
////
This file is generated! See _meta/fields.yml and scripts/generate_fields_docs.py
////

[[exported-fields]]
= Exported fields

[partintro]

--
This document describes the fields that are exported by Metricbeat. They are
grouped in the following categories:

* <<exported-fields-activemq>>
* <<exported-fields-aerospike>>
* <<exported-fields-airflow>>
* <<exported-fields-apache>>
* <<exported-fields-appsearch>>
* <<exported-fields-aws>>
* <<exported-fields-awsfargate>>
* <<exported-fields-azure>>
* <<exported-fields-beat-common>>
* <<exported-fields-beat>>
* <<exported-fields-ceph>>
* <<exported-fields-cloud>>
* <<exported-fields-cloudfoundry>>
* <<exported-fields-cockroachdb>>
* <<exported-fields-common>>
* <<exported-fields-consul>>
* <<exported-fields-coredns>>
* <<exported-fields-couchbase>>
* <<exported-fields-couchdb>>
* <<exported-fields-docker-processor>>
* <<exported-fields-docker>>
* <<exported-fields-dropwizard>>
* <<exported-fields-ecs>>
* <<exported-fields-elasticsearch>>
* <<exported-fields-enterprisesearch>>
* <<exported-fields-envoyproxy>>
* <<exported-fields-etcd>>
* <<exported-fields-gcp>>
* <<exported-fields-golang>>
* <<exported-fields-graphite>>
* <<exported-fields-haproxy>>
* <<exported-fields-host-processor>>
* <<exported-fields-http>>
* <<exported-fields-ibmmq>>
* <<exported-fields-iis>>
* <<exported-fields-istio>>
* <<exported-fields-jolokia>>
* <<exported-fields-jolokia-autodiscover>>
* <<exported-fields-kafka>>
* <<exported-fields-kibana>>
* <<exported-fields-kubernetes-processor>>
* <<exported-fields-kubernetes>>
* <<exported-fields-kvm>>
* <<exported-fields-linux>>
* <<exported-fields-logstash>>
* <<exported-fields-memcached>>
* <<exported-fields-mongodb>>
* <<exported-fields-mssql>>
* <<exported-fields-munin>>
* <<exported-fields-mysql>>
* <<exported-fields-nats>>
* <<exported-fields-nginx>>
* <<exported-fields-openmetrics>>
* <<exported-fields-oracle>>
* <<exported-fields-php_fpm>>
* <<exported-fields-postgresql>>
* <<exported-fields-process>>
* <<exported-fields-prometheus>>
* <<exported-fields-prometheus-xpack>>
* <<exported-fields-rabbitmq>>
* <<exported-fields-redis>>
* <<exported-fields-redisenterprise>>
* <<exported-fields-sql>>
* <<exported-fields-stan>>
* <<exported-fields-statsd>>
* <<exported-fields-syncgateway>>
* <<exported-fields-system>>
* <<exported-fields-tomcat>>
* <<exported-fields-traefik>>
* <<exported-fields-uwsgi>>
* <<exported-fields-vsphere>>
* <<exported-fields-windows>>
* <<exported-fields-zookeeper>>

--
[[exported-fields-activemq]]
== ActiveMQ fields

activemq module



[float]
=== activemq




[float]
=== broker

Broker metrics from org.apache.activemq:brokerName=*,type=Broker


*`activemq.broker.mbean`*::
+
--
Mbean that this event is related to

type: keyword

--

*`activemq.broker.name`*::
+
--
Broker name

type: keyword

--

*`activemq.broker.memory.broker.pct`*::
+
--
The percentage of the memory limit used.

type: scaled_float

format: percent

--

*`activemq.broker.memory.store.pct`*::
+
--
Percent of store limit used.

type: scaled_float

format: percent

--

*`activemq.broker.memory.temp.pct`*::
+
--
The percentage of the temp usage limit used.

type: scaled_float

format: percent

--

*`activemq.broker.connections.count`*::
+
--
Total number of connections.

type: long

--

*`activemq.broker.consumers.count`*::
+
--
Number of message consumers.

type: long

--

*`activemq.broker.messages.dequeue.count`*::
+
--
Number of messages that have been acknowledged on the broker.

type: long

--

*`activemq.broker.messages.enqueue.count`*::
+
--
Number of messages that have been sent to the destination.

type: long

--

*`activemq.broker.messages.count`*::
+
--
Number of unacknowledged messages on the broker.

type: long

--

*`activemq.broker.producers.count`*::
+
--
Number of message producers active on destinations on the broker.

type: long

--

[float]
=== queue

Queue metrics from org.apache.activemq:brokerName=*,destinationName=*,destinationType=Queue,type=Broker


*`activemq.queue.mbean`*::
+
--
Mbean that this event is related to

type: keyword

--

*`activemq.queue.name`*::
+
--
Queue name

type: keyword

--

*`activemq.queue.size`*::
+
--
Queue size

type: long

--

*`activemq.queue.messages.enqueue.time.avg`*::
+
--
Average time a message was held on this destination.

type: double

--

*`activemq.queue.messages.size.avg`*::
+
--
Average message size on this destination.

type: long

--

*`activemq.queue.consumers.count`*::
+
--
Number of consumers subscribed to this destination.

type: long

--

*`activemq.queue.messages.dequeue.count`*::
+
--
Number of messages that has been acknowledged (and removed) from the destination.

type: long

--

*`activemq.queue.messages.dispatch.count`*::
+
--
Number of messages that has been delivered to consumers, including those not acknowledged.

type: long

--

*`activemq.queue.messages.enqueue.count`*::
+
--
Number of messages that have been sent to the destination.

type: long

--

*`activemq.queue.messages.expired.count`*::
+
--
Number of messages that have been expired.

type: long

--

*`activemq.queue.messages.inflight.count`*::
+
--
Number of messages that have been dispatched to, but not acknowledged by, consumers.

type: long

--

*`activemq.queue.messages.enqueue.time.max`*::
+
--
The longest time a message was held on this destination.

type: long

--

*`activemq.queue.memory.broker.pct`*::
+
--
Percent of memory limit used.

type: scaled_float

format: percent

--

*`activemq.queue.messages.enqueue.time.min`*::
+
--
The shortest time a message was held on this destination.

type: long

--

*`activemq.queue.producers.count`*::
+
--
Number of producers attached to this destination.

type: long

--

[float]
=== topic

Topic metrics from org.apache.activemq:brokerName=*,destinationName=*,destinationType=Topic,type=Broker


*`activemq.topic.mbean`*::
+
--
Mbean that this event is related to

type: keyword

--

*`activemq.topic.name`*::
+
--
Topic name

type: keyword

--

*`activemq.topic.messages.enqueue.time.avg`*::
+
--
Average time a message was held on this destination.

type: double

--

*`activemq.topic.messages.size.avg`*::
+
--
Average message size on this destination.

type: long

--

*`activemq.topic.consumers.count`*::
+
--
Number of consumers subscribed to this destination.

type: long

--

*`activemq.topic.messages.dequeue.count`*::
+
--
Number of messages that has been acknowledged (and removed) from the destination.

type: long

--

*`activemq.topic.messages.dispatch.count`*::
+
--
Number of messages that has been delivered to consumers, including those not acknowledged.

type: long

--

*`activemq.topic.messages.enqueue.count`*::
+
--
Number of messages that have been sent to the destination.

type: long

--

*`activemq.topic.messages.expired.count`*::
+
--
Number of messages that have been expired.

type: long

--

*`activemq.topic.messages.inflight.count`*::
+
--
Number of messages that have been dispatched to, but not acknowledged by, consumers.

type: long

--

*`activemq.topic.messages.enqueue.time.max`*::
+
--
The longest time a message was held on this destination.

type: long

--

*`activemq.topic.memory.broker.pct`*::
+
--
Percent of memory limit used.

type: scaled_float

format: percent

--

*`activemq.topic.messages.enqueue.time.min`*::
+
--
The shortest time a message was held on this destination.

type: long

--

*`activemq.topic.producers.count`*::
+
--
Number of producers attached to this destination.

type: long

--

[[exported-fields-aerospike]]
== Aerospike fields

Aerospike module



[float]
=== aerospike




[float]
=== namespace

namespace



[float]
=== client

Client stats.



[float]
=== delete

Client delete transactions stats.



*`aerospike.namespace.client.delete.error`*::
+
--
Number of client delete transactions that failed with an error.


type: long

--

*`aerospike.namespace.client.delete.not_found`*::
+
--
Number of client delete transactions that resulted in a not found.


type: long

--

*`aerospike.namespace.client.delete.success`*::
+
--
Number of successful client delete transactions.


type: long

--

*`aerospike.namespace.client.delete.timeout`*::
+
--
Number of client delete transactions that timed out.


type: long

--

[float]
=== read

Client read transactions stats.



*`aerospike.namespace.client.read.error`*::
+
--
Number of client read transaction errors.


type: long

--

*`aerospike.namespace.client.read.not_found`*::
+
--
Number of client read transaction that resulted in not found.


type: long

--

*`aerospike.namespace.client.read.success`*::
+
--
Number of successful client read transactions.


type: long

--

*`aerospike.namespace.client.read.timeout`*::
+
--
Number of client read transaction that timed out.


type: long

--

[float]
=== write

Client write transactions stats.



*`aerospike.namespace.client.write.error`*::
+
--
Number of client write transactions that failed with an error.


type: long

--

*`aerospike.namespace.client.write.success`*::
+
--
Number of successful client write transactions.


type: long

--

*`aerospike.namespace.client.write.timeout`*::
+
--
Number of client write transactions that timed out.


type: long

--

[float]
=== device

Disk storage stats



*`aerospike.namespace.device.available.pct`*::
+
--
Measures the minimum contiguous disk space across all disks in a namespace.


type: scaled_float

format: percent

--

*`aerospike.namespace.device.free.pct`*::
+
--
Percentage of disk capacity free for this namespace.


type: scaled_float

format: percent

--

*`aerospike.namespace.device.total.bytes`*::
+
--
Total bytes of disk space allocated to this namespace on this node.


type: long

format: bytes

--

*`aerospike.namespace.device.used.bytes`*::
+
--
Total bytes of disk space used by this namespace on this node.


type: long

format: bytes

--

*`aerospike.namespace.hwm_breached`*::
+
--
If true, Aerospike has breached 'high-water-[disk|memory]-pct' for this namespace.


type: boolean

--

[float]
=== memory

Memory storage stats.



*`aerospike.namespace.memory.free.pct`*::
+
--
Percentage of memory capacity free for this namespace on this node.


type: scaled_float

format: percent

--

*`aerospike.namespace.memory.used.data.bytes`*::
+
--
Amount of memory occupied by data for this namespace on this node.


type: long

format: bytes

--

*`aerospike.namespace.memory.used.index.bytes`*::
+
--
Amount of memory occupied by the index for this namespace on this node.


type: long

format: bytes

--

*`aerospike.namespace.memory.used.sindex.bytes`*::
+
--
Amount of memory occupied by secondary indexes for this namespace on this node.


type: long

format: bytes

--

*`aerospike.namespace.memory.used.total.bytes`*::
+
--
Total bytes of memory used by this namespace on this node.


type: long

format: bytes

--

*`aerospike.namespace.name`*::
+
--
Namespace name


type: keyword

--

*`aerospike.namespace.node.host`*::
+
--
Node host


type: keyword

--

*`aerospike.namespace.node.name`*::
+
--
Node name


type: keyword

--

[float]
=== objects

Records stats.



*`aerospike.namespace.objects.master`*::
+
--
Number of records on this node which are active masters.


type: long

--

*`aerospike.namespace.objects.total`*::
+
--
Number of records in this namespace for this node.


type: long

--

*`aerospike.namespace.stop_writes`*::
+
--
If true this namespace is currently not allowing writes.


type: boolean

--

[[exported-fields-airflow]]
== Airflow fields

Airflow module




*`airflow.*.1m_rate`*::
+
--
Airflow 1m rate timers metric


type: object

--

*`airflow.*.5m_rate`*::
+
--
Airflow 5m rate timers metric


type: object

--

*`airflow.*.15m_rate`*::
+
--
Airflow 15 rate timers metric


type: object

--

*`airflow.*.count`*::
+
--
Airflow counters


type: object

--

*`airflow.*.max`*::
+
--
Airflow max timers metric


type: object

--

*`airflow.*.mean_rate`*::
+
--
Airflow mean rate timers metric


type: object

--

*`airflow.*.mean`*::
+
--
Airflow mean timers metric


type: object

--

*`airflow.*.median`*::
+
--
Airflow median timers metric


type: object

--

*`airflow.*.min`*::
+
--
Airflow min timers metric


type: object

--

*`airflow.*.p75`*::
+
--
Airflow 75 percentile timers metric


type: object

--

*`airflow.*.p95`*::
+
--
Airflow 95 percentile timers metric


type: object

--

*`airflow.*.p99_9`*::
+
--
Airflow 99.9 percentile timers metric


type: object

--

*`airflow.*.p99`*::
+
--
Airflow 99 percentile timers metric


type: object

--

*`airflow.*.stddev`*::
+
--
Airflow standard deviation timers metric


type: object

--

*`airflow.*.value`*::
+
--
Airflow gauges


type: object

--

*`airflow.dag_file`*::
+
--
Airflow dag file metadata


type: keyword

--

*`airflow.dag_id`*::
+
--
Airflow dag id metadata


type: keyword

--

*`airflow.job_name`*::
+
--
Airflow job name metadata


type: keyword

--

*`airflow.operator_name`*::
+
--
Airflow operator name metadata


type: keyword

--

*`airflow.pool_name`*::
+
--
Airflow pool name metadata


type: keyword

--

*`airflow.status`*::
+
--
Airflow status metadata


type: keyword

--

*`airflow.task_id`*::
+
--
Airflow task id metadata


type: keyword

--

[[exported-fields-apache]]
== Apache fields

Apache HTTPD server metricsets collected from the Apache web server.



