diff --git a/CHANGELOG.next.md b/CHANGELOG.next.md index 67fbb71b4..a26c40beb 100644 --- a/CHANGELOG.next.md +++ b/CHANGELOG.next.md @@ -23,6 +23,7 @@ Thanks, you're awesome :-) --> #### Improvements +* Promote beta fields to GA. #2411 * Define base encoding of `x509.serial_number`. #2383 * Restrict the encoding of `x509.serial_number` to base 16. #2398 * Set synthetic_source_keep = none on fields that represent sets. #2422 diff --git a/docs/fields/field-details.asciidoc b/docs/fields/field-details.asciidoc index 7f5679e36..106609648 100644 --- a/docs/fields/field-details.asciidoc +++ b/docs/fields/field-details.asciidoc @@ -821,17 +821,15 @@ Note also that the `cloud` fields may be used directly at the root of the events | `cloud.origin.*` -| <>| beta:[ Reusing the `cloud` fields in this location is currently considered beta.] - -Provides the cloud information of the origin entity in case of an incoming request or event. +| <> +| Provides the cloud information of the origin entity in case of an incoming request or event. // =============================================================== | `cloud.target.*` -| <>| beta:[ Reusing the `cloud` fields in this location is currently considered beta.] - -Provides the cloud information of the target entity in case of an outgoing request or event. +| <> +| Provides the cloud information of the target entity in case of an outgoing request or event. // =============================================================== @@ -2327,8 +2325,6 @@ image:https://img.shields.io/badge/OpenTelemetry-4a5ca6?style=flat&logo=opentele These fields contain Linux Executable Linkable Format (ELF) metadata. -beta::[ These fields are in beta and are subject to change.] - [discrete] ==== ELF Header Field Details @@ -4020,8 +4016,6 @@ example: `https://mysystem.example.com/alert/5271dedb-f5b0-4218-87f0-4ac4870a38f The user fields describe information about the function as a service (FaaS) that is relevant to the event. -beta::[ These fields are in beta and are subject to change.] - [discrete] ==== FaaS Field Details @@ -4673,9 +4667,8 @@ Note also that the `file` fields may be used directly at the root of the events. | `file.elf.*` -| <>| beta:[ This field reuse is beta and subject to change.] - -These fields contain Linux Executable Linkable Format (ELF) metadata. +| <> +| These fields contain Linux Executable Linkable Format (ELF) metadata. // =============================================================== @@ -5242,9 +5235,7 @@ image:https://img.shields.io/badge/OpenTelemetry-4a5ca6?style=flat&logo=opentele [[field-host-boot-id]] <> -a| beta:[ This field is beta and subject to change. ] - -Linux boot uuid taken from /proc/sys/kernel/random/boot_id. Note the boot_id value from /proc may or may not be the same in containers as on the host. Some container runtimes will bind mount a new boot_id value onto the proc file in each container. +a| Linux boot uuid taken from /proc/sys/kernel/random/boot_id. Note the boot_id value from /proc may or may not be the same in containers as on the host. Some container runtimes will bind mount a new boot_id value onto the proc file in each container. type: keyword @@ -5512,9 +5503,7 @@ image:https://img.shields.io/badge/OpenTelemetry-4a5ca6?style=flat&logo=opentele [[field-host-pid-ns-ino]] <> -a| beta:[ This field is beta and subject to change. ] - -This is the inode number of the namespace in the namespace file system (nsfs). Unsigned int inum in include/linux/ns_common.h. +a| This is the inode number of the namespace in the namespace file system (nsfs). Unsigned int inum in include/linux/ns_common.h. type: keyword @@ -9070,9 +9059,8 @@ The externally attested user based on an external source such as the Kube API. | `process.elf.