Add node.role to service schema

CHANGELOG.next.md

@@ -16,6 +16,8 @@ Thanks, you're awesome :-) -->
 
 #### Added
 
+* Add `service.node.role` #1916
+
 #### Improvements
 
 #### Deprecated

docs/fields/field-details.asciidoc

@@ -8601,6 +8601,30 @@ example: `instance-0000000016`
 
 // ===============================================================
 
+|
+[[field-service-node-role]]
+<<field-service-node-role, service.node.role>>
+
+| Role of a service node.
+
+This allows for distinction between different running roles of the same service.
+
+In the case of Kibana, the `service.node.role` could be `ui` or `background-tasks`.
+
+In the case of Elasticsearch, the `service.node.role` could be `master` or `data`.
+
+Other services could use this to distinguish between a `web` and `worker` role running as part of the service.
+
+type: keyword
+
+
+
+example: `background-tasks`
+
+| extended
+
+// ===============================================================
+
 |
 [[field-service-state]]
 <<field-service-state, service.state>>

experimental/generated/beats/fields.ecs.yml

@@ -7650,6 +7650,23 @@
         provide uniqueness (e.g. multiple instances of the service running on the
         same host) - the node name can be manually set.'
       example: instance-0000000016
+    - name: node.role
+      level: extended
+      type: keyword
+      ignore_above: 1024
+      description: 'Role of a service node.
+
+        This allows for distinction between different running roles of the same service.
+
+        In the case of Kibana, the `service.node.role` could be `ui` or `background-tasks`.
+
+        In the case of Elasticsearch, the `service.node.role` could be `master` or
+        `data`.
+
+        Other services could use this to distinguish between a `web` and `worker`
+        role running as part of the service.'
+      example: background-tasks
+      default_field: false
     - name: origin.address
       level: extended
       type: keyword
@@ -7728,6 +7745,23 @@
         same host) - the node name can be manually set.'
       example: instance-0000000016
       default_field: false
+    - name: origin.node.role
+      level: extended
+      type: keyword
+      ignore_above: 1024
+      description: 'Role of a service node.
+
+        This allows for distinction between different running roles of the same service.
+
+        In the case of Kibana, the `service.node.role` could be `ui` or `background-tasks`.
+
+        In the case of Elasticsearch, the `service.node.role` could be `master` or
+        `data`.
+
+        Other services could use this to distinguish between a `web` and `worker`
+        role running as part of the service.'
+      example: background-tasks
+      default_field: false
     - name: origin.state
       level: core
       type: keyword
@@ -7839,6 +7873,23 @@
         same host) - the node name can be manually set.'
       example: instance-0000000016
       default_field: false
+    - name: target.node.role
+      level: extended
+      type: keyword
+      ignore_above: 1024
+      description: 'Role of a service node.
+
+        This allows for distinction between different running roles of the same service.
+
+        In the case of Kibana, the `service.node.role` could be `ui` or `background-tasks`.
+
+        In the case of Elasticsearch, the `service.node.role` could be `master` or
+        `data`.
+
+        Other services could use this to distinguish between a `web` and `worker`
+        role running as part of the service.'
+      example: background-tasks
+      default_field: false
     - name: target.state
       level: core
       type: keyword