[float]
=== apache

`apache` contains the metrics that were scraped from Apache.



[float]
=== status

`status` contains the metrics that were scraped from the Apache status page.



*`apache.status.hostname`*::
+
--
Apache hostname.


type: keyword

--

*`apache.status.total_accesses`*::
+
--
Total number of access requests.


type: long

--

*`apache.status.total_kbytes`*::
+
--
Total number of kilobytes served.


type: long

--

*`apache.status.requests_per_sec`*::
+
--
Requests per second.


type: scaled_float

--

*`apache.status.bytes_per_sec`*::
+
--
Bytes per second.


type: scaled_float

--

*`apache.status.bytes_per_request`*::
+
--
Bytes per request.


type: scaled_float

--

*`apache.status.workers.busy`*::
+
--
Number of busy workers.


type: long

--

*`apache.status.workers.idle`*::
+
--
Number of idle workers.


type: long

--

[float]
=== uptime

Uptime stats.



*`apache.status.uptime.server_uptime`*::
+
--
Server uptime in seconds.


type: long

--

*`apache.status.uptime.uptime`*::
+
--
Server uptime.


type: long

--

[float]
=== cpu

CPU stats.



*`apache.status.cpu.load`*::
+
--
CPU Load.


type: scaled_float

--

*`apache.status.cpu.user`*::
+
--
CPU user load.


type: scaled_float

--

*`apache.status.cpu.system`*::
+
--
System cpu.


type: scaled_float

--

*`apache.status.cpu.children_user`*::
+
--
CPU of children user.


type: scaled_float

--

*`apache.status.cpu.children_system`*::
+
--
CPU of children system.


type: scaled_float

--

[float]
=== connections

Connection stats.



*`apache.status.connections.total`*::
+
--
Total connections.


type: long

--

*`apache.status.connections.async.writing`*::
+
--
Async connection writing.


type: long

--

*`apache.status.connections.async.keep_alive`*::
+
--
Async keeped alive connections.


type: long

--

*`apache.status.connections.async.closing`*::
+
--
Async closed connections.


type: long

--

[float]
=== load

Load averages.



*`apache.status.load.1`*::
+
--
Load average for the last minute.


type: scaled_float

--

*`apache.status.load.5`*::
+
--
Load average for the last 5 minutes.


type: scaled_float

--

*`apache.status.load.15`*::
+
--
Load average for the last 15 minutes.


type: scaled_float

--

[float]
=== scoreboard

Scoreboard metrics.



*`apache.status.scoreboard.starting_up`*::
+
--
Starting up.


type: long

--

*`apache.status.scoreboard.reading_request`*::
+
--
Reading requests.


type: long

--

*`apache.status.scoreboard.sending_reply`*::
+
--
Sending Reply.


type: long

--

*`apache.status.scoreboard.keepalive`*::
+
--
Keep alive.


type: long

--

*`apache.status.scoreboard.dns_lookup`*::
+
--
Dns Lookups.


type: long

--

*`apache.status.scoreboard.closing_connection`*::
+
--
Closing connections.


type: long

--

*`apache.status.scoreboard.logging`*::
+
--
Logging


type: long

--

*`apache.status.scoreboard.gracefully_finishing`*::
+
--
Gracefully finishing.


type: long

--

*`apache.status.scoreboard.idle_cleanup`*::
+
--
Idle cleanups.


type: long

--

*`apache.status.scoreboard.open_slot`*::
+
--
Open slots.


type: long

--

*`apache.status.scoreboard.waiting_for_connection`*::
+
--
Waiting for connections.


type: long

--

*`apache.status.scoreboard.total`*::
+
--
Total.


type: long

--

[[exported-fields-appsearch]]
== App Search fields

App Search module



[float]
=== appsearch




[float]
=== stats

App Search stats



[float]
=== jvm

JVM stats



[float]
=== memory_usage

Memory usage



*`appsearch.stats.jvm.memory_usage.heap_init.bytes`*::
+
--
Heap init used by the JVM in bytes.


type: long

--

*`appsearch.stats.jvm.memory_usage.heap_used.bytes`*::
+
--
Heap used by the JVM in bytes.


type: long

--

*`appsearch.stats.jvm.memory_usage.heap_committed.bytes`*::
+
--
Committed heap to the JVM in bytes.


type: long

--

*`appsearch.stats.jvm.memory_usage.heap_max.bytes`*::
+
--
Max heap used by the JVM in bytes


type: long

--

*`appsearch.stats.jvm.memory_usage.non_heap_init.bytes`*::
+
--
Non-Heap initial memory used by the JVM in bytes.


type: long

--

*`appsearch.stats.jvm.memory_usage.non_heap_committed.bytes`*::
+
--
Non-Heap committed memory used by the JVM in bytes.


type: long

--

[float]
=== queues

Worker queues



*`appsearch.stats.queues.analytics_events.count`*::
+
--
Number of pending jobs in the `analytics_events` queue.


type: long

--

*`appsearch.stats.queues.document_destroyer.count`*::
+
--
Number of pending jobs in the `document_destroyer` queue.


type: long

--

*`appsearch.stats.queues.engine_destroyer.count`*::
+
--
Number of pending jobs in the `engine_destroyer` queue.


type: long

--

*`appsearch.stats.queues.index_adder.count`*::
+
--
Number of pending jobs in the `index_adder` queue.


type: long

--

*`appsearch.stats.queues.indexed_doc_remover.count`*::
+
--
Number of pending jobs in the `indexed_doc_remover` queue.


type: long

--

*`appsearch.stats.queues.mailer.count`*::
+
--
Number of pending jobs in the `mailer` queue.


type: long

--

*`appsearch.stats.queues.refresh_document_counts.count`*::
+
--
Number of pending jobs in the `refresh_document_counts` queue.


type: long

--

*`appsearch.stats.queues.reindexer.count`*::
+
--
Number of pending jobs in the `reindexer` queue.


type: long

--

*`appsearch.stats.queues.schema_updater.count`*::
+
--
Number of pending jobs in the `schema_updater` queue.


type: long

--

*`appsearch.stats.queues.failed.count`*::
+
--
Number of failed jobs waiting to be retried.


type: long

--

[float]
=== requests

Request metrics



*`appsearch.stats.requests.count`*::
+
--
Number of recently completed requests


type: long

--

[float]
=== api.duration

API response time metrics



*`appsearch.stats.requests.api.duration.avg.ms`*::
+
--
Average response time in milliseconds


type: long

--

*`appsearch.stats.requests.api.duration.max.ms`*::
+
--
Max response time in milliseconds


type: long

--

[float]
=== web.response_time

Dashboard response time metrics



*`appsearch.stats.requests.web.response_time.avg.ms`*::
+
--
Average response time in milliseconds


type: long

--

*`appsearch.stats.requests.web.response_time.max.ms`*::
+
--
Max response time in milliseconds


type: long

--

[[exported-fields-aws]]
== AWS fields

`aws` module collects AWS monitoring metrics from AWS Cloudwatch.



[float]
=== aws




*`aws.tags.*`*::
+
--
Tag key value pairs from aws resources.


type: object

--

*`aws.s3.bucket.name`*::
+
--
Name of a S3 bucket.


type: keyword

--

*`aws.dimensions.*`*::
+
--
Metric dimensions.


type: object

--

*`aws.*.metrics.*.*`*::
+
--
Metrics that returned from Cloudwatch API query.


type: object

--


*`aws.linked_account.id`*::
+
--
ID used to identify linked account.


type: keyword

--

*`aws.linked_account.name`*::
+
--
Name or alias used to identify linked account.


type: keyword

--

[float]
=== billing

`billing` contains the estimated charges for your AWS account in Cloudwatch.



*`aws.billing.EstimatedCharges`*::
+
--
Maximum estimated charges for AWS acccount.

type: long

--

*`aws.billing.Currency`*::
+
--
Estimated charges currency unit.

type: keyword

--

*`aws.billing.ServiceName`*::
+
--
Service name for the maximum estimated charges.

type: keyword

--


*`aws.billing.AmortizedCost.amount`*::
+
--
Amortized cost amount

type: double

--

*`aws.billing.AmortizedCost.unit`*::
+
--
Amortized cost unit

type: keyword

--


*`aws.billing.BlendedCost.amount`*::
+
--
Blended cost amount

type: double

--

*`aws.billing.BlendedCost.unit`*::
+
--
Blended cost unit

type: keyword

--


*`aws.billing.NormalizedUsageAmount.amount`*::
+
--
Normalized usage amount

type: double

--

*`aws.billing.NormalizedUsageAmount.unit`*::
+
--
Normalized usage amount unit

type: keyword

--


*`aws.billing.UnblendedCost.amount`*::
+
--
Unblended cost amount

type: double

--

*`aws.billing.UnblendedCost.unit`*::
+
--
Unblended cost unit

type: keyword

--


*`aws.billing.UsageQuantity.amount`*::
+
--
Usage quantity amount

type: double

--

*`aws.billing.UsageQuantity.unit`*::
+
--
Usage quantity unit

type: keyword

--

*`aws.billing.start_date`*::
+
--
Start date for retrieving AWS costs

type: keyword

--

*`aws.billing.end_date`*::
+
--
End date for retrieving AWS costs

type: keyword

--


*`aws.billing.group_definition.key`*::
+
--
The string that represents a key for a specified group

type: keyword

--

*`aws.billing.group_definition.type`*::
+
--
The string that represents the type of group

type: keyword

--

*`aws.billing.group_by.*`*::
+
--
Cost explorer group by key values


type: object

--

[float]
=== cloudwatch

`cloudwatch` contains the metrics that were scraped from AWS CloudWatch which contains monitoring metrics sent by different namespaces.



*`aws.cloudwatch.namespace`*::
+
--
The namespace specified when query cloudwatch api.


type: keyword

--

[float]
=== dynamodb

`dynamodb` contains the metrics that were scraped from AWS CloudWatch which contains monitoring metrics sent by AWS DynamoDB.




*`aws.dynamodb.metrics.SuccessfulRequestLatency.avg`*::
+
--
The average latency of successful requests to DynamoDB or Amazon DynamoDB Streams during the specified time period.


type: double

--

*`aws.dynamodb.metrics.SuccessfulRequestLatency.max`*::
+
--
The maximum latency of successful requests to DynamoDB or Amazon DynamoDB Streams during the specified time period.


type: double

--

*`aws.dynamodb.metrics.OnlineIndexPercentageProgress.avg`*::
+
--
The percentage of completion when a new global secondary index is being added to a table.


type: double

--

*`aws.dynamodb.metrics.ProvisionedWriteCapacityUnits.avg`*::
+
--
The number of provisioned write capacity units for a table or a global secondary index.


type: double

--

*`aws.dynamodb.metrics.ProvisionedReadCapacityUnits.avg`*::
+
--
The number of provisioned read capacity units for a table or a global secondary index.


type: double

--

*`aws.dynamodb.metrics.ConsumedReadCapacityUnits.avg`*::
+
--
The average number of read capacity units consumed over the specified time period, so you can track how much of your provisioned throughput is used.


type: double

--

*`aws.dynamodb.metrics.ConsumedReadCapacityUnits.sum`*::
+
--
The sum of read capacity units consumed over the specified time period, so you can track how much of your provisioned throughput is used.


type: long

--

*`aws.dynamodb.metrics.ConsumedWriteCapacityUnits.avg`*::
+
--
The average number of write capacity units consumed over the specified time period, so you can track how much of your provisioned throughput is used.


type: double

--

*`aws.dynamodb.metrics.ConsumedWriteCapacityUnits.sum`*::
+
--
The sum of write capacity units consumed over the specified time period, so you can track how much of your provisioned throughput is used.


type: long

--

*`aws.dynamodb.metrics.ReplicationLatency.avg`*::
+
--
The average elapsed time between an updated item appearing in the DynamoDB stream for one replica table, and that item appearing in another replica in the global table.


type: double

--

*`aws.dynamodb.metrics.ReplicationLatency.max`*::
+
--
The maximum elapsed time between an updated item appearing in the DynamoDB stream for one replica table, and that item appearing in another replica in the global table.


type: double

--

*`aws.dynamodb.metrics.TransactionConflict.avg`*::
+
--
Average rejected item-level requests due to transactional conflicts between concurrent requests on the same items.


type: double

--

*`aws.dynamodb.metrics.TransactionConflict.sum`*::
+
--
Total rejected item-level requests due to transactional conflicts between concurrent requests on the same items.


type: long

--

*`aws.dynamodb.metrics.AccountProvisionedReadCapacityUtilization.avg`*::
+
--
The average percentage of provisioned read capacity units utilized by the account.


type: double

--

*`aws.dynamodb.metrics.AccountProvisionedWriteCapacityUtilization.avg`*::
+
--
The average percentage of provisioned write capacity units utilized by the account.


type: double

--

*`aws.dynamodb.metrics.SystemErrors.sum`*::
+
--
The requests to DynamoDB or Amazon DynamoDB Streams that generate an HTTP 500 status code during the specified time period.


type: long

--

*`aws.dynamodb.metrics.ConditionalCheckFailedRequests.sum`*::
+
--
The number of failed attempts to perform conditional writes.


type: long

--

*`aws.dynamodb.metrics.PendingReplicationCount.sum`*::
+
--
The number of item updates that are written to one replica table, but that have not yet been written to another replica in the global table.


type: long

--

*`aws.dynamodb.metrics.ReadThrottleEvents.sum`*::
+
--
Requests to DynamoDB that exceed the provisioned read capacity units for a table or a global secondary index.


type: long

--

*`aws.dynamodb.metrics.ThrottledRequests.sum`*::
+
--
Requests to DynamoDB that exceed the provisioned throughput limits on a resource (such as a table or an index).


type: long

--

*`aws.dynamodb.metrics.WriteThrottleEvents.sum`*::
+
--
Requests to DynamoDB that exceed the provisioned write capacity units for a table or a global secondary index.


type: long

--

*`aws.dynamodb.metrics.AccountMaxReads.max`*::
+
--
The maximum number of read capacity units that can be used by an account. This limit does not apply to on-demand tables or global secondary indexes.


type: long

--

*`aws.dynamodb.metrics.AccountMaxTableLevelReads.max`*::
+
--
The maximum number of read capacity units that can be used by a table or global secondary index of an account. For on-demand tables this limit caps the maximum read request units a table or a global secondary index can use.


type: long

--

*`aws.dynamodb.metrics.AccountMaxTableLevelWrites.max`*::
+
--
The maximum number of write capacity units that can be used by a table or global secondary index of an account. For on-demand tables this limit caps the maximum write request units a table or a global secondary index can use.


type: long

--

*`aws.dynamodb.metrics.AccountMaxWrites.max`*::
+
--
The maximum number of write capacity units that can be used by an account. This limit does not apply to on-demand tables or global secondary indexes.


type: long

--

*`aws.dynamodb.metrics.MaxProvisionedTableReadCapacityUtilization.max`*::
+
--
The percentage of provisioned read capacity units utilized by the highest provisioned read table or global secondary index of an account.


type: double

--

*`aws.dynamodb.metrics.MaxProvisionedTableWriteCapacityUtilization.max`*::
+
--
The percentage of provisioned write capacity utilized by the highest provisioned write table or global secondary index of an account.


type: double

--

[float]
=== ebs

`ebs` contains the metrics that were scraped from AWS CloudWatch which contains monitoring metrics sent by AWS EBS.