*` -| <>| beta:[ This field reuse is beta and subject to change.] - -These fields contain Linux Executable Linkable Format (ELF) metadata. +| <> +| These fields contain Linux Executable Linkable Format (ELF) metadata. // =============================================================== @@ -13407,8 +13395,6 @@ Note also that the `vlan` fields are not expected to be used directly at the roo Fields related to storage volume details. -beta::[ These fields are beta and are subject to change.] - [discrete] ==== Volume Field Details diff --git a/docs/fields/field-values.asciidoc b/docs/fields/field-values.asciidoc index 0a4030ba0..c05396aa7 100644 --- a/docs/fields/field-values.asciidoc +++ b/docs/fields/field-values.asciidoc @@ -64,8 +64,6 @@ This value is not used by Elastic solutions for alert documents that are created [[ecs-event-kind-asset]] ==== asset -beta:[ This event categorization value is beta and subject to change. ] - This value indicates events whose primary purpose is to store an inventory of assets/entities and their attributes. Assets/entities are objects (such as users and hosts) that are expected to be subjects of detailed analysis within the system. Examples include lists of user identities or accounts ingested from directory services such as Active Directory (AD), inventory of hosts pulled from configuration management databases (CMDB), and lists of cloud storage buckets pulled from cloud provider APIs. diff --git a/docs/opentelemetry/otel-fields-mapping.asciidoc b/docs/opentelemetry/otel-fields-mapping.asciidoc index e871993a4..4e6d5f047 100644 --- a/docs/opentelemetry/otel-fields-mapping.asciidoc +++ b/docs/opentelemetry/otel-fields-mapping.asciidoc @@ -540,7 +540,7 @@ Note: The `body` in OTLP is of type `Any` and can be either an unstructured log .1+| [[otel-mapping-for-faas-coldstart]] -<> [beta] +<> @@ -554,7 +554,7 @@ Note: The `body` in OTLP is of type `Any` and can be either an unstructured log // =============================================================== .1+| [[otel-mapping-for-faas-execution]] -<> [beta] +<> @@ -568,7 +568,7 @@ Note: The `body` in OTLP is of type `Any` and can be either an unstructured log // =============================================================== .1+| [[otel-mapping-for-faas-name]] -<> [beta] +<> @@ -582,7 +582,7 @@ Note: The `body` in OTLP is of type `Any` and can be either an unstructured log // =============================================================== .1+| [[otel-mapping-for-faas-trigger-type]] -<> [beta] +<> @@ -596,7 +596,7 @@ Note: The `body` in OTLP is of type `Any` and can be either an unstructured log // =============================================================== .1+| [[otel-mapping-for-faas-version]] -<> [beta] +<> diff --git a/experimental/generated/ecs/ecs_flat.yml b/experimental/generated/ecs/ecs_flat.yml index 1c383350b..036b33927 100644 --- a/experimental/generated/ecs/ecs_flat.yml +++ b/experimental/generated/ecs/ecs_flat.yml @@ -3515,8 +3515,7 @@ event.kind: This value is not used by Elastic solutions for alert documents that are created by rules executing within the Kibana alerting framework.' name: alert - - beta: This event categorization value is beta and subject to change. - description: 'This value indicates events whose primary purpose is to store an + - description: 'This value indicates events whose primary purpose is to store an inventory of assets/entities and their attributes. Assets/entities are objects (such as users and hosts) that are expected to be subjects of detailed analysis within the system. @@ -5931,7 +5930,6 @@ host.architecture: short: Operating system architecture. type: keyword host.boot.id: - beta: This field is beta and subject to change. dashed_name: host-boot-id description: Linux boot uuid taken from /proc/sys/kernel/random/boot_id. Note the boot_id value from /proc may or may not be the same in containers as on the host. @@ -6390,7 +6388,6 @@ host.os.version: short: Operating system version as a raw string. type: keyword host.pid_ns_ino: - beta: This field is beta and subject to change. dashed_name: host-pid-ns-ino description: This is the inode number of the namespace in the namespace file system (nsfs). Unsigned int inum in include/linux/ns_common.h. diff --git a/experimental/generated/ecs/ecs_nested.yml b/experimental/generated/ecs/ecs_nested.yml index d5e6aaac4..4c31d4778 100644 --- a/experimental/generated/ecs/ecs_nested.yml +++ b/experimental/generated/ecs/ecs_nested.yml @@ -1321,25 +1321,21 @@ cloud: expected: - as: origin at: cloud - beta: Reusing the `cloud` fields in this location is currently considered beta. full: cloud.origin short_override: Provides the cloud information of the origin entity in case of an incoming request or event. - as: