Clarify the user.id definition, the field should contain a single ID.

CHANGELOG.next.md

@@ -20,6 +20,9 @@ Thanks, you're awesome :-) -->
 
 #### Improvements
 
+* Remove misleading pluralization in the description of `user.id`, it should
+  contain one ID, not many. #801
+
 #### Deprecated
 
 

docs/field-details.asciidoc

@@ -6448,7 +6448,7 @@ type: keyword
 // ===============================================================
 
 | user.id
-| Unique identifiers of the user.
+| Unique identifier of the user.
 
 type: keyword
 

generated/beats/fields.ecs.yml

@@ -358,7 +358,7 @@
       level: core
       type: keyword
       ignore_above: 1024
-      description: Unique identifiers of the user.
+      description: Unique identifier of the user.
     - name: user.name
       level: core
       type: keyword
@@ -726,7 +726,7 @@
       level: core
       type: keyword
       ignore_above: 1024
-      description: Unique identifiers of the user.
+      description: Unique identifier of the user.
     - name: user.name
       level: core
       type: keyword
@@ -1984,7 +1984,7 @@
       level: core
       type: keyword
       ignore_above: 1024
-      description: Unique identifiers of the user.
+      description: Unique identifier of the user.
     - name: user.name
       level: core
       type: keyword
@@ -3834,7 +3834,7 @@
       level: core
       type: keyword
       ignore_above: 1024
-      description: Unique identifiers of the user.
+      description: Unique identifier of the user.
     - name: user.name
       level: core
       type: keyword
@@ -4145,7 +4145,7 @@
       level: core
       type: keyword
       ignore_above: 1024
-      description: Unique identifiers of the user.
+      description: Unique identifier of the user.
     - name: user.name
       level: core
       type: keyword
@@ -4695,7 +4695,7 @@
       level: core
       type: keyword
       ignore_above: 1024
-      description: Unique identifiers of the user.
+      description: Unique identifier of the user.
     - name: name
       level: core
       type: keyword