*`aws.ebs.metrics.VolumeReadBytes.avg`*::
+
--
Average size of each read operation during the period, except on volumes attached to a Nitro-based instance, where the average represents the average over the specified period.

type: double

--

*`aws.ebs.metrics.VolumeWriteBytes.avg`*::
+
--
Average size of each write operation during the period, except on volumes attached to a Nitro-based instance, where the average represents the average over the specified period.

type: double

--

*`aws.ebs.metrics.VolumeReadOps.avg`*::
+
--
The total number of read operations in a specified period of time.

type: double

--

*`aws.ebs.metrics.VolumeWriteOps.avg`*::
+
--
The total number of write operations in a specified period of time.

type: double

--

*`aws.ebs.metrics.VolumeQueueLength.avg`*::
+
--
The number of read and write operation requests waiting to be completed in a specified period of time.

type: double

--

*`aws.ebs.metrics.VolumeThroughputPercentage.avg`*::
+
--
The percentage of I/O operations per second (IOPS) delivered of the total IOPS provisioned for an Amazon EBS volume. Used with Provisioned IOPS SSD volumes only.

type: double

--

*`aws.ebs.metrics.VolumeConsumedReadWriteOps.avg`*::
+
--
The total amount of read and write operations (normalized to 256K capacity units) consumed in a specified period of time. Used with Provisioned IOPS SSD volumes only.

type: double

--

*`aws.ebs.metrics.BurstBalance.avg`*::
+
--
Used with General Purpose SSD (gp2), Throughput Optimized HDD (st1), and Cold HDD (sc1) volumes only. Provides information about the percentage of I/O credits (for gp2) or throughput credits (for st1 and sc1) remaining in the burst bucket.

type: double

--

*`aws.ebs.metrics.VolumeTotalReadTime.sum`*::
+
--
The total number of seconds spent by all read operations that completed in a specified period of time.

type: double

--

*`aws.ebs.metrics.VolumeTotalWriteTime.sum`*::
+
--
The total number of seconds spent by all write operations that completed in a specified period of time.

type: double

--

*`aws.ebs.metrics.VolumeIdleTime.sum`*::
+
--
The total number of seconds in a specified period of time when no read or write operations were submitted.

type: double

--

[float]
=== ec2

`ec2` contains the metrics that were scraped from AWS CloudWatch which contains monitoring metrics sent by AWS EC2.



*`aws.ec2.cpu.total.pct`*::
+
--
The percentage of allocated EC2 compute units that are currently in use on the instance.


type: scaled_float

--

*`aws.ec2.cpu.credit_usage`*::
+
--
The number of CPU credits spent by the instance for CPU utilization.


type: long

--

*`aws.ec2.cpu.credit_balance`*::
+
--
The number of earned CPU credits that an instance has accrued since it was launched or started.


type: long

--

*`aws.ec2.cpu.surplus_credit_balance`*::
+
--
The number of surplus credits that have been spent by an unlimited instance when its CPUCreditBalance value is zero.


type: long

--

*`aws.ec2.cpu.surplus_credits_charged`*::
+
--
The number of spent surplus credits that are not paid down by earned CPU credits, and which thus incur an additional charge.


type: long

--

*`aws.ec2.network.in.packets`*::
+
--
The total number of packets received on all network interfaces by the instance in collection period.


type: long

--

*`aws.ec2.network.in.packets_per_sec`*::
+
--
The number of packets per second sent out on all network interfaces by the instance.


type: scaled_float

--

*`aws.ec2.network.out.packets`*::
+
--
The total number of packets sent out on all network interfaces by the instance in collection period.


type: long

--

*`aws.ec2.network.out.packets_per_sec`*::
+
--
The number of packets per second sent out on all network interfaces by the instance.


type: scaled_float

--

*`aws.ec2.network.in.bytes`*::
+
--
The total number of bytes received on all network interfaces by the instance in collection period.


type: long

format: bytes

--

*`aws.ec2.network.in.bytes_per_sec`*::
+
--
The number of bytes per second received on all network interfaces by the instance.


type: scaled_float

--

*`aws.ec2.network.out.bytes`*::
+
--
The total number of bytes sent out on all network interfaces by the instance in collection period.


type: long

format: bytes

--

*`aws.ec2.network.out.bytes_per_sec`*::
+
--
The number of bytes per second sent out on all network interfaces by the instance.


type: scaled_float

--

*`aws.ec2.diskio.read.bytes`*::
+
--
Total bytes read from all instance store volumes available to the instance in collection period.


type: long

format: bytes

--

*`aws.ec2.diskio.read.bytes_per_sec`*::
+
--
Bytes read per second from all instance store volumes available to the instance.


type: scaled_float

--

*`aws.ec2.diskio.write.bytes`*::
+
--
Total bytes written to all instance store volumes available to the instance in collection period.


type: long

format: bytes

--

*`aws.ec2.diskio.write.bytes_per_sec`*::
+
--
Bytes written per second to all instance store volumes available to the instance.


type: scaled_float

--

*`aws.ec2.diskio.read.count`*::
+
--
Total completed read operations from all instance store volumes available to the instance in collection period.


type: long

--

*`aws.ec2.diskio.read.count_per_sec`*::
+
--
Completed read operations per second from all instance store volumes available to the instance in a specified period of time.


type: long

--

*`aws.ec2.diskio.write.count`*::
+
--
Total completed write operations to all instance store volumes available to the instance in collection period.


type: long

--

*`aws.ec2.diskio.write.count_per_sec`*::
+
--
Completed write operations per second to all instance store volumes available to the instance in a specified period of time.


type: long

--

*`aws.ec2.status.check_failed`*::
+
--
Reports whether the instance has passed both the instance status check and the system status check in the last minute.


type: long

--

*`aws.ec2.status.check_failed_system`*::
+
--
Reports whether the instance has passed the system status check in the last minute.


type: long

--

*`aws.ec2.status.check_failed_instance`*::
+
--
Reports whether the instance has passed the instance status check in the last minute.


type: long

--

*`aws.ec2.instance.core.count`*::
+
--
The number of CPU cores for the instance.


type: integer

--

*`aws.ec2.instance.image.id`*::
+
--
The ID of the image used to launch the instance.


type: keyword

--

*`aws.ec2.instance.monitoring.state`*::
+
--
Indicates whether detailed monitoring is enabled.


type: keyword

--

*`aws.ec2.instance.private.dns_name`*::
+
--
The private DNS name of the network interface.


type: keyword

--

*`aws.ec2.instance.private.ip`*::
+
--
The private IPv4 address associated with the network interface.


type: ip

--

*`aws.ec2.instance.public.dns_name`*::
+
--
The public DNS name of the instance.


type: keyword

--

*`aws.ec2.instance.public.ip`*::
+
--
The address of the Elastic IP address (IPv4) bound to the network interface.


type: ip

--

*`aws.ec2.instance.state.code`*::
+
--
The state of the instance, as a 16-bit unsigned integer.


type: integer

--

*`aws.ec2.instance.state.name`*::
+
--
The state of the instance (pending | running | shutting-down | terminated | stopping | stopped).


type: keyword

--

*`aws.ec2.instance.threads_per_core`*::
+
--
The number of threads per CPU core.


type: integer

--

[float]
=== elb

`elb` contains the metrics that were scraped from AWS CloudWatch which contains monitoring metrics sent by AWS ELB.




*`aws.elb.metrics.BackendConnectionErrors.sum`*::
+
--
The number of connections that were not successfully established between the load balancer and the registered instances.

type: long

--

*`aws.elb.metrics.HTTPCode_Backend_2XX.sum`*::
+
--
The number of HTTP 2XX response code generated by registered instances.

type: long

--

*`aws.elb.metrics.HTTPCode_Backend_3XX.sum`*::
+
--
The number of HTTP 3XX response code generated by registered instances.

type: long

--

*`aws.elb.metrics.HTTPCode_Backend_4XX.sum`*::
+
--
The number of HTTP 4XX response code generated by registered instances.

type: long

--

*`aws.elb.metrics.HTTPCode_Backend_5XX.sum`*::
+
--
The number of HTTP 5XX response code generated by registered instances.

type: long

--

*`aws.elb.metrics.HTTPCode_ELB_4XX.sum`*::
+
--
The number of HTTP 4XX client error codes generated by the load balancer.

type: long

--

*`aws.elb.metrics.HTTPCode_ELB_5XX.sum`*::
+
--
The number of HTTP 5XX server error codes generated by the load balancer.

type: long

--

*`aws.elb.metrics.RequestCount.sum`*::
+
--
The number of requests completed or connections made during the specified interval.

type: long

--

*`aws.elb.metrics.SpilloverCount.sum`*::
+
--
The total number of requests that were rejected because the surge queue is full.

type: long

--

*`aws.elb.metrics.HealthyHostCount.max`*::
+
--
The number of healthy instances registered with your load balancer.

type: long

--

*`aws.elb.metrics.SurgeQueueLength.max`*::
+
--
The total number of requests (HTTP listener) or connections (TCP listener) that are pending routing to a healthy instance.

type: long

--

*`aws.elb.metrics.UnHealthyHostCount.max`*::
+
--
The number of unhealthy instances registered with your load balancer.

type: long

--

*`aws.elb.metrics.Latency.avg`*::
+
--
The total time elapsed, in seconds, from the time the load balancer sent the request to a registered instance until the instance started to send the response headers.

type: double

--

*`aws.elb.metrics.EstimatedALBActiveConnectionCount.avg`*::
+
--
The estimated number of concurrent TCP connections active from clients to the load balancer and from the load balancer to targets.

type: double

--

*`aws.elb.metrics.EstimatedALBConsumedLCUs.avg`*::
+
--
The estimated number of load balancer capacity units (LCU) used by an Application Load Balancer.

type: double

--

*`aws.elb.metrics.EstimatedALBNewConnectionCount.avg`*::
+
--
The estimated number of new TCP connections established from clients to the load balancer and from the load balancer to targets.

type: double

--

*`aws.elb.metrics.EstimatedProcessedBytes.avg`*::
+
--
The estimated number of bytes processed by an Application Load Balancer.

type: double

--

[float]
=== applicationelb

`applicationelb` contains the metrics that were scraped from AWS CloudWatch which contains monitoring metrics sent by AWS ApplicationELB.




*`aws.applicationelb.metrics.ActiveConnectionCount.sum`*::
+
--
The total number of concurrent TCP connections active from clients to the load balancer and from the load balancer to targets.

type: long

--

*`aws.applicationelb.metrics.ClientTLSNegotiationErrorCount.sum`*::
+
--
The number of TLS connections initiated by the client that did not establish a session with the load balancer due to a TLS error.

type: long

--

*`aws.applicationelb.metrics.HTTP_Fixed_Response_Count.sum`*::
+
--
The number of fixed-response actions that were successful.

type: long

--

*`aws.applicationelb.metrics.HTTP_Redirect_Count.sum`*::
+
--
The number of redirect actions that were successful.

type: long

--

*`aws.applicationelb.metrics.HTTP_Redirect_Url_Limit_Exceeded_Count.sum`*::
+
--
The number of redirect actions that couldn't be completed because the URL in the response location header is larger than 8K.

type: long

--

*`aws.applicationelb.metrics.HTTPCode_ELB_3XX_Count.sum`*::
+
--
The number of HTTP 3XX redirection codes that originate from the load balancer.

type: long

--

*`aws.applicationelb.metrics.HTTPCode_ELB_4XX_Count.sum`*::
+
--
The number of HTTP 4XX client error codes that originate from the load balancer.

type: long

--

*`aws.applicationelb.metrics.HTTPCode_ELB_5XX_Count.sum`*::
+
--
The number of HTTP 5XX server error codes that originate from the load balancer.

type: long

--

*`aws.applicationelb.metrics.HTTPCode_ELB_500_Count.sum`*::
+
--
The number of HTTP 500 error codes that originate from the load balancer.

type: long

--

*`aws.applicationelb.metrics.HTTPCode_ELB_502_Count.sum`*::
+
--
The number of HTTP 502 error codes that originate from the load balancer.

type: long

--

*`aws.applicationelb.metrics.HTTPCode_ELB_503_Count.sum`*::
+
--
The number of HTTP 503 error codes that originate from the load balancer.

type: long

--

*`aws.applicationelb.metrics.HTTPCode_ELB_504_Count.sum`*::
+
--
The number of HTTP 504 error codes that originate from the load balancer.

type: long

--

*`aws.applicationelb.metrics.IPv6ProcessedBytes.sum`*::
+
--
The total number of bytes processed by the load balancer over IPv6.

type: long

--

*`aws.applicationelb.metrics.IPv6RequestCount.sum`*::
+
--
The number of IPv6 requests received by the load balancer.

type: long

--

*`aws.applicationelb.metrics.NewConnectionCount.sum`*::
+
--
The total number of new TCP connections established from clients to the load balancer and from the load balancer to targets.

type: long

--

*`aws.applicationelb.metrics.ProcessedBytes.sum`*::
+
--
The total number of bytes processed by the load balancer over IPv4 and IPv6.

type: long

--

*`aws.applicationelb.metrics.RejectedConnectionCount.sum`*::
+
--
The number of connections that were rejected because the load balancer had reached its maximum number of connections.

type: long

--

*`aws.applicationelb.metrics.RequestCount.sum`*::
+
--
The number of requests processed over IPv4 and IPv6.

type: long

--

*`aws.applicationelb.metrics.RuleEvaluations.sum`*::
+
--
The number of rules processed by the load balancer given a request rate averaged over an hour.

type: long

--

*`aws.applicationelb.metrics.ConsumedLCUs.avg`*::
+
--
The number of load balancer capacity units (LCU) used by your load balancer.

type: double

--

*`aws.applicationelb.metrics.HealthyHostCount.max`*::
+
--
The number of targets that are considered healthy.

type: long

--

*`aws.applicationelb.metrics.UnHealthyHostCount.max`*::
+
--
The number of targets that are considered unhealthy.

type: long

--

[float]
=== networkelb

`networkelb` contains the metrics that were scraped from AWS CloudWatch which contains monitoring metrics sent by AWS NetworkELB.