target at: cloud - beta: Reusing the `cloud` fields in this location is currently considered beta. full: cloud.target short_override: Provides the cloud information of the target entity in case of an outgoing request or event. top_level: true reused_here: - - beta: Reusing the `cloud` fields in this location is currently considered beta. - full: cloud.origin + - full: cloud.origin schema_name: cloud short: Provides the cloud information of the origin entity in case of an incoming request or event. - - beta: Reusing the `cloud` fields in this location is currently considered beta. - full: cloud.target + - full: cloud.target schema_name: cloud short: Provides the cloud information of the target entity in case of an outgoing request or event. @@ -3259,7 +3255,6 @@ ecs: title: ECS type: group elf: - beta: These fields are in beta and are subject to change. description: These fields contain Linux Executable Linkable Format (ELF) metadata. fields: elf.architecture: @@ -3674,11 +3669,9 @@ elf: expected: - as: elf at: file - beta: This field reuse is beta and subject to change. full: file.elf - as: elf at: process - beta: This field reuse is beta and subject to change. full: process.elf top_level: false short: These fields contain Linux Executable Linkable Format (ELF) metadata. @@ -4538,8 +4531,7 @@ event: This value is not used by Elastic solutions for alert documents that are created by rules executing within the Kibana alerting framework.' name: alert - - beta: This event categorization value is beta and subject to change. - description: 'This value indicates events whose primary purpose is to store + - description: 'This value indicates events whose primary purpose is to store an inventory of assets/entities and their attributes. Assets/entities are objects (such as users and hosts) that are expected to be subjects of detailed analysis within the system. @@ -5001,7 +4993,6 @@ event: title: Event type: group faas: - beta: These fields are in beta and are subject to change. description: The user fields describe information about the function as a service (FaaS) that is relevant to the event. fields: @@ -6978,8 +6969,7 @@ file: - full: file.code_signature schema_name: code_signature short: These fields contain information about binary code signatures. - - beta: This field reuse is beta and subject to change. - full: file.elf + - full: file.elf schema_name: elf short: These fields contain Linux Executable Linkable Format (ELF) metadata. - beta: This field reuse is beta and subject to change. @@ -7397,7 +7387,6 @@ host: short: Operating system architecture. type: keyword host.boot.id: - beta: This field is beta and subject to change. dashed_name: host-boot-id description: Linux boot uuid taken from /proc/sys/kernel/random/boot_id. Note the boot_id value from /proc may or may not be the same in containers as on @@ -7858,7 +7847,6 @@ host: short: Operating system version as a raw string. type: keyword host.pid_ns_ino: - beta: This field is beta and subject to change. dashed_name: host-pid-ns-ino description: This is the inode number of the namespace in the namespace file system (nsfs). Unsigned int inum in include/linux/ns_common.h. @@ -15666,8 +15654,7 @@ process: - full: process.code_signature schema_name: code_signature short: These fields contain information about binary code signatures. - - beta: This field reuse is beta and subject to change. - full: process.elf + - full: process.elf schema_name: elf short: These fields contain Linux Executable Linkable Format (ELF) metadata. - beta: This field reuse is beta and subject to change. @@ -25860,7 +25847,6 @@ vlan: title: VLAN type: group volume: - beta: These fields are beta and are subject to change. description: Fields related to storage volume details. fields: volume.bus_type: diff --git a/generated/ecs/ecs_flat.yml b/generated/ecs/ecs_flat.yml index b12d8e90a..a1c14a8c2 100644 --- a/generated/ecs/ecs_flat.yml +++ b/generated/ecs/ecs_flat.yml @@ -3446,8 +3446,7 @@ event.kind: This value is not used by Elastic solutions for alert documents that are created by rules executing within the Kibana alerting framework.' name: alert - - beta: This event categorization value is beta and subject to change. - description: 'This