generated/csv/fields.csv

@@ -41,7 +41,7 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description
 1.6.0-dev,true,client,client.user.group.id,keyword,extended,,,Unique identifier for the group on the system/platform.
 1.6.0-dev,true,client,client.user.group.name,keyword,extended,,,Name of the group.
 1.6.0-dev,true,client,client.user.hash,keyword,extended,,,Unique user hash to correlate information for a user in anonymized form.
-1.6.0-dev,true,client,client.user.id,keyword,core,,,Unique identifiers of the user.
+1.6.0-dev,true,client,client.user.id,keyword,core,,,Unique identifier of the user.
 1.6.0-dev,true,client,client.user.name,keyword,core,,albert,Short name or login of the user.
 1.6.0-dev,true,client,client.user.name.text,text,core,,albert,Short name or login of the user.
 1.6.0-dev,true,cloud,cloud.account.id,keyword,extended,,666777888999,The cloud account or organization id.
@@ -92,7 +92,7 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description
 1.6.0-dev,true,destination,destination.user.group.id,keyword,extended,,,Unique identifier for the group on the system/platform.
 1.6.0-dev,true,destination,destination.user.group.name,keyword,extended,,,Name of the group.
 1.6.0-dev,true,destination,destination.user.hash,keyword,extended,,,Unique user hash to correlate information for a user in anonymized form.
-1.6.0-dev,true,destination,destination.user.id,keyword,core,,,Unique identifiers of the user.
+1.6.0-dev,true,destination,destination.user.id,keyword,core,,,Unique identifier of the user.
 1.6.0-dev,true,destination,destination.user.name,keyword,core,,albert,Short name or login of the user.
 1.6.0-dev,true,destination,destination.user.name.text,text,core,,albert,Short name or login of the user.
 1.6.0-dev,true,dll,dll.code_signature.exists,boolean,core,,true,Boolean to capture if a signature is present.
@@ -245,7 +245,7 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description
 1.6.0-dev,true,host,host.user.group.id,keyword,extended,,,Unique identifier for the group on the system/platform.
 1.6.0-dev,true,host,host.user.group.name,keyword,extended,,,Name of the group.
 1.6.0-dev,true,host,host.user.hash,keyword,extended,,,Unique user hash to correlate information for a user in anonymized form.
-1.6.0-dev,true,host,host.user.id,keyword,core,,,Unique identifiers of the user.
+1.6.0-dev,true,host,host.user.id,keyword,core,,,Unique identifier of the user.
 1.6.0-dev,true,host,host.user.name,keyword,core,,albert,Short name or login of the user.
 1.6.0-dev,true,host,host.user.name.text,text,core,,albert,Short name or login of the user.
 1.6.0-dev,true,http,http.request.body.bytes,long,extended,,887,Size in bytes of the request body.
@@ -480,7 +480,7 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description
 1.6.0-dev,true,server,server.user.group.id,keyword,extended,,,Unique identifier for the group on the system/platform.
 1.6.0-dev,true,server,server.user.group.name,keyword,extended,,,Name of the group.
 1.6.0-dev,true,server,server.user.hash,keyword,extended,,,Unique user hash to correlate information for a user in anonymized form.
-1.6.0-dev,true,server,server.user.id,keyword,core,,,Unique identifiers of the user.
+1.6.0-dev,true,server,server.user.id,keyword,core,,,Unique identifier of the user.
 1.6.0-dev,true,server,server.user.name,keyword,core,,albert,Short name or login of the user.
 1.6.0-dev,true,server,server.user.name.text,text,core,,albert,Short name or login of the user.
 1.6.0-dev,true,service,service.ephemeral_id,keyword,extended,,8a4f500f,Ephemeral identifier of this service.
@@ -520,7 +520,7 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description
 1.6.0-dev,true,source,source.user.group.id,keyword,extended,,,Unique identifier for the group on the system/platform.
 1.6.0-dev,true,source,source.user.group.name,keyword,extended,,,Name of the group.
 1.6.0-dev,true,source,source.user.hash,keyword,extended,,,Unique user hash to correlate information for a user in anonymized form.
-1.6.0-dev,true,source,source.user.id,keyword,core,,,Unique identifiers of the user.
+1.6.0-dev,true,source,source.user.id,keyword,core,,,Unique identifier of the user.
 1.6.0-dev,true,source,source.user.name,keyword,core,,albert,Short name or login of the user.
 1.6.0-dev,true,source,source.user.name.text,text,core,,albert,Short name or login of the user.
 1.6.0-dev,true,threat,threat.framework,keyword,extended,,MITRE ATT&CK,Threat classification framework.
@@ -585,7 +585,7 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description
 1.6.0-dev,true,user,user.group.id,keyword,extended,,,Unique identifier for the group on the system/platform.
 1.6.0-dev,true,user,user.group.name,keyword,extended,,,Name of the group.
 1.6.0-dev,true,user,user.hash,keyword,extended,,,Unique user hash to correlate information for a user in anonymized form.
-1.6.0-dev,true,user,user.id,keyword,core,,,Unique identifiers of the user.
+1.6.0-dev,true,user,user.id,keyword,core,,,Unique identifier of the user.
 1.6.0-dev,true,user,user.name,keyword,core,,albert,Short name or login of the user.
 1.6.0-dev,true,user,user.name.text,text,core,,albert,Short name or login of the user.
 1.6.0-dev,true,user_agent,user_agent.device.name,keyword,extended,,iPhone,Name of the device.

generated/ecs/ecs_flat.yml

@@ -512,15 +512,15 @@ client.user.hash:
   type: keyword
 client.user.id:
   dashed_name: client-user-id
-  description: Unique identifiers of the user.
+  description: Unique identifier of the user.
   flat_name: client.user.id
   ignore_above: 1024
   level: core
   name: id
   normalize: []
   order: 0
   original_fieldset: user
-  short: Unique identifiers of the user.
+  short: Unique identifier of the user.
   type: keyword
 client.user.name:
   dashed_name: client-user-name
@@ -1155,15 +1155,15 @@ destination.user.hash:
   type: keyword
 destination.user.id:
   dashed_name: destination-user-id
-  description: Unique identifiers of the user.
+  description: Unique identifier of the user.
   flat_name: destination.user.id
   ignore_above: 1024
   level: core
   name: id
   normalize: []
   order: 0
   original_fieldset: user
-  short: Unique identifiers of the user.
+  short: Unique identifier of the user.
   type: keyword
 destination.user.name:
   dashed_name: destination-user-name
@@ -3620,15 +3620,15 @@ host.user.hash:
   type: keyword
 host.user.id:
   dashed_name: host-user-id
-  description: Unique identifiers of the user.
+  description: Unique identifier of the user.
   flat_name: host.user.id
   ignore_above: 1024
   level: core
   name: id
   normalize: []
   order: 0
   original_fieldset: user
-  short: Unique identifiers of the user.
+  short: Unique identifier of the user.
   type: keyword
 host.user.name:
   dashed_name: host-user-name
@@ -6630,15 +6630,15 @@ server.user.hash:
   type: keyword
 server.user.id:
   dashed_name: server-user-id
-  description: Unique identifiers of the user.
+  description: Unique identifier of the user.
   flat_name: server.user.id
   ignore_above: 1024
   level: core
   name: id
   normalize: []
   order: 0
   original_fieldset: user
-  short: Unique identifiers of the user.
+  short: Unique identifier of the user.
   type: keyword
 server.user.name:
   dashed_name: server-user-name
@@ -7165,15 +7165,15 @@ source.user.hash:
   type: keyword
 source.user.id:
   dashed_name: source-user-id
-  description: Unique identifiers of the user.
+  description: Unique identifier of the user.
   flat_name: source.user.id
   ignore_above: 1024
   level: core
   name: id
   normalize: []
   order: 0
   original_fieldset: user
-  short: Unique identifiers of the user.
+  short: Unique identifier of the user.
   type: keyword
 source.user.name:
   dashed_name: source-user-name
@@ -8052,15 +8052,15 @@ user.hash:
   type: keyword
 user.id:
   dashed_name: user-id
-  description: Unique identifiers of the user.
+  description: Unique identifier of the user.
   flat_name: user.id
   ignore_above: 1024
   level: core
   name: id
   normalize: []
   order: 0
   original_fieldset: user
-  short: Unique identifiers of the user.
+  short: Unique identifier of the user.
   type: keyword
 user.name:
   dashed_name: user-name