*`aws.networkelb.metrics.ActiveFlowCount.avg`*::
+
--
The total number of concurrent flows (or connections) from clients to targets.

type: double

--

*`aws.networkelb.metrics.ActiveFlowCount_TCP.avg`*::
+
--
The total number of concurrent TCP flows (or connections) from clients to targets.

type: double

--

*`aws.networkelb.metrics.ActiveFlowCount_TLS.avg`*::
+
--
The total number of concurrent TLS flows (or connections) from clients to targets.

type: double

--

*`aws.networkelb.metrics.ActiveFlowCount_UDP.avg`*::
+
--
The total number of concurrent UDP flows (or connections) from clients to targets.

type: double

--

*`aws.networkelb.metrics.ConsumedLCUs.avg`*::
+
--
The number of load balancer capacity units (LCU) used by your load balancer.

type: double

--

*`aws.networkelb.metrics.ClientTLSNegotiationErrorCount.sum`*::
+
--
The total number of TLS handshakes that failed during negotiation between a client and a TLS listener.

type: long

--

*`aws.networkelb.metrics.NewFlowCount.sum`*::
+
--
The total number of new flows (or connections) established from clients to targets in the time period.

type: long

--

*`aws.networkelb.metrics.NewFlowCount_TLS.sum`*::
+
--
The total number of new TLS flows (or connections) established from clients to targets in the time period.

type: long

--

*`aws.networkelb.metrics.ProcessedBytes.sum`*::
+
--
The total number of bytes processed by the load balancer, including TCP/IP headers.

type: long

--

*`aws.networkelb.metrics.ProcessedBytes_TLS.sum`*::
+
--
The total number of bytes processed by TLS listeners.

type: long

--

*`aws.networkelb.metrics.TargetTLSNegotiationErrorCount.sum`*::
+
--
The total number of TLS handshakes that failed during negotiation between a TLS listener and a target.

type: long

--

*`aws.networkelb.metrics.TCP_Client_Reset_Count.sum`*::
+
--
The total number of reset (RST) packets sent from a client to a target.

type: long

--

*`aws.networkelb.metrics.TCP_ELB_Reset_Count.sum`*::
+
--
The total number of reset (RST) packets generated by the load balancer.

type: long

--

*`aws.networkelb.metrics.TCP_Target_Reset_Count.sum`*::
+
--
The total number of reset (RST) packets sent from a target to a client.

type: long

--

*`aws.networkelb.metrics.HealthyHostCount.max`*::
+
--
The number of targets that are considered healthy.

type: long

--

*`aws.networkelb.metrics.UnHealthyHostCount.max`*::
+
--
The number of targets that are considered unhealthy.

type: long

--

[float]
=== kinesis

`kinesis` contains the metrics that were scraped from AWS CloudWatch which contains monitoring metrics sent by Amazon Kinesis.




*`aws.kinesis.metrics.GetRecords_Bytes.avg`*::
+
--
The average number of bytes retrieved from the Kinesis stream, measured over the specified time period.


type: double

--

*`aws.kinesis.metrics.GetRecords_IteratorAgeMilliseconds.avg`*::
+
--
The age of the last record in all GetRecords calls made against a Kinesis stream, measured over the specified time period. Age is the difference between the current time and when the last record of the GetRecords call was written to the stream.


type: double

--

*`aws.kinesis.metrics.GetRecords_Latency.avg`*::
+
--
The time taken per GetRecords operation, measured over the specified time period.


type: double

--

*`aws.kinesis.metrics.GetRecords_Records.sum`*::
+
--
The number of records retrieved from the shard, measured over the specified time period.


type: long

--

*`aws.kinesis.metrics.GetRecords_Success.sum`*::
+
--
The number of successful GetRecords operations per stream, measured over the specified time period.


type: long

--

*`aws.kinesis.metrics.IncomingBytes.avg`*::
+
--
The number of bytes successfully put to the Kinesis stream over the specified time period. This metric includes bytes from PutRecord and PutRecords operations.


type: double

--

*`aws.kinesis.metrics.IncomingRecords.avg`*::
+
--
The number of records successfully put to the Kinesis stream over the specified time period. This metric includes record counts from PutRecord and PutRecords operations.


type: double

--

*`aws.kinesis.metrics.PutRecord_Bytes.avg`*::
+
--
The number of bytes put to the Kinesis stream using the PutRecord operation over the specified time period.


type: double

--

*`aws.kinesis.metrics.PutRecord_Latency.avg`*::
+
--
The time taken per PutRecord operation, measured over the specified time period.


type: double

--

*`aws.kinesis.metrics.PutRecord_Success.avg`*::
+
--
The percentage of successful writes to a Kinesis stream, measured over the specified time period.


type: double

--

*`aws.kinesis.metrics.PutRecords_Bytes.avg`*::
+
--
The average number of bytes put to the Kinesis stream using the PutRecords operation over the specified time period.


type: double

--

*`aws.kinesis.metrics.PutRecords_Latency.avg`*::
+
--
The average time taken per PutRecords operation, measured over the specified time period.


type: double

--

*`aws.kinesis.metrics.PutRecords_Success.avg`*::
+
--
The total number of PutRecords operations where at least one record succeeded, per Kinesis stream, measured over the specified time period.


type: long

--

*`aws.kinesis.metrics.PutRecords_TotalRecords.sum`*::
+
--
The total number of records sent in a PutRecords operation per Kinesis data stream, measured over the specified time period.


type: long

--

*`aws.kinesis.metrics.PutRecords_SuccessfulRecords.sum`*::
+
--
The number of successful records in a PutRecords operation per Kinesis data stream, measured over the specified time period.


type: long

--

*`aws.kinesis.metrics.PutRecords_FailedRecords.sum`*::
+
--
The number of records rejected due to internal failures in a PutRecords operation per Kinesis data stream, measured over the specified time period.


type: long

--

*`aws.kinesis.metrics.PutRecords_ThrottledRecords.sum`*::
+
--
The number of records rejected due to throttling in a PutRecords operation per Kinesis data stream, measured over the specified time period.


type: long

--

*`aws.kinesis.metrics.ReadProvisionedThroughputExceeded.avg`*::
+
--
The number of GetRecords calls throttled for the stream over the specified time period.


type: long

--

*`aws.kinesis.metrics.SubscribeToShard_RateExceeded.avg`*::
+
--
This metric is emitted when a new subscription attempt fails because there already is an active subscription by the same consumer or if you exceed the number of calls per second allowed for this operation.


type: long

--

*`aws.kinesis.metrics.SubscribeToShard_Success.avg`*::
+
--
This metric records whether the SubscribeToShard subscription was successfully established.


type: long

--

*`aws.kinesis.metrics.SubscribeToShardEvent_Bytes.avg`*::
+
--
The number of bytes received from the shard, measured over the specified time period.


type: long

--

*`aws.kinesis.metrics.SubscribeToShardEvent_MillisBehindLatest.avg`*::
+
--
The difference between the current time and when the last record of the SubscribeToShard event was written to the stream.


type: long

--

*`aws.kinesis.metrics.SubscribeToShardEvent_Records.sum`*::
+
--
The number of records received from the shard, measured over the specified time period.


type: long

--

*`aws.kinesis.metrics.SubscribeToShardEvent_Success.avg`*::
+
--
This metric is emitted every time an event is published successfully. It is only emitted when there's an active subscription.


type: long

--

*`aws.kinesis.metrics.WriteProvisionedThroughputExceeded.avg`*::
+
--
The number of records rejected due to throttling for the stream over the specified time period. This metric includes throttling from PutRecord and PutRecords operations.


type: long

--

[float]
=== lambda

`lambda` contains the metrics that were scraped from AWS CloudWatch which contains monitoring metrics sent by AWS Lambda.




*`aws.lambda.metrics.Invocations.avg`*::
+
--
The number of times your function code is executed, including successful executions and executions that result in a function error.

type: double

--

*`aws.lambda.metrics.Errors.avg`*::
+
--
The number of invocations that result in a function error.

type: double

--

*`aws.lambda.metrics.DeadLetterErrors.avg`*::
+
--
For asynchronous invocation, the number of times Lambda attempts to send an event to a dead-letter queue but fails.

type: double

--

*`aws.lambda.metrics.DestinationDeliveryFailures.avg`*::
+
--
For asynchronous invocation, the number of times Lambda attempts to send an event to a destination but fails.

type: double

--

*`aws.lambda.metrics.Duration.avg`*::
+
--
The amount of time that your function code spends processing an event.

type: double

--

*`aws.lambda.metrics.Throttles.avg`*::
+
--
The number of invocation requests that are throttled.

type: double

--

*`aws.lambda.metrics.IteratorAge.avg`*::
+
--
For event source mappings that read from streams, the age of the last record in the event.

type: double

--

*`aws.lambda.metrics.ConcurrentExecutions.avg`*::
+
--
The number of function instances that are processing events.

type: double

--

*`aws.lambda.metrics.UnreservedConcurrentExecutions.avg`*::
+
--
For an AWS Region, the number of events that are being processed by functions that don't have reserved concurrency.

type: double

--

*`aws.lambda.metrics.ProvisionedConcurrentExecutions.max`*::
+
--
The number of function instances that are processing events on provisioned concurrency.

type: long

--

*`aws.lambda.metrics.ProvisionedConcurrencyUtilization.max`*::
+
--
For a version or alias, the value of ProvisionedConcurrentExecutions divided by the total amount of provisioned concurrency allocated.

type: long

--

*`aws.lambda.metrics.ProvisionedConcurrencyInvocations.sum`*::
+
--
The number of times your function code is executed on provisioned concurrency.

type: long

--

*`aws.lambda.metrics.ProvisionedConcurrencySpilloverInvocations.sum`*::
+
--
The number of times your function code is executed on standard concurrency when all provisioned concurrency is in use.

type: long

--

[float]
=== natgateway

`natgateway` contains the metrics from Cloudwatch to track usage of NAT gateway related resources.




*`aws.natgateway.metrics.BytesInFromDestination.sum`*::
+
--
The number of bytes received by the NAT gateway from the destination.

type: long

--

*`aws.natgateway.metrics.BytesInFromSource.sum`*::
+
--
The number of bytes received by the NAT gateway from clients in your VPC.

type: long

--

*`aws.natgateway.metrics.BytesOutToDestination.sum`*::
+
--
The number of bytes sent out through the NAT gateway to the destination.

type: long

--

*`aws.natgateway.metrics.BytesOutToSource.sum`*::
+
--
The number of bytes sent through the NAT gateway to the clients in your VPC.

type: long

--

*`aws.natgateway.metrics.ConnectionAttemptCount.sum`*::
+
--
The number of connection attempts made through the NAT gateway.

type: long

--

*`aws.natgateway.metrics.ConnectionEstablishedCount.sum`*::
+
--
The number of connections established through the NAT gateway.

type: long

--

*`aws.natgateway.metrics.ErrorPortAllocation.sum`*::
+
--
The number of times the NAT gateway could not allocate a source port.

type: long

--

*`aws.natgateway.metrics.IdleTimeoutCount.sum`*::
+
--
The number of connections that transitioned from the active state to the idle state.

type: long

--

*`aws.natgateway.metrics.PacketsDropCount.sum`*::
+
--
The number of packets dropped by the NAT gateway.

type: long

--

*`aws.natgateway.metrics.PacketsInFromDestination.sum`*::
+
--
The number of packets received by the NAT gateway from the destination.

type: long

--

*`aws.natgateway.metrics.PacketsInFromSource.sum`*::
+
--
The number of packets received by the NAT gateway from clients in your VPC.

type: long

--

*`aws.natgateway.metrics.PacketsOutToDestination.sum`*::
+
--
The number of packets sent out through the NAT gateway to the destination.

type: long

--

*`aws.natgateway.metrics.PacketsOutToSource.sum`*::
+
--
The number of packets sent through the NAT gateway to the clients in your VPC.

type: long

--

*`aws.natgateway.metrics.ActiveConnectionCount.max`*::
+
--
The total number of concurrent active TCP connections through the NAT gateway.

type: long

--

[float]
=== rds

`rds` contains the metrics that were scraped from AWS CloudWatch which contains monitoring metrics sent by AWS RDS.