value indicates events whose primary purpose is to store an + - description: 'This value indicates events whose primary purpose is to store an inventory of assets/entities and their attributes. Assets/entities are objects (such as users and hosts) that are expected to be subjects of detailed analysis within the system. @@ -5862,7 +5861,6 @@ host.architecture: short: Operating system architecture. type: keyword host.boot.id: - beta: This field is beta and subject to change. dashed_name: host-boot-id description: Linux boot uuid taken from /proc/sys/kernel/random/boot_id. Note the boot_id value from /proc may or may not be the same in containers as on the host. @@ -6321,7 +6319,6 @@ host.os.version: short: Operating system version as a raw string. type: keyword host.pid_ns_ino: - beta: This field is beta and subject to change. dashed_name: host-pid-ns-ino description: This is the inode number of the namespace in the namespace file system (nsfs). Unsigned int inum in include/linux/ns_common.h. diff --git a/generated/ecs/ecs_nested.yml b/generated/ecs/ecs_nested.yml index fb97c570f..ff5ae4e17 100644 --- a/generated/ecs/ecs_nested.yml +++ b/generated/ecs/ecs_nested.yml @@ -1241,25 +1241,21 @@ cloud: expected: - as: origin at: cloud - beta: Reusing the `cloud` fields in this location is currently considered beta. full: cloud.origin short_override: Provides the cloud information of the origin entity in case of an incoming request or event. - as: target at: cloud - beta: Reusing the `cloud` fields in this location is currently considered beta. full: cloud.target short_override: Provides the cloud information of the target entity in case of an outgoing request or event. top_level: true reused_here: - - beta: Reusing the `cloud` fields in this location is currently considered beta. - full: cloud.origin + - full: cloud.origin schema_name: cloud short: Provides the cloud information of the origin entity in case of an incoming request or event. - - beta: Reusing the `cloud` fields in this location is currently considered beta. - full: cloud.target + - full: cloud.target schema_name: cloud short: Provides the cloud information of the target entity in case of an outgoing request or event. @@ -3179,7 +3175,6 @@ ecs: title: ECS type: group elf: - beta: These fields are in beta and are subject to change. description: These fields contain Linux Executable Linkable Format (ELF) metadata. fields: elf.architecture: @@ -3594,11 +3589,9 @@ elf: expected: - as: elf at: file - beta: This field reuse is beta and subject to change. full: file.elf - as: elf at: process - beta: This field reuse is beta and subject to change. full: process.elf top_level: false short: These fields contain Linux Executable Linkable Format (ELF) metadata. @@ -4458,8 +4451,7 @@ event: This value is not used by Elastic solutions for alert documents that are created by rules executing within the Kibana alerting framework.' name: alert - - beta: This event categorization value is beta and subject to change. - description: 'This value indicates events whose primary purpose is to store + - description: 'This value indicates events whose primary purpose is to store an inventory of assets/entities and their attributes. Assets/entities are objects (such as users and hosts) that are expected to be subjects of detailed analysis within the system. @@ -4921,7 +4913,6 @@ event: title: Event type: group faas: - beta: These fields are in beta and are subject to change. description: The user fields describe information about the function as a service (FaaS) that is relevant to the event. fields: @@ -6898,8 +6889,7 @@ file: - full: file.code_signature schema_name: code_signature short: These fields contain information about binary code signatures. - - beta: This field reuse is beta and subject to change. - full: file.elf + - full: file.elf schema_name: elf short: These fields contain Linux Executable Linkable Format (ELF) metadata. - beta: This field reuse is beta and subject to change. @@ -7317,7 +7307,6 @@ host: short: Operating system architecture. type: keyword host.boot.id: - beta: This field is beta and subject to change. dashed_name: host-boot-id description: Linux boot uuid taken from /proc/sys/kernel/random/boot_id. Note the