |
|
oh yea no worries, it can wait. |
…cs into linux-event-model-beta-changes
There was a problem hiding this comment.
With all the introduced fields and reuses, this PR more than doubles the existing total ECS field count. However, this is because the current ECS tooling is fully populating all the reuses to build its artifacts.
From the ECS side, we're planning on submitting a follow-up PR shortly to trim this total back using filtering for some of the process.* reuese. But that's not a blocker for moving forward with these changes.
FYI @mitodrummer - ECS will base its process.* filtering on your work in the endpoint-package
Co-authored-by: Eric Beahan <[email protected]>
…cs into linux-event-model-beta-changes
…lastic#1842) # Conflicts: # experimental/generated/csv/fields.csv # generated/csv/fields.csv
Cool, yea @kqualters-elastic opened this PR which has a lot of nested mappings on the process fieldsets, so glad to hear you are going to filter some of those out, as I imagine this adds quite a large overhead to indexes making use of these new mappings. https://github.com/elastic/kibana/pull/128286/files |
Implement the schema changes for linux event model proposed in RFC 0030 and updated in #1826