*`aws.rds.burst_balance.pct`*::
+
--
The percent of General Purpose SSD (gp2) burst-bucket I/O credits available.


type: scaled_float

format: percent

--

*`aws.rds.cpu.total.pct`*::
+
--
The percentage of CPU utilization.


type: scaled_float

format: percent

--

*`aws.rds.cpu.credit_usage`*::
+
--
The number of CPU credits spent by the instance for CPU utilization.


type: long

--

*`aws.rds.cpu.credit_balance`*::
+
--
The number of earned CPU credits that an instance has accrued since it was launched or started.


type: long

--

*`aws.rds.database_connections`*::
+
--
The number of database connections in use.


type: long

--

*`aws.rds.db_instance.arn`*::
+
--
Amazon Resource Name(ARN) for each rds.


type: keyword

--

*`aws.rds.db_instance.class`*::
+
--
Contains the name of the compute and memory capacity class of the DB instance.


type: keyword

--

*`aws.rds.db_instance.identifier`*::
+
--
Contains a user-supplied database identifier. This identifier is the unique key that identifies a DB instance.


type: keyword

--

*`aws.rds.db_instance.status`*::
+
--
Specifies the current state of this database.


type: keyword

--

*`aws.rds.disk_queue_depth`*::
+
--
The number of outstanding IOs (read/write requests) waiting to access the disk.


type: float

--

*`aws.rds.failed_sql_server_agent_jobs`*::
+
--
The number of failed SQL Server Agent jobs during the last minute.


type: long

--

*`aws.rds.freeable_memory.bytes`*::
+
--
The amount of available random access memory.


type: long

format: bytes

--

*`aws.rds.free_storage.bytes`*::
+
--
The amount of available storage space.


type: long

format: bytes

--

*`aws.rds.maximum_used_transaction_ids`*::
+
--
The maximum transaction ID that has been used. Applies to PostgreSQL.


type: long

--

*`aws.rds.oldest_replication_slot_lag.mb`*::
+
--
The lagging size of the replica lagging the most in terms of WAL data received. Applies to PostgreSQL.


type: long

--

*`aws.rds.read_io.ops_per_sec`*::
+
--
The average number of disk read I/O operations per second.


type: float

--

*`aws.rds.replica_lag.sec`*::
+
--
The amount of time a Read Replica DB instance lags behind the source DB instance. Applies to MySQL, MariaDB, and PostgreSQL Read Replicas.


type: long

format: duration

--

*`aws.rds.swap_usage.bytes`*::
+
--
The amount of swap space used on the DB instance. This metric is not available for SQL Server.


type: long

format: bytes

--

*`aws.rds.transaction_logs_generation`*::
+
--
The disk space used by transaction logs. Applies to PostgreSQL.


type: long

--

*`aws.rds.write_io.ops_per_sec`*::
+
--
The average number of disk write I/O operations per second.


type: float

--

*`aws.rds.queries`*::
+
--
The average number of queries executed per second.


type: long

--

*`aws.rds.deadlocks`*::
+
--
The average number of deadlocks in the database per second.


type: long

--

*`aws.rds.volume_used.bytes`*::
+
--
The amount of storage used by your Aurora DB instance, in bytes.


type: long

format: bytes

--

*`aws.rds.volume.read.iops`*::
+
--
The number of billed read I/O operations from a cluster volume, reported at 5-minute intervals.


type: long

format: bytes

--

*`aws.rds.volume.write.iops`*::
+
--
The number of write disk I/O operations to the cluster volume, reported at 5-minute intervals.


type: long

format: bytes

--

*`aws.rds.free_local_storage.bytes`*::
+
--
The amount of storage available for temporary tables and logs, in bytes.


type: long

format: bytes

--

*`aws.rds.login_failures`*::
+
--
The average number of failed login attempts per second.


type: long

--

*`aws.rds.throughput.commit`*::
+
--
The average number of commit operations per second.


type: float

--

*`aws.rds.throughput.delete`*::
+
--
The average number of delete queries per second.


type: float

--

*`aws.rds.throughput.ddl`*::
+
--
The average number of DDL requests per second.


type: float

--

*`aws.rds.throughput.dml`*::
+
--
The average number of inserts, updates, and deletes per second.


type: float

--

*`aws.rds.throughput.insert`*::
+
--
The average number of insert queries per second.


type: float

--

*`aws.rds.throughput.network`*::
+
--
The amount of network throughput both received from and transmitted to clients by each instance in the Aurora MySQL DB cluster, in bytes per second.


type: float

--

*`aws.rds.throughput.network_receive`*::
+
--
The incoming (Receive) network traffic on the DB instance, including both customer database traffic and Amazon RDS traffic used for monitoring and replication.


type: float

--

*`aws.rds.throughput.network_transmit`*::
+
--
The outgoing (Transmit) network traffic on the DB instance, including both customer database traffic and Amazon RDS traffic used for monitoring and replication.


type: float

--

*`aws.rds.throughput.read`*::
+
--
The average amount of time taken per disk I/O operation.


type: float

--

*`aws.rds.throughput.select`*::
+
--
The average number of select queries per second.


type: float

--

*`aws.rds.throughput.update`*::
+
--
The average number of update queries per second.


type: float

--

*`aws.rds.throughput.write`*::
+
--
The average number of bytes written to disk per second.


type: float

--

*`aws.rds.latency.commit`*::
+
--
The amount of latency for commit operations, in milliseconds.


type: float

format: duration

--

*`aws.rds.latency.ddl`*::
+
--
The amount of latency for data definition language (DDL) requests, in milliseconds.


type: float

format: duration

--

*`aws.rds.latency.dml`*::
+
--
The amount of latency for inserts, updates, and deletes, in milliseconds.


type: float

format: duration

--

*`aws.rds.latency.insert`*::
+
--
The amount of latency for insert queries, in milliseconds.


type: float

format: duration

--

*`aws.rds.latency.read`*::
+
--
The average amount of time taken per disk I/O operation.


type: float

format: duration

--

*`aws.rds.latency.select`*::
+
--
The amount of latency for select queries, in milliseconds.


type: float

format: duration

--

*`aws.rds.latency.update`*::
+
--
The amount of latency for update queries, in milliseconds.


type: float

format: duration

--

*`aws.rds.latency.write`*::
+
--
The average amount of time taken per disk I/O operation.


type: float

format: duration

--

*`aws.rds.latency.delete`*::
+
--
The amount of latency for delete queries, in milliseconds.


type: float

format: duration

--

*`aws.rds.disk_usage.bin_log.bytes`*::
+
--
The amount of disk space occupied by binary logs on the master. Applies to MySQL read replicas.


type: long

format: bytes

--

*`aws.rds.disk_usage.replication_slot.mb`*::
+
--
The disk space used by replication slot files. Applies to PostgreSQL.


type: long

--

*`aws.rds.disk_usage.transaction_logs.mb`*::
+
--
The disk space used by transaction logs. Applies to PostgreSQL.


type: long

--

*`aws.rds.transactions.active`*::
+
--
The average number of current transactions executing on an Aurora database instance per second.


type: long

--

*`aws.rds.transactions.blocked`*::
+
--
The average number of transactions in the database that are blocked per second.


type: long

--

*`aws.rds.db_instance.db_cluster_identifier`*::
+
--
This identifier is the unique key that identifies a DB cluster specifically for Amazon Aurora DB cluster.


type: keyword

--

*`aws.rds.db_instance.role`*::
+
--
DB roles like WRITER or READER, specifically for Amazon Aurora DB cluster.


type: keyword

--

*`aws.rds.db_instance.engine_name`*::
+
--
Each DB instance runs a DB engine, like MySQL, MariaDB, PostgreSQL and etc.


type: keyword

--

*`aws.rds.aurora_bin_log_replica_lag`*::
+
--
The amount of time a replica DB cluster running on Aurora with MySQL compatibility lags behind the source DB cluster.


type: long

--

*`aws.rds.aurora_global_db.replicated_write_io.bytes`*::
+
--
In an Aurora Global Database, the number of write I/O operations replicated from the primary AWS Region to the cluster volume in a secondary AWS Region.


type: long

--

*`aws.rds.aurora_global_db.data_transfer.bytes`*::
+
--
In an Aurora Global Database, the amount of redo log data transferred from the master AWS Region to a secondary AWS Region.


type: long

--

*`aws.rds.aurora_global_db.replication_lag.ms`*::
+
--
For an Aurora Global Database, the amount of lag when replicating updates from the primary AWS Region, in milliseconds.


type: long

--

*`aws.rds.aurora_replica.lag.ms`*::
+
--
For an Aurora Replica, the amount of lag when replicating updates from the primary instance, in milliseconds.


type: long

--

*`aws.rds.aurora_replica.lag_max.ms`*::
+
--
The maximum amount of lag between the primary instance and each Aurora DB instance in the DB cluster, in milliseconds.


type: long

--

*`aws.rds.aurora_replica.lag_min.ms`*::
+
--
The minimum amount of lag between the primary instance and each Aurora DB instance in the DB cluster, in milliseconds.


type: long

--

*`aws.rds.backtrack_change_records.creation_rate`*::
+
--
The number of backtrack change records created over five minutes for your DB cluster.


type: long

--

*`aws.rds.backtrack_change_records.stored`*::
+
--
The actual number of backtrack change records used by your DB cluster.


type: long

--

*`aws.rds.backtrack_window.actual`*::
+
--
The difference between the target backtrack window and the actual backtrack window.


type: long

--

*`aws.rds.backtrack_window.alert`*::
+
--
The number of times that the actual backtrack window is smaller than the target backtrack window for a given period of time.


type: long

--

*`aws.rds.storage_used.backup_retention_period.bytes`*::
+
--
The total amount of backup storage in bytes used to support the point-in-time restore feature within the Aurora DB cluster's backup retention window.


type: long

--

*`aws.rds.storage_used.snapshot.bytes`*::
+
--
The total amount of backup storage in bytes consumed by all Aurora snapshots for an Aurora DB cluster outside its backup retention window.


type: long

--

*`aws.rds.cache_hit_ratio.buffer`*::
+
--
The percentage of requests that are served by the buffer cache.


type: long

--

*`aws.rds.cache_hit_ratio.result_set`*::
+
--
The percentage of requests that are served by the Resultset cache.


type: long

--

*`aws.rds.engine_uptime.sec`*::
+
--
The amount of time that the instance has been running, in seconds.


type: long

--

*`aws.rds.rds_to_aurora_postgresql_replica_lag.sec`*::
+
--
The amount of lag in seconds when replicating updates from the primary RDS PostgreSQL instance to other nodes in the cluster.


type: long

--

*`aws.rds.backup_storage_billed_total.bytes`*::
+
--
The total amount of backup storage in bytes for which you are billed for a given Aurora DB cluster.


type: long

--

*`aws.rds.aurora_volume_left_total.bytes`*::
+
--
The remaining available space for the cluster volume, measured in bytes.


type: long

--

[float]
=== s3_daily_storage

`s3_daily_storage` contains the daily storage metrics that were scraped from AWS CloudWatch which contains monitoring metrics sent by AWS S3.



*`aws.s3_daily_storage.bucket.size.bytes`*::
+
--
The amount of data in bytes stored in a bucket.


type: long

format: bytes

--

*`aws.s3_daily_storage.number_of_objects`*::
+
--
The total number of objects stored in a bucket for all storage classes.


type: long

--

[float]
=== s3_request

`s3_request` contains request metrics that were scraped from AWS CloudWatch which contains monitoring metrics sent by AWS S3.



*`aws.s3_request.requests.total`*::
+
--
The total number of HTTP requests made to an Amazon S3 bucket, regardless of type.


type: long

--

*`aws.s3_request.requests.get`*::
+
--
The number of HTTP GET requests made for objects in an Amazon S3 bucket.


type: long

--

*`aws.s3_request.requests.put`*::
+
--
The number of HTTP PUT requests made for objects in an Amazon S3 bucket.


type: long

--

*`aws.s3_request.requests.delete`*::
+
--
The number of HTTP DELETE requests made for objects in an Amazon S3 bucket.


type: long

--

*`aws.s3_request.requests.head`*::
+
--
The number of HTTP HEAD requests made to an Amazon S3 bucket.


type: long

--

*`aws.s3_request.requests.post`*::
+
--
The number of HTTP POST requests made to an Amazon S3 bucket.


type: long

--

*`aws.s3_request.requests.select`*::
+
--
The number of Amazon S3 SELECT Object Content requests made for objects in an Amazon S3 bucket.


type: long

--

*`aws.s3_request.requests.select_scanned.bytes`*::
+
--
The number of bytes of data scanned with Amazon S3 SELECT Object Content requests in an Amazon S3 bucket.


type: long

format: bytes

--

*`aws.s3_request.requests.select_returned.bytes`*::
+
--
The number of bytes of data returned with Amazon S3 SELECT Object Content requests in an Amazon S3 bucket.


type: long

format: bytes

--

*`aws.s3_request.requests.list`*::
+
--
The number of HTTP requests that list the contents of a bucket.


type: long

--

*`aws.s3_request.downloaded.bytes`*::
+
--
The number bytes downloaded for requests made to an Amazon S3 bucket, where the response includes a body.


type: long

format: bytes

--

*`aws.s3_request.uploaded.bytes`*::
+
--
The number bytes uploaded that contain a request body, made to an Amazon S3 bucket.


type: long

format: bytes

--

*`aws.s3_request.errors.4xx`*::
+
--
The number of HTTP 4xx client error status code requests made to an Amazon S3 bucket with a value of either 0 or 1.


type: long

--

*`aws.s3_request.errors.5xx`*::
+
--
The number of HTTP 5xx server error status code requests made to an Amazon S3 bucket with a value of either 0 or 1.


type: long

--

*`aws.s3_request.latency.first_byte.ms`*::
+
--
The per-request time from the complete request being received by an Amazon S3 bucket to when the response starts to be returned.


type: long

format: duration

--

*`aws.s3_request.latency.total_request.ms`*::
+
--
The elapsed per-request time from the first byte received to the last byte sent to an Amazon S3 bucket.


type: long

format: duration

--

[float]
=== sns

`sns` contains the metrics that were scraped from AWS CloudWatch which contains monitoring metrics sent by AWS SNS.




