clarify agent definition #192
Conversation
CONTRIBUTING.md
Outdated
| @@ -80,15 +80,6 @@ The `type` is the [Elasticsearch field type](https://www.elastic.co/guide/en/ela | |||
| `example` adds an sample value. | |||
| The `phase` field indicates the development status of the field. If `phase` is left out, the default is 0. | |||
|
|
|||
| ## Phases | |||
There was a problem hiding this comment.
+1 on removing this but it should not be in this PR
There was a problem hiding this comment.
Agreed, thanks. Will back this out and make new PR for removing Phase discussion.
CONTRIBUTING.md
Outdated
| @@ -59,7 +59,7 @@ The file structure is similar to this: | |||
| title: Agent fields | |||
| group: 2 | |||
| description: > | |||
| The agent fields contain all the data about the agent/client/shipper that collected/generated the events. | |||
| The agent fields contain the data about the software entity, if any, that detects or observes events on a host, or takes measurements on a host. Examples include beats. Agents do not run on devices. ECS agent.* fields shall be populated with details of the agent running on the host where the event happened or the measurement was taken. | |||
There was a problem hiding this comment.
I'm running Filebeat and Metricbeat on my Ubiquity EdgeMax to collect logs and system metrics. In this case my agent runs on a device I think?
Could add detects, collects or observes events because I think collection is an important part of most beats.
There was a problem hiding this comment.
@ruflin Thanks! yes, there are a few cases where an agent may run on devices. I will fix this language to allow for that.
There was a problem hiding this comment.
... and yes, adding "collects" makes good sense. Will do.
MikePaquette
force-pushed
the
agent-mods
branch
2 times, most recently
from
974711c to
102203a
Compare
CHANGELOG.md
Outdated
| @@ -25,6 +25,9 @@ All notable changes to this project will be documented in this file based on the | |||
|
|
|||
| ### Improvements | |||
| * Improved the definition of the file fields #196 | |||
| Improved the definition of the agent fields two places #192 | |||
| * Improved the definition of the agent fields two places #192 | |||
There was a problem hiding this comment.
Seems like we had a git rebase issue here :-)
Just edit the file, commit again and push again (no need for the --force this time)
Co-Authored-By: MikePaquette <[email protected]>
|
@MikePaquette Seems like you need to run |
|
thanks @ruflin make is breaking on my local system. I pulled from master earlier this afternoon and now getting an error running template.go, which was updated just over 1 hour ago. |
|
@MikePaquette Ah yeah this is because the ECS scripts have a dependency on Beats. You need to go to the Beats repo on your local machine, check out master (on beats) and pull again. Then your |
MikePaquette
force-pushed
the
agent-mods
branch
from
964a06f to
f6c081f
Compare
| @@ -86,7 +86,7 @@ The base set contains all fields which are on the top level. These fields are co | |||
|
|
|||
| ## <a name="agent"></a> Agent fields | |||
|
|
|||
| The agent fields contain the data about the agent/client/shipper that created the event. | |||
| The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host. Examples include beats. Agents may also run on devices. ECS agent.* fields shall be populated with details of the agent running on the host or device where the event happened or the measurement was taken. | |||
* clarify agent defintion * Make same change in CONTRIBUTING.md, remove Phases, and update CHANGELOG.md * Fix Format of CHANGELOG.md * Tweak CHANGELOG.md Co-Authored-By: MikePaquette <[email protected]> * Changed wording per suggestion - backed out phase removal * fix changelog conflict * fix make error
Enhancing definition of agent object.