experimental/generated/csv/fields.csv

@@ -896,12 +896,14 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description
 8.4.0-dev+exp,true,service,service.id,keyword,core,,d37e5ebfe0ae6c4972dbe9f0174a1637bb8247f6,Unique identifier of the running service.
 8.4.0-dev+exp,true,service,service.name,keyword,core,,elasticsearch-metrics,Name of the service.
 8.4.0-dev+exp,true,service,service.node.name,keyword,extended,,instance-0000000016,Name of the service node.
+8.4.0-dev+exp,true,service,service.node.role,keyword,extended,,background-tasks,Role of the service node.
 8.4.0-dev+exp,true,service,service.origin.address,keyword,extended,,172.26.0.2:5432,Address of this service.
 8.4.0-dev+exp,true,service,service.origin.environment,keyword,extended,,production,Environment of the service.
 8.4.0-dev+exp,true,service,service.origin.ephemeral_id,keyword,extended,,8a4f500f,Ephemeral identifier of this service.
 8.4.0-dev+exp,true,service,service.origin.id,keyword,core,,d37e5ebfe0ae6c4972dbe9f0174a1637bb8247f6,Unique identifier of the running service.
 8.4.0-dev+exp,true,service,service.origin.name,keyword,core,,elasticsearch-metrics,Name of the service.
 8.4.0-dev+exp,true,service,service.origin.node.name,keyword,extended,,instance-0000000016,Name of the service node.
+8.4.0-dev+exp,true,service,service.origin.node.role,keyword,extended,,background-tasks,Role of the service node.
 8.4.0-dev+exp,true,service,service.origin.state,keyword,core,,,Current state of the service.
 8.4.0-dev+exp,true,service,service.origin.type,keyword,core,,elasticsearch,The type of the service.
 8.4.0-dev+exp,true,service,service.origin.version,keyword,core,,3.2.4,Version of the service.
@@ -912,6 +914,7 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description
 8.4.0-dev+exp,true,service,service.target.id,keyword,core,,d37e5ebfe0ae6c4972dbe9f0174a1637bb8247f6,Unique identifier of the running service.
 8.4.0-dev+exp,true,service,service.target.name,keyword,core,,elasticsearch-metrics,Name of the service.
 8.4.0-dev+exp,true,service,service.target.node.name,keyword,extended,,instance-0000000016,Name of the service node.
+8.4.0-dev+exp,true,service,service.target.node.role,keyword,extended,,background-tasks,Role of the service node.
 8.4.0-dev+exp,true,service,service.target.state,keyword,core,,,Current state of the service.
 8.4.0-dev+exp,true,service,service.target.type,keyword,core,,elasticsearch,The type of the service.
 8.4.0-dev+exp,true,service,service.target.version,keyword,core,,3.2.4,Version of the service.

experimental/generated/ecs/ecs_flat.yml

@@ -11252,6 +11252,26 @@ service.node.name:
   normalize: []
   short: Name of the service node.
   type: keyword
+service.node.role:
+  dashed_name: service-node-role
+  description: 'Role of a service node.
+
+    This allows for distinction between different running roles of the same service.
+
+    In the case of Kibana, the `service.node.role` could be `ui` or `background-tasks`.
+
+    In the case of Elasticsearch, the `service.node.role` could be `master` or `data`.
+
+    Other services could use this to distinguish between a `web` and `worker` role
+    running as part of the service.'
+  example: background-tasks
+  flat_name: service.node.role
+  ignore_above: 1024
+  level: extended
+  name: node.role
+  normalize: []
+  short: Role of the service node.
+  type: keyword
 service.origin.address:
   dashed_name: service-origin-address
   description: 'Address where data about this service was collected from.
@@ -11360,6 +11380,27 @@ service.origin.node.name:
   original_fieldset: service
   short: Name of the service node.
   type: keyword
+service.origin.node.role:
+  dashed_name: service-origin-node-role
+  description: 'Role of a service node.
+
+    This allows for distinction between different running roles of the same service.
+
+    In the case of Kibana, the `service.node.role` could be `ui` or `background-tasks`.
+
+    In the case of Elasticsearch, the `service.node.role` could be `master` or `data`.
+
+    Other services could use this to distinguish between a `web` and `worker` role
+    running as part of the service.'
+  example: background-tasks
+  flat_name: service.origin.node.role
+  ignore_above: 1024
+  level: extended
+  name: node.role
+  normalize: []
+  original_fieldset: service
+  short: Role of the service node.
+  type: keyword
 service.origin.state:
   dashed_name: service-origin-state
   description: Current state of the service.
@@ -11521,6 +11562,27 @@ service.target.node.name:
   original_fieldset: service
   short: Name of the service node.
   type: keyword
+service.target.node.role:
+  dashed_name: service-target-node-role
+  description: 'Role of a service node.
+
+    This allows for distinction between different running roles of the same service.
+
+    In the case of Kibana, the `service.node.role` could be `ui` or `background-tasks`.
+
+    In the case of Elasticsearch, the `service.node.role` could be `master` or `data`.
+
+    Other services could use this to distinguish between a `web` and `worker` role
+    running as part of the service.'
+  example: background-tasks
+  flat_name: service.target.node.role
+  ignore_above: 1024
+  level: extended
+  name: node.role
+  normalize: []
+  original_fieldset: service
+  short: Role of the service node.
+  type: keyword
 service.target.state:
   dashed_name: service-target-state
   description: Current state of the service.