boot_id value from /proc may or may not be the same in containers as on @@ -7778,7 +7767,6 @@ host: short: Operating system version as a raw string. type: keyword host.pid_ns_ino: - beta: This field is beta and subject to change. dashed_name: host-pid-ns-ino description: This is the inode number of the namespace in the namespace file system (nsfs). Unsigned int inum in include/linux/ns_common.h. @@ -15586,8 +15574,7 @@ process: - full: process.code_signature schema_name: code_signature short: These fields contain information about binary code signatures. - - beta: This field reuse is beta and subject to change. - full: process.elf + - full: process.elf schema_name: elf short: These fields contain Linux Executable Linkable Format (ELF) metadata. - beta: This field reuse is beta and subject to change. @@ -25780,7 +25767,6 @@ vlan: title: VLAN type: group volume: - beta: These fields are beta and are subject to change. description: Fields related to storage volume details. fields: volume.bus_type: diff --git a/schemas/cloud.yml b/schemas/cloud.yml index 2a7f2d29b..d41661ced 100644 --- a/schemas/cloud.yml +++ b/schemas/cloud.yml @@ -44,11 +44,9 @@ expected: - at: cloud as: origin - beta: Reusing the `cloud` fields in this location is currently considered beta. short_override: Provides the cloud information of the origin entity in case of an incoming request or event. - at: cloud as: target - beta: Reusing the `cloud` fields in this location is currently considered beta. short_override: Provides the cloud information of the target entity in case of an outgoing request or event. type: group fields: diff --git a/schemas/elf.yml b/schemas/elf.yml index a8594bd02..cd81f6b41 100644 --- a/schemas/elf.yml +++ b/schemas/elf.yml @@ -20,18 +20,14 @@ group: 2 description: > These fields contain Linux Executable Linkable Format (ELF) metadata. - beta: > - These fields are in beta and are subject to change. type: group reusable: top_level: false expected: - at: file as: elf - beta: This field reuse is beta and subject to change. - at: process as: elf - beta: This field reuse is beta and subject to change. fields: - name: creation_date short: Build or compile date. diff --git a/schemas/event.yml b/schemas/event.yml index 93b828638..6cf15db9f 100644 --- a/schemas/event.yml +++ b/schemas/event.yml @@ -99,8 +99,6 @@ `event.kind: asset` is not used for normal system events or logs that are coming from an asset/entity, nor is it used for system events or logs coming from a directory or CMDB system. - beta: > - This event categorization value is beta and subject to change. - name: enrichment description: > The `enrichment` value indicates an event collected to provide additional diff --git a/schemas/faas.yml b/schemas/faas.yml index 302930abb..511f14e7a 100644 --- a/schemas/faas.yml +++ b/schemas/faas.yml @@ -22,8 +22,6 @@ description: > The user fields describe information about the function as a service (FaaS) that is relevant to the event. - beta: > - These fields are in beta and are subject to change. type: group fields: - name: name diff --git a/schemas/host.yml b/schemas/host.yml index 560aee148..48098f8e4 100644 --- a/schemas/host.yml +++ b/schemas/host.yml @@ -225,7 +225,6 @@ type: keyword short: Linux boot uuid taken from /proc/sys/kernel/random/boot_id example: 88a1f0ed-5ae5-41ee-af6b-41921c311872 - beta: This field is beta and subject to change. description: > Linux boot uuid taken from /proc/sys/kernel/random/boot_id. Note the boot_id value from /proc may or may not be the same in containers as on the host. Some container runtimes will bind mount a new boot_id value onto the proc file in each container. @@ -234,6 +233,5 @@ type: keyword short: Pid namespace inode example: 256383 - beta: This field is beta and subject to change. description: > This is the inode number of the namespace in the namespace file system (nsfs). Unsigned int inum in include/linux/ns_common.h. diff --git a/schemas/volume.yml b/schemas/volume.yml index f2e6dadfa..557c9053b 100644 --- a/schemas/volume.yml +++ b/schemas/volume.yml @@ -20,8 +20,6 @@ group: 2 description: > Fields related to storage volume details. - beta: > - These fields are beta and are subject to change. type: group fields: - name: mount_name