*`aws.sns.metrics.PublishSize.avg`*::
+
--
The size of messages published.

type: double

--

*`aws.sns.metrics.SMSSuccessRate.avg`*::
+
--
The rate of successful SMS message deliveries.

type: double

--

*`aws.sns.metrics.NumberOfMessagesPublished.sum`*::
+
--
The number of messages published to your Amazon SNS topics.

type: long

--

*`aws.sns.metrics.NumberOfNotificationsDelivered.sum`*::
+
--
The number of messages successfully delivered from your Amazon SNS topics to subscribing endpoints.

type: long

--

*`aws.sns.metrics.NumberOfNotificationsFailed.sum`*::
+
--
The number of messages that Amazon SNS failed to deliver.

type: long

--

*`aws.sns.metrics.NumberOfNotificationsFilteredOut.sum`*::
+
--
The number of messages that were rejected by subscription filter policies.

type: long

--

*`aws.sns.metrics.NumberOfNotificationsFilteredOut-InvalidAttributes.sum`*::
+
--
The number of messages that were rejected by subscription filter policies because the messages' attributes are invalid - for example, because the attribute JSON is incorrectly formatted.

type: long

--

*`aws.sns.metrics.NumberOfNotificationsFilteredOut-NoMessageAttributes.sum`*::
+
--
The number of messages that were rejected by subscription filter policies because the messages have no attributes.

type: long

--

*`aws.sns.metrics.NumberOfNotificationsRedrivenToDlq.sum`*::
+
--
The number of messages that have been moved to a dead-letter queue.

type: long

--

*`aws.sns.metrics.NumberOfNotificationsFailedToRedriveToDlq.sum`*::
+
--
The number of messages that couldn't be moved to a dead-letter queue.

type: long

--

*`aws.sns.metrics.SMSMonthToDateSpentUSD.sum`*::
+
--
The charges you have accrued since the start of the current calendar month for sending SMS messages.

type: long

--

[float]
=== sqs

`sqs` contains the metrics that were scraped from AWS CloudWatch which contains monitoring metrics sent by AWS SQS.



*`aws.sqs.oldest_message_age.sec`*::
+
--
The approximate age of the oldest non-deleted message in the queue.


type: long

format: duration

--

*`aws.sqs.messages.delayed`*::
+
--
TThe number of messages in the queue that are delayed and not available for reading immediately.


type: long

--

*`aws.sqs.messages.not_visible`*::
+
--
The number of messages that are in flight.


type: long

--

*`aws.sqs.messages.visible`*::
+
--
The number of messages available for retrieval from the queue.


type: long

--

*`aws.sqs.messages.deleted`*::
+
--
The number of messages deleted from the queue.


type: long

--

*`aws.sqs.messages.received`*::
+
--
The number of messages returned by calls to the ReceiveMessage action.


type: long

--

*`aws.sqs.messages.sent`*::
+
--
The number of messages added to a queue.


type: long

--

*`aws.sqs.empty_receives`*::
+
--
The number of ReceiveMessage API calls that did not return a message.


type: long

--

*`aws.sqs.sent_message_size.bytes`*::
+
--
The size of messages added to a queue.


type: long

format: bytes

--

*`aws.sqs.queue.name`*::
+
--
SQS queue name


type: keyword

--

[float]
=== transitgateway

`transitgateway` contains the metrics from Cloudwatch to track usage of transit gateway related resources.




*`aws.transitgateway.metrics.BytesIn.sum`*::
+
--
The number of bytes received by the transit gateway.

type: long

--

*`aws.transitgateway.metrics.BytesOut.sum`*::
+
--
The number of bytes sent from the transit gateway.

type: long

--

*`aws.transitgateway.metrics.PacketsIn.sum`*::
+
--
The number of packets received by the transit gateway.

type: long

--

*`aws.transitgateway.metrics.PacketsOut.sum`*::
+
--
The number of packets sent by the transit gateway.

type: long

--

*`aws.transitgateway.metrics.PacketDropCountBlackhole.sum`*::
+
--
The number of packets dropped because they matched a blackhole route.

type: long

--

*`aws.transitgateway.metrics.PacketDropCountNoRoute.sum`*::
+
--
The number of packets dropped because they did not match a route.

type: long

--

*`aws.transitgateway.metrics.BytesDropCountNoRoute.sum`*::
+
--
The number of bytes dropped because they did not match a route.

type: long

--

*`aws.transitgateway.metrics.BytesDropCountBlackhole.sum`*::
+
--
The number of bytes dropped because they matched a blackhole route.

type: long

--

[float]
=== usage

`usage` contains the metrics from Cloudwatch to track usage of some AWS resources.




*`aws.usage.metrics.CallCount.sum`*::
+
--
The number of specified API operations performed in your account.

type: long

--

*`aws.usage.metrics.ResourceCount.sum`*::
+
--
The number of the specified resources running in your account. The resources are defined by the dimensions associated with the metric.

type: long

--

[float]
=== vpn

`vpn` contains the metrics from Cloudwatch to track usage of VPN related resources.




*`aws.vpn.metrics.TunnelState.avg`*::
+
--
The state of the tunnel. For static VPNs, 0 indicates DOWN and 1 indicates UP. For BGP VPNs, 1 indicates ESTABLISHED and 0 is used for all other states.

type: double

--

*`aws.vpn.metrics.TunnelDataIn.sum`*::
+
--
The bytes received through the VPN tunnel.

type: double

--

*`aws.vpn.metrics.TunnelDataOut.sum`*::
+
--
The bytes sent through the VPN tunnel.

type: double

--

[[exported-fields-awsfargate]]
== AWS Fargate fields

`awsfargate` module collects AWS fargate metrics from task metadata endpoint.



[float]
=== task_stats

`task_stats` contains the metrics that were scraped from AWS fargate task stats ${ECS_CONTAINER_METADATA_URI_V4}/task/stats metadata endpoint.



*`task_stats.identifier`*::
+
--
Container identifier across tasks and clusters, which equals to container.name + '/' + container.id.


type: keyword

--

[float]
=== cpu

Runtime CPU metrics.


*`task_stats.cpu.kernel.pct`*::
+
--
Percentage of time in kernel space.


type: scaled_float

format: percent

--

*`task_stats.cpu.kernel.norm.pct`*::
+
--
Percentage of time in kernel space normalized by the number of CPU cores.


type: scaled_float

format: percent

--

*`task_stats.cpu.kernel.ticks`*::
+
--
CPU ticks in kernel space.


type: long

--

*`task_stats.cpu.system.pct`*::
+
--
Percentage of total CPU time in the system.


type: scaled_float

format: percent

--

*`task_stats.cpu.system.norm.pct`*::
+
--
Percentage of total CPU time in the system normalized by the number of CPU cores.


type: scaled_float

format: percent

--

*`task_stats.cpu.system.ticks`*::
+
--
CPU system ticks.


type: long

--

*`task_stats.cpu.user.pct`*::
+
--
Percentage of time in user space.


type: scaled_float

format: percent

--

*`task_stats.cpu.user.norm.pct`*::
+
--
Percentage of time in user space normalized by the number of CPU cores.


type: scaled_float

format: percent

--

*`task_stats.cpu.user.ticks`*::
+
--
CPU ticks in user space.


type: long

--

*`task_stats.cpu.total.pct`*::
+
--
Total CPU usage.


type: scaled_float

format: percent

--

*`task_stats.cpu.total.norm.pct`*::
+
--
Total CPU usage normalized by the number of CPU cores.


type: scaled_float

format: percent

--

[float]
=== diskio

Disk I/O metrics.


[float]
=== read

Accumulated reads during the life of the container



*`task_stats.diskio.read.ops`*::
+
--
Number of reads during the life of the container


type: long

--

*`task_stats.diskio.read.bytes`*::
+
--
Bytes read during the life of the container


type: long

format: bytes

--

*`task_stats.diskio.read.rate`*::
+
--
Number of current reads per second


type: long

--

*`task_stats.diskio.read.service_time`*::
+
--
Total time to service IO requests, in nanoseconds


type: long

--

*`task_stats.diskio.read.wait_time`*::
+
--
Total time requests spent waiting in queues for service, in nanoseconds


type: long

--

*`task_stats.diskio.read.queued`*::
+
--
Total number of queued requests


type: long

--

*`task_stats.diskio.read.reads`*::
+
--

deprecated:[6.4]

Number of current reads per second


type: scaled_float

--

[float]
=== write

Accumulated writes during the life of the container



*`task_stats.diskio.read.write.ops`*::
+
--
Number of writes during the life of the container


type: long

--

*`task_stats.diskio.read.write.bytes`*::
+
--
Bytes written during the life of the container


type: long

format: bytes

--

*`task_stats.diskio.read.write.rate`*::
+
--
Number of current writes per second


type: long

--

*`task_stats.diskio.read.write.service_time`*::
+
--
Total time to service IO requests, in nanoseconds


type: long

--

*`task_stats.diskio.read.write.wait_time`*::
+
--
Total time requests spent waiting in queues for service, in nanoseconds


type: long

--

*`task_stats.diskio.read.write.queued`*::
+
--
Total number of queued requests


type: long

--

*`task_stats.diskio.read.writes`*::
+
--

deprecated:[6.4]

Number of current writes per second


type: scaled_float

--

[float]
=== summary

Accumulated reads and writes during the life of the container



*`task_stats.diskio.read.summary.ops`*::
+
--
Number of I/O operations during the life of the container


type: long

--

*`task_stats.diskio.read.summary.bytes`*::
+
--
Bytes read and written during the life of the container


type: long

format: bytes

--

*`task_stats.diskio.read.summary.rate`*::
+
--
Number of current operations per second


type: long

--

*`task_stats.diskio.read.summary.service_time`*::
+
--
Total time to service IO requests, in nanoseconds


type: long

--

*`task_stats.diskio.read.summary.wait_time`*::
+
--
Total time requests spent waiting in queues for service, in nanoseconds


type: long

--

*`task_stats.diskio.read.summary.queued`*::
+
--
Total number of queued requests


type: long

--

*`task_stats.diskio.read.total`*::
+
--

deprecated:[6.4]

Number of reads and writes per second


type: scaled_float

--

[float]
=== memory

Memory metrics.


*`task_stats.memory.stats.*`*::
+
--
Raw memory stats from the cgroups memory.stat interface


type: object

--

[float]
=== network

Network metrics.


*`task_stats.network.interface`*::
+
--
Network interface name.


type: keyword

--

[float]
=== inbound

Incoming network stats since the container started.



*`task_stats.network.inbound.bytes`*::
+
--
Total number of incoming bytes.


type: long

format: bytes

--

*`task_stats.network.inbound.dropped`*::
+
--
Total number of dropped incoming packets.


type: long

--

*`task_stats.network.inbound.errors`*::
+
--
Total errors on incoming packets.


type: long

--

*`task_stats.network.inbound.packets`*::
+
--
Total number of incoming packets.


type: long

--

[float]
=== outbound

Outgoing network stats since the container started.



*`task_stats.network.outbound.bytes`*::
+
--
Total number of outgoing bytes.


type: long

format: bytes

--

*`task_stats.network.outbound.dropped`*::
+
--
Total number of dropped outgoing packets.


type: long

--

*`task_stats.network.outbound.errors`*::
+
--
Total errors on outgoing packets.


type: long

--

*`task_stats.network.outbound.packets`*::
+
--
Total number of outgoing packets.


type: long

--

[[exported-fields-azure]]
== Azure fields

azure module




*`azure.timegrain`*::
+
--
The Azure metric timegrain


type: keyword

--

[float]
=== resource

The resource specified



*`azure.resource.type`*::
+
--
The type of the resource


type: keyword

--

*`azure.resource.name`*::
+
--
The name of the resource


type: keyword

--

*`azure.resource.group`*::
+
--
The resource group


type: keyword

--

*`azure.resource.tags.*`*::
+
--
Azure resource tags.


type: object

--

*`azure.namespace`*::
+
--
The namespace selected


type: keyword

--

*`azure.subscription_id`*::
+
--
The subscription ID


type: keyword

--

*`azure.subscription_name`*::
+
--
The subscription name


type: keyword

--

*`azure.application_id`*::
+
--
The application ID


type: keyword

--

*`azure.dimensions.*`*::
+
--
Azure metric dimensions.


type: object

--

*`azure.metrics.*.*`*::
+
--
Metrics returned.


type: object

--

[float]
=== app_insights

application insights



*`azure.app_insights.start_date`*::
+
--
The start date


type: date

--

*`azure.app_insights.end_date`*::
+
--
The end date


type: date

--

*`azure.app_insights.metrics.*.*`*::
+
--
The metrics


type: object

--

[float]
=== app_state

application state



*`azure.app_state.start_date`*::
+
--
The start date


type: date

--

*`azure.app_state.end_date`*::
+
--
The end date


type: date

--

*`azure.app_state.requests_count.sum`*::
+
--
Request count


type: float

--

*`azure.app_state.requests_failed.sum`*::
+
--
Request failed count


type: float

--

*`azure.app_state.users_count.unique`*::
+
--
User count


type: float

--

*`azure.app_state.sessions_count.unique`*::
+
--
Session count


type: float

--

*`azure.app_state.users_authenticated.unique`*::
+
--
Authenticated users count


type: float

--

*`azure.app_state.browser_timings_network_duration.avg`*::
+
--
Browser timings network duration


type: float

--

*`azure.app_state.browser_timings_send_duration.avg`*::
+
--
Browser timings send duration


type: float

--

*`azure.app_state.browser_timings_receive_uration.avg`*::
+
--
Browser timings receive duration


type: float

--

*`azure.app_state.browser_timings_processing_duration.avg`*::
+
--
Browser timings processing duration


type: float

--

*`azure.app_state.browser_timings_total_duration.avg`*::
+
--
Browser timings total duration


type: float

--

*`azure.app_state.exceptions_count.sum`*::
+
--
Exception count


type: float

--

*`azure.app_state.exceptions_browser.sum`*::
+
--
Exception count at browser level


type: float

--

*`azure.app_state.exceptions_server.sum`*::
+
--
Exception count at server level


type: float

--

*`azure.app_state.performance_counters_memory_available_bytes.avg`*::
+
--
Performance counters memory available bytes


type: float

--

*`azure.app_state.performance_counters_process_private_bytes.avg`*::
+
--
Performance counters process private bytes


type: float

--

*`azure.app_state.performance_counters_process_cpu_percentage_total.avg`*::
+
--
Performance counters process cpu percentage total


type: float

--

*`azure.app_state.performance_counters_process_cpu_percentage.avg`*::
+
--
Performance counters process cpu percentage


type: float

--

*`azure.app_state.performance_counters_processiobytes_per_second.avg`*::
+
--
Performance counters process IO bytes per second


type: float

--

[float]
=== billing

billing and usage details



*`azure.billing.currency`*::
+
--
Billing Currency.