experimental/generated/ecs/ecs_nested.yml

@@ -13250,6 +13250,27 @@ service:
       normalize: []
       short: Name of the service node.
       type: keyword
+    service.node.role:
+      dashed_name: service-node-role
+      description: 'Role of a service node.
+
+        This allows for distinction between different running roles of the same service.
+
+        In the case of Kibana, the `service.node.role` could be `ui` or `background-tasks`.
+
+        In the case of Elasticsearch, the `service.node.role` could be `master` or
+        `data`.
+
+        Other services could use this to distinguish between a `web` and `worker`
+        role running as part of the service.'
+      example: background-tasks
+      flat_name: service.node.role
+      ignore_above: 1024
+      level: extended
+      name: node.role
+      normalize: []
+      short: Role of the service node.
+      type: keyword
     service.origin.address:
       dashed_name: service-origin-address
       description: 'Address where data about this service was collected from.
@@ -13359,6 +13380,28 @@ service:
       original_fieldset: service
       short: Name of the service node.
       type: keyword
+    service.origin.node.role:
+      dashed_name: service-origin-node-role
+      description: 'Role of a service node.
+
+        This allows for distinction between different running roles of the same service.
+
+        In the case of Kibana, the `service.node.role` could be `ui` or `background-tasks`.
+
+        In the case of Elasticsearch, the `service.node.role` could be `master` or
+        `data`.
+
+        Other services could use this to distinguish between a `web` and `worker`
+        role running as part of the service.'
+      example: background-tasks
+      flat_name: service.origin.node.role
+      ignore_above: 1024
+      level: extended
+      name: node.role
+      normalize: []
+      original_fieldset: service
+      short: Role of the service node.
+      type: keyword
     service.origin.state:
       dashed_name: service-origin-state
       description: Current state of the service.
@@ -13521,6 +13564,28 @@ service:
       original_fieldset: service
       short: Name of the service node.
       type: keyword
+    service.target.node.role:
+      dashed_name: service-target-node-role
+      description: 'Role of a service node.
+
+        This allows for distinction between different running roles of the same service.
+
+        In the case of Kibana, the `service.node.role` could be `ui` or `background-tasks`.
+
+        In the case of Elasticsearch, the `service.node.role` could be `master` or
+        `data`.
+
+        Other services could use this to distinguish between a `web` and `worker`
+        role running as part of the service.'
+      example: background-tasks
+      flat_name: service.target.node.role
+      ignore_above: 1024
+      level: extended
+      name: node.role
+      normalize: []
+      original_fieldset: service
+      short: Role of the service node.
+      type: keyword
     service.target.state:
       dashed_name: service-target-state
       description: Current state of the service.

experimental/generated/elasticsearch/composable/component/service.json

@@ -33,6 +33,10 @@
                 "name": {
                   "ignore_above": 1024,
                   "type": "keyword"
+                },
+                "role": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
                 }
               }
             },
@@ -63,6 +67,10 @@
                     "name": {
                       "ignore_above": 1024,
                       "type": "keyword"
+                    },
+                    "role": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
                     }
                   }
                 },
@@ -111,6 +119,10 @@
                     "name": {
                       "ignore_above": 1024,
                       "type": "keyword"
+                    },
+                    "role": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
                     }
                   }
                 },

experimental/generated/elasticsearch/legacy/template.json

@@ -4254,6 +4254,10 @@
               "name": {
                 "ignore_above": 1024,
                 "type": "keyword"
+              },
+              "role": {
+                "ignore_above": 1024,
+                "type": "keyword"
               }
             }
           },
@@ -4284,6 +4288,10 @@
                   "name": {
                     "ignore_above": 1024,
                     "type": "keyword"
+                  },
+                  "role": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
                   }
                 }
               },
@@ -4332,6 +4340,10 @@
                   "name": {
                     "ignore_above": 1024,
                     "type": "keyword"
+                  },
+                  "role": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
                   }
                 }
               },