generated/ecs/ecs_nested.yml

@@ -624,15 +624,15 @@ client:
       type: keyword
     user.id:
       dashed_name: client-user-id
-      description: Unique identifiers of the user.
+      description: Unique identifier of the user.
       flat_name: client.user.id
       ignore_above: 1024
       level: core
       name: id
       normalize: []
       order: 0
       original_fieldset: user
-      short: Unique identifiers of the user.
+      short: Unique identifier of the user.
       type: keyword
     user.name:
       dashed_name: client-user-name
@@ -1320,15 +1320,15 @@ destination:
       type: keyword
     user.id:
       dashed_name: destination-user-id
-      description: Unique identifiers of the user.
+      description: Unique identifier of the user.
       flat_name: destination.user.id
       ignore_above: 1024
       level: core
       name: id
       normalize: []
       order: 0
       original_fieldset: user
-      short: Unique identifiers of the user.
+      short: Unique identifier of the user.
       type: keyword
     user.name:
       dashed_name: destination-user-name
@@ -3963,15 +3963,15 @@ host:
       type: keyword
     user.id:
       dashed_name: host-user-id
-      description: Unique identifiers of the user.
+      description: Unique identifier of the user.
       flat_name: host.user.id
       ignore_above: 1024
       level: core
       name: id
       normalize: []
       order: 0
       original_fieldset: user
-      short: Unique identifiers of the user.
+      short: Unique identifier of the user.
       type: keyword
     user.name:
       dashed_name: host-user-name
@@ -7176,15 +7176,15 @@ server:
       type: keyword
     user.id:
       dashed_name: server-user-id
-      description: Unique identifiers of the user.
+      description: Unique identifier of the user.
       flat_name: server.user.id
       ignore_above: 1024
       level: core
       name: id
       normalize: []
       order: 0
       original_fieldset: user
-      short: Unique identifiers of the user.
+      short: Unique identifier of the user.
       type: keyword
     user.name:
       dashed_name: server-user-name
@@ -7739,15 +7739,15 @@ source:
       type: keyword
     user.id:
       dashed_name: source-user-id
-      description: Unique identifiers of the user.
+      description: Unique identifier of the user.
       flat_name: source.user.id
       ignore_above: 1024
       level: core
       name: id
       normalize: []
       order: 0
       original_fieldset: user
-      short: Unique identifiers of the user.
+      short: Unique identifier of the user.
       type: keyword
     user.name:
       dashed_name: source-user-name
@@ -8684,14 +8684,14 @@ user:
       type: keyword
     id:
       dashed_name: user-id
-      description: Unique identifiers of the user.
+      description: Unique identifier of the user.
       flat_name: user.id
       ignore_above: 1024
       level: core
       name: id
       normalize: []
       order: 0
-      short: Unique identifiers of the user.
+      short: Unique identifier of the user.
       type: keyword
     name:
       dashed_name: user-name

schemas/user.yml

@@ -25,7 +25,7 @@
       level: core
       type: keyword
       description: >
-        Unique identifiers of the user.
+        Unique identifier of the user.
 
     - name: name
       level: core