type: keyword

--

*`azure.billing.pretax_cost`*::
+
--
The amount of cost before tax.


type: float

--

*`azure.billing.unit_price`*::
+
--
Unit Price is the price applicable to you. (your EA or other contract price).


type: float

--

*`azure.billing.quantity`*::
+
--
Measure the quantity purchased or consumed. The amount of the meter used during the billing period.


type: float

--

*`azure.billing.department_name`*::
+
--
The department name


type: keyword

--

*`azure.billing.product`*::
+
--
Product name for the consumed service or purchase.


type: keyword

--

*`azure.billing.usage_start`*::
+
--
The usage start date


type: date

--

*`azure.billing.usage_end`*::
+
--
The usage end date


type: date

--

*`azure.billing.billing_period_id`*::
+
--
The billing period id.


type: keyword

--

*`azure.billing.account_name`*::
+
--
Name of the Billing Account.


type: keyword

--

*`azure.billing.account_id`*::
+
--
Billing Account identifier.


type: keyword

--

*`azure.billing.actual_cost`*::
+
--
The actual cost


type: float

--

*`azure.billing.forecast_cost`*::
+
--
The forecast cost


type: float

--

*`azure.billing.usage_date`*::
+
--
The usage date


type: date

--

*`azure.compute_vm.*.*`*::
+
--
compute_vm


type: object

--

*`azure.compute_vm_scaleset.*.*`*::
+
--
compute_vm_scaleset


type: object

--

*`azure.container_instance.*.*`*::
+
--
container instance


type: object

--

*`azure.container_registry.*.*`*::
+
--
container registry


type: object

--

*`azure.container_service.*.*`*::
+
--
container service


type: object

--

*`azure.database_account.*.*`*::
+
--
database account


type: object

--

[float]
=== monitor

monitor


*`azure.storage.*.*`*::
+
--
storage account


type: object

--

*`azure.storage_account.*.*`*::
+
--
storage account


type: object

--

[[exported-fields-beat-common]]
== Beat fields

Contains common beat fields available in all event types.



*`agent.hostname`*::
+
--
Deprecated - use agent.name or agent.id to identify an agent. Hostname of the agent.


type: keyword

--

*`beat.timezone`*::
+
--
type: alias

alias to: event.timezone

--

*`fields`*::
+
--
Contains user configurable fields.


type: object

--

*`beat.name`*::
+
--
type: alias

alias to: host.name

--

*`beat.hostname`*::
+
--
type: alias

alias to: agent.hostname

--

*`timeseries.instance`*::
+
--
Time series instance id

type: keyword

--

[[exported-fields-beat]]
== Beat fields

Beat module



[float]
=== beat




*`beat.id`*::
+
--
Beat ID.


type: keyword

--

*`beat.type`*::
+
--
Beat type.


type: keyword

--

[float]
=== state

Beat state



*`beat.state.management.enabled`*::
+
--
Is central management enabled?


type: boolean

--

*`beat.state.module.count`*::
+
--
Number of modules enabled


type: integer

--

*`beat.state.output.name`*::
+
--
Name of output used by Beat


type: keyword

--

*`beat.state.queue.name`*::
+
--
Name of queue being used by Beat


type: keyword

--

[float]
=== stats

Beat stats



*`beat.stats.uptime.ms`*::
+
--
Beat uptime


type: long

--

*`beat.stats.runtime.goroutines`*::
+
--
Number of goroutines running in Beat


type: long

--

[float]
=== libbeat

Fields common to all Beats



[float]
=== output

Output stats



*`beat.stats.libbeat.output.type`*::
+
--
Type of output


type: keyword

--

[float]
=== events

Event counters



*`beat.stats.libbeat.output.events.acked`*::
+
--
Number of events acknowledged


type: long

--

*`beat.stats.libbeat.output.events.active`*::
+
--
Number of active events


type: long

--

*`beat.stats.libbeat.output.events.batches`*::
+
--
Number of event batches


type: long

--

*`beat.stats.libbeat.output.events.dropped`*::
+
--
Number of events dropped


type: long

--

*`beat.stats.libbeat.output.events.duplicates`*::
+
--
Number of events duplicated


type: long

--

*`beat.stats.libbeat.output.events.failed`*::
+
--
Number of events failed


type: long

--

*`beat.stats.libbeat.output.events.toomany`*::
+
--
Number of too many events


type: long

--

*`beat.stats.libbeat.output.events.total`*::
+
--
Total number of events


type: long

--

[float]
=== read

Read stats



*`beat.stats.libbeat.output.read.bytes`*::
+
--
Number of bytes read


type: long

--

*`beat.stats.libbeat.output.read.errors`*::
+
--
Number of read errors


type: long

--

[float]
=== write

Write stats



*`beat.stats.libbeat.output.write.bytes`*::
+
--
Number of bytes written


type: long

--

*`beat.stats.libbeat.output.write.errors`*::
+
--
Number of write errors


type: long

--

[[exported-fields-ceph]]
== Ceph fields

Ceph module



[float]
=== ceph

`ceph` contains the metrics that were scraped from CEPH.



[float]
=== cluster_disk

cluster_disk



*`ceph.cluster_disk.available.bytes`*::
+
--
Available bytes of the cluster


type: long

format: bytes

--

*`ceph.cluster_disk.total.bytes`*::
+
--
Total bytes of the cluster


type: long

format: bytes

--

*`ceph.cluster_disk.used.bytes`*::
+
--
Used bytes of the cluster


type: long

format: bytes

--

[float]
=== cluster_health

cluster_health



*`ceph.cluster_health.overall_status`*::
+
--
Overall status of the cluster


type: keyword

--

*`ceph.cluster_health.timechecks.epoch`*::
+
--
Map version


type: long

--

*`ceph.cluster_health.timechecks.round.value`*::
+
--
timecheck round


type: long

--

*`ceph.cluster_health.timechecks.round.status`*::
+
--
Status of the round


type: keyword

--

[float]
=== cluster_status

cluster_status



*`ceph.cluster_status.version`*::
+
--
Ceph Status version


type: long

--

*`ceph.cluster_status.traffic.read_bytes`*::
+
--
Cluster read throughput per second


type: long

format: bytes

--

*`ceph.cluster_status.traffic.write_bytes`*::
+
--
Cluster write throughput per second


type: long

format: bytes

--

*`ceph.cluster_status.traffic.read_op_per_sec`*::
+
--
Cluster read iops per second


type: long

--

*`ceph.cluster_status.traffic.write_op_per_sec`*::
+
--
Cluster write iops per second


type: long

--

*`ceph.cluster_status.misplace.total`*::
+
--
Cluster misplace pg number


type: long

--

*`ceph.cluster_status.misplace.objects`*::
+
--
Cluster misplace objects number


type: long

--

*`ceph.cluster_status.misplace.ratio`*::
+
--
Cluster misplace ratio


type: scaled_float

format: percent

--

*`ceph.cluster_status.degraded.total`*::
+
--
Cluster degraded pg number


type: long

--

*`ceph.cluster_status.degraded.objects`*::
+
--
Cluster degraded objects number


type: long

--

*`ceph.cluster_status.degraded.ratio`*::
+
--
Cluster degraded ratio


type: scaled_float

format: percent

--

*`ceph.cluster_status.pg.data_bytes`*::
+
--
Cluster pg data bytes


type: long

format: bytes

--

*`ceph.cluster_status.pg.avail_bytes`*::
+
--
Cluster available bytes


type: long

format: bytes

--

*`ceph.cluster_status.pg.total_bytes`*::
+
--
Cluster total bytes


type: long

format: bytes

--

*`ceph.cluster_status.pg.used_bytes`*::
+
--
Cluster used bytes


type: long

format: bytes

--

*`ceph.cluster_status.pg_state.state_name`*::
+
--
Pg state description


type: long

--

*`ceph.cluster_status.pg_state.count`*::
+
--
Shows how many pgs are in state of pg_state.state_name


type: long

--

*`ceph.cluster_status.pg_state.version`*::
+
--
Cluster status version


type: long

--

*`ceph.cluster_status.osd.full`*::
+
--
Is osd full


type: boolean

--

*`ceph.cluster_status.osd.nearfull`*::
+
--
Is osd near full


type: boolean

--

*`ceph.cluster_status.osd.num_osds`*::
+
--
Shows how many osds in the cluster


type: long

--

*`ceph.cluster_status.osd.num_up_osds`*::
+
--
Shows how many osds are on the state of UP


type: long

--

*`ceph.cluster_status.osd.num_in_osds`*::
+
--
Shows how many osds are on the state of IN


type: long

--

*`ceph.cluster_status.osd.num_remapped_pgs`*::
+
--
Shows how many osds are on the state of REMAPPED


type: long

--

*`ceph.cluster_status.osd.epoch`*::
+
--
epoch number


type: long

--

[float]
=== mgr_cluster_disk

see: cluster_disk


[float]
=== mgr_cluster_health

see: cluster_health


[float]
=== mgr_osd_perf

OSD performance metrics of Ceph cluster



*`ceph.mgr_osd_perf.id`*::
+
--
OSD ID

type: long

--

*`ceph.mgr_osd_perf.stats.commit_latency_ms`*::
+
--
Commit latency in ms

type: long

--

*`ceph.mgr_osd_perf.stats.apply_latency_ms`*::
+
--
Apply latency in ms

type: long

--

*`ceph.mgr_osd_perf.stats.commit_latency_ns`*::
+
--
Commit latency in ns

type: long

--

*`ceph.mgr_osd_perf.stats.apply_latency_ns`*::
+
--
Apply latency in ns

type: long

--

[float]
=== mgr_osd_pool_stats

OSD pool stats of Ceph cluster



*`ceph.mgr_osd_pool_stats.pool_name`*::
+
--
Pool name

type: keyword

--

*`ceph.mgr_osd_pool_stats.pool_id`*::
+
--
Pool ID

type: long

--

*`ceph.mgr_osd_pool_stats.client_io_rate`*::
+
--
Client I/O rates

type: object

--

[float]
=== mgr_osd_tree

see: osd_tree


[float]
=== mgr_pool_disk

see: pool_disk


[float]
=== monitor_health

monitor_health stats data



*`ceph.monitor_health.available.pct`*::
+
--
Available percent of the MON


type: long

--

*`ceph.monitor_health.health`*::
+
--
Health of the MON


type: keyword

--

*`ceph.monitor_health.available.kb`*::
+
--
Available KB of the MON


type: long

--

*`ceph.monitor_health.total.kb`*::
+
--
Total KB of the MON


type: long

--

*`ceph.monitor_health.used.kb`*::
+
--
Used KB of the MON


type: long

--

*`ceph.monitor_health.last_updated`*::
+
--
Time when was updated


type: date

--

*`ceph.monitor_health.name`*::
+
--
Name of the MON


type: keyword

--

*`ceph.monitor_health.store_stats.log.bytes`*::
+
--
Log bytes of MON


type: long

format: bytes

--

*`ceph.monitor_health.store_stats.misc.bytes`*::
+
--
Misc bytes of MON


type: long

format: bytes

--

*`ceph.monitor_health.store_stats.sst.bytes`*::
+
--
SST bytes of MON


type: long

format: bytes

--

*`ceph.monitor_health.store_stats.total.bytes`*::
+
--
Total bytes of MON


type: long

format: bytes

--

*`ceph.monitor_health.store_stats.last_updated`*::
+
--
Last updated


type: long

--

[float]
=== osd_df

ceph osd disk usage information



*`ceph.osd_df.id`*::
+
--
osd node id


type: long

--

*`ceph.osd_df.name`*::
+
--
osd node name


type: keyword

--

*`ceph.osd_df.device_class`*::
+
--
osd node type, illegal type include hdd, ssd etc.


type: keyword

--

*`ceph.osd_df.total.byte`*::
+
--
osd disk total volume


type: long

format: bytes

--

*`ceph.osd_df.used.byte`*::
+
--
osd disk usage volume


type: long

format: bytes

--

*`ceph.osd_df.available.bytes`*::
+
--
osd disk available volume


type: long

format: bytes

--

*`ceph.osd_df.pg_num`*::
+
--
shows how many pg located on this osd


type: long

--

*`ceph.osd_df.used.pct`*::
+
--
osd disk usage percentage


type: scaled_float

format: percent

--

[float]
=== osd_tree

ceph osd tree info



*`ceph.osd_tree.id`*::
+
--
osd or bucket node id


type: long

--

*`ceph.osd_tree.name`*::
+
--
osd or bucket node name


type: keyword

--

*`ceph.osd_tree.type`*::
+
--
osd or bucket node type, illegal type include osd, host, root etc.


type: keyword

--

*`ceph.osd_tree.type_id`*::
+
--
osd or bucket node typeID


type: long

--

*`ceph.osd_tree.children`*::
+
--
bucket children list, separated by comma.


type: keyword

--

*`ceph.osd_tree.crush_weight`*::
+
--
osd node crush weight


type: float

--

*`ceph.osd_tree.depth`*::
+
--
node depth


type: long

--

*`ceph.osd_tree.exists`*::
+
--
is node still exist or not(1-yes, 0-no)


type: boolean

--

*`ceph.osd_tree.primary_affinity`*::
+
--
the weight of reading data from primary osd


type: float

--

*`ceph.osd_tree.reweight`*::
+
--
the reweight of osd


type: long

--

*`ceph.osd_tree.status`*::
+
--
status of osd, it should be up or down


type: keyword

--

*`ceph.osd_tree.device_class`*::
+
--
the device class of osd, like hdd, ssd etc.


type: keyword

--

*`ceph.osd_tree.father`*::
+
--
the parent node of this osd or bucket node


type: keyword

--

[float]
=== pool_disk

pool_disk



*`ceph.pool_disk.id`*::
+
--
Id of the pool


type: long

--

*`ceph.pool_disk.name`*::
+
--
Name of the pool


type: keyword

--

*`ceph.pool_disk.stats.available.bytes`*::
+
--
Available bytes of the pool


type: long

format: bytes

--

*`ceph.pool_disk.stats.objects`*::
+
--
Number of objects of the pool


type: long

--

*`ceph.pool_disk.stats.used.bytes`*::
+
--
Used bytes of the pool


type: long

format: bytes

--

*`ceph.pool_disk.stats.used.kb`*::
+
--
Used kb of the pool


type: long

--

[[exported-fields-cloud]]
== Cloud provider metadata fields

Metadata from cloud providers added by the add_cloud_metadata processor.



*`cloud.image.id`*::
+
--
Image ID for the cloud instance.


example: ami-abcd1234

--

*`meta.cloud.provider`*::
+
--
type: alias

alias to: cloud.provider

--

*`meta.cloud.instance_id`*::
+
--
type: alias

alias to: cloud.instance.id

--

*`meta.cloud.instance_name`*::
+
--
type: alias

alias to: cloud.instance.name

--

*`meta.cloud.machine_type`*::
+
--
type: alias

alias to: cloud.machine.type

--

*`meta.cloud.availability_zone`*::
+
--
type: alias

alias to: cloud.availability_zone

--

*`meta.cloud.project_id`*::
+
--
type: alias

alias to: cloud.project.id

--

*`meta.cloud.region`*::
+
--
type: alias

alias to: cloud.region

--

[[exported-fields-cloudfoundry]]
== Cloudfoundry fields

Cloud Foundry module



[float]
=== cloudfoundry




*`cloudfoundry.type`*::
+
--
The type of event from Cloud Foundry. Possible values include 'container', 'counter' and 'value'.


type: keyword

--

[float]
=== app

The application the metric is associated with.



*`cloudfoundry.app.id`*::
+
--
The ID of the application.


type: keyword

--

[float]
=== container

`container` contains container metrics from Cloud Foundry.



*`cloudfoundry.container.instance_index`*::
+
--
Index of the instance the metric belongs to.


type: long

--

*`cloudfoundry.container.cpu.pct`*::
+
--
CPU usage percentage.


type: scaled_float

--

*`cloudfoundry.container.memory.bytes`*::
+
--
Bytes of used memory.


type: long

--

*`cloudfoundry.container.memory.quota.bytes`*::
+
--
Bytes of available memory.


type: long

--

*`cloudfoundry.container.disk.bytes`*::
+
--
Bytes of used storage.


type: long

--

*`cloudfoundry.container.disk.quota.bytes`*::
+
--
Bytes of available storage.


type: long

--

[float]
=== counter

`counter` contains counter metrics from Cloud Foundry.



*`cloudfoundry.counter.name`*::
+
--
The name of the counter.


type: keyword

--

*`cloudfoundry.counter.delta`*::
+
--
The difference between the last time the counter event occurred.


type: long

--

*`cloudfoundry.counter.total`*::
+
--
The total value for the counter.


type: long

--

[float]
=== value

`value` contains counter metrics from Cloud Foundry.



*`cloudfoundry.value.name`*::
+
--
The name of the value.


type: keyword

--

*`cloudfoundry.value.unit`*::
+
--
The unit of the value.


type: keyword

--

*`cloudfoundry.value.value`*::
+
--
The value of the value.


type: float

--

[[exported-fields-cockroachdb]]
== CockroachDB fields

CockroachDB module




[[exported-fields-common]]
== Common fields

Contains common fields available in all event types.



*`metricset.module`*::
+
--
The name of the module that generated the event.


type: alias

alias to: event.module

--

*`metricset.name`*::
+
--
The name of the metricset that generated the event.


--

*`metricset.period`*::
+
--
Current data collection period for this event in milliseconds.


type: integer

--

*`service.hostname`*::
+
--
Host name of the machine where the service is running.


--

*`type`*::
+
--
The document type. Always set to "doc".


example: metricsets

required: True

--

*`systemd.fragment_path`*::
+
--
the location of the systemd unit path

type: keyword

--

*`systemd.unit`*::
+
--
the unit name of the systemd service

type: keyword

--

[[exported-fields-consul]]
== Consul fields

Consul module




[float]
=== agent

Agent Metricset fetches metrics information from a Consul instance running as Agent




*`consul.agent.autopilot.healthy`*::
+
--
Overall health of the local server cluster

type: boolean

--

[float]
=== runtime

Runtime related metrics



*`consul.agent.runtime.sys.bytes`*::
+
--
Number of bytes of memory obtained from the OS.

type: long

--

*`consul.agent.runtime.malloc_count`*::
+
--
Heap objects allocated

type: long

--

*`consul.agent.runtime.heap_objects`*::
+
--
Objects allocated on the heap and is a general memory pressure indicator. This may burst from time to time but should return to a steady state value.

type: long

--

*`consul.agent.runtime.goroutines`*::
+
--
Running goroutines and is a general load pressure indicator. This may burst from time to time but should return to a steady state value.

type: long

--


*`consul.agent.runtime.alloc.bytes`*::
+
--
Bytes allocated by the Consul process.

type: long

--

[float]
=== garbage_collector

Garbage collector metrics


*`consul.agent.runtime.garbage_collector.runs`*::
+
--
Garbage collector total executions

type: long

--

[float]
=== pause

Time that the garbage collector has paused the app



*`consul.agent.runtime.garbage_collector.pause.current.ns`*::
+
--
Garbage collector pause time in nanoseconds

type: long

--


*`consul.agent.runtime.garbage_collector.pause.total.ns`*::
+
--
Nanoseconds consumed by stop-the-world garbage collection pauses since Consul started.

type: long

--

[[exported-fields-coredns]]
== Coredns fields

coredns Module



[float]
=== coredns

`coredns` contains statistics that were read from coreDNS



[float]
=== stats

Contains statistics related to the coreDNS service



*`coredns.stats.panic.count`*::
+
--
Total number of panics


type: long

--

*`coredns.stats.dns.request.count`*::
+
--
Total query count


type: long

--

*`coredns.stats.dns.request.duration.ns.bucket.*`*::
+
--
Request duration histogram buckets in nanoseconds


type: object

--

*`coredns.stats.dns.request.duration.ns.sum`*::
+
--
Requests duration, sum of durations in nanoseconds


type: long

format: duration

--

*`coredns.stats.dns.request.duration.ns.count`*::
+
--
Requests duration, number of requests


type: long

--

*`coredns.stats.dns.request.size.bytes.bucket.*`*::
+
--
Request Size histogram buckets


type: object

--

*`coredns.stats.dns.request.size.bytes.sum`*::
+
--
Request Size histogram sum


type: long

--

*`coredns.stats.dns.request.size.bytes.count`*::
+
--
Request Size histogram count


type: long

--

*`coredns.stats.dns.request.do.count`*::
+
--
Number of queries that have the DO bit set


type: long

--

*`coredns.stats.dns.request.type.count`*::
+
--
Counter of queries per zone and type


type: long

--

*`coredns.stats.type`*::
+
--
Holds the query type of the request


type: keyword

--

*`coredns.stats.dns.response.rcode.count`*::
+
--
Counter of responses per zone and rcode


type: long

--

*`coredns.stats.rcode`*::
+
--
Holds the rcode of the response


type: keyword

--

*`coredns.stats.family`*::
+
--
The address family of the transport (1 = IP (IP version 4), 2 = IP6 (IP version 6))


type: keyword

--

*`coredns.stats.dns.response.size.bytes.bucket.*`*::
+
--
Response Size histogram buckets


type: object

--

*`coredns.stats.dns.response.size.bytes.sum`*::
+
--
Response Size histogram sum


type: long

--

*`coredns.stats.dns.response.size.bytes.count`*::
+
--
Response Size histogram count


type: long

--

*`coredns.stats.server`*::
+
--
The server responsible for the request


type: keyword

--

*`coredns.stats.zone`*::
+
--
The zonename used for the request/response


type: keyword

--

*`coredns.stats.proto`*::
+
--
The transport of the response ("udp" or "tcp")


type: keyword

--

*`coredns.stats.dns.cache.hits.count`*::
+
--
Cache hits count for the cache plugin


type: long

--

*`coredns.stats.dns.cache.misses.count`*::
+
--
Cache misses count for the cache plugin


type: long

--

[[exported-fields-couchbase]]
== Couchbase fields

Metrics collected from Couchbase servers.



[float]
=== couchbase

`couchbase` contains the metrics that were scraped from Couchbase.



[float]
=== bucket

Couchbase bucket metrics.



*`couchbase.bucket.name`*::
+
--
Name of the bucket.


type: keyword

--

*`couchbase.bucket.type`*::
+
--
Type of the bucket.


type: keyword

--

*`couchbase.bucket.data.used.bytes`*::
+
--
Size of user data within buckets of the specified state that are resident in RAM.


type: long

format: bytes

--

*`couchbase.bucket.disk.fetches`*::
+
--
Number of disk fetches.


type: double

--

*`couchbase.bucket.disk.used.bytes`*::
+
--
Amount of disk used (bytes).


type: long

format: bytes

--

*`couchbase.bucket.memory.used.bytes`*::
+
--
Amount of memory used by the bucket (bytes).


type: long

format: bytes

--

*`couchbase.bucket.quota.ram.bytes`*::
+
--
Amount of RAM used by the bucket (bytes).


type: long

format: bytes

--

*`couchbase.bucket.quota.use.pct`*::
+
--
Percentage of RAM used (for active objects) against the configured bucket size (%).


type: scaled_float

format: percent

--

*`couchbase.bucket.ops_per_sec`*::
+
--
Number of operations per second.


type: double

--

*`couchbase.bucket.item_count`*::
+
--
Number of items associated with the bucket.


type: long

--

[float]
=== cluster

Couchbase cluster metrics.



*`couchbase.cluster.hdd.free.bytes`*::
+
--
Free hard drive space in the cluster (bytes).


type: long

format: bytes

--

*`couchbase.cluster.hdd.quota.total.bytes`*::
+
--
Hard drive quota total for the cluster (bytes).


type: long

format: bytes

--

*`couchbase.cluster.hdd.total.bytes`*::
+
--
Total hard drive space available to the cluster (bytes).


type: long

format: bytes

--

*`couchbase.cluster.hdd.used.value.bytes`*::
+
--
Hard drive space used by the cluster (bytes).


type: long

format: bytes

--

*`couchbase.cluster.hdd.used.by_data.bytes`*::
+
--
Hard drive space used by the data in the cluster (bytes).


type: long

format: bytes

--

*`couchbase.cluster.max_bucket_count`*::
+
--
Max bucket count setting.


type: long

--

*`couchbase.cluster.quota.index_memory.mb`*::
+
--
Memory quota setting for the Index service (Mbyte).


type: double

--

*`couchbase.cluster.quota.memory.mb`*::
+
--
Memory quota setting for the cluster (Mbyte).


type: double

--

*`couchbase.cluster.ram.quota.total.value.bytes`*::
+
--
RAM quota total for the cluster (bytes).


type: long

format: bytes

--

*`couchbase.cluster.ram.quota.total.per_node.bytes`*::
+
--
RAM quota used by the current node in the cluster (bytes).


type: long

format: bytes

--

*`couchbase.cluster.ram.quota.used.value.bytes`*::
+
--
RAM quota used by the cluster (bytes).


type: long

format: bytes

--

*`couchbase.cluster.ram.quota.used.per_node.bytes`*::
+
--
Ram quota used by the current node in the cluster (bytes)


type: long

format: bytes

--

*`couchbase.cluster.ram.total.bytes`*::
+
--
Total RAM available to cluster (bytes).


type: long

format: bytes

--

*`couchbase.cluster.ram.used.value.bytes`*::
+
--
RAM used by the cluster (bytes).


type: long

format: bytes

--

*`couchbase.cluster.ram.used.by_data.bytes`*::
+
--
RAM used by the data in the cluster (bytes).


type: long

format: bytes

--

[float]
=== node

Couchbase node metrics.



*`couchbase.node.cmd_get`*::
+
--
Number of get commands


type: double

--

*`couchbase.node.couch.docs.disk_size.bytes`*::
+
--
Amount of disk space used by Couch docs (bytes).


type: long

format: bytes

--

*`couchbase.node.couch.docs.data_size.bytes`*::
+
--
Data size of Couch docs associated with a node (bytes).


type: long

format: bytes

--

*`couchbase.node.couch.spatial.data_size.bytes`*::
+
--
Size of object data for spatial views (bytes).


type: long

--

*`couchbase.node.couch.spatial.disk_size.bytes`*::
+
--
Amount of disk space used by spatial views (bytes).


type: long

--

*`couchbase.node.couch.views.disk_size.bytes`*::
+
--
Amount of disk space used by Couch views (bytes).


type: long

--

*`couchbase.node.couch.views.data_size.bytes`*::
+
--
Size of object data for Couch views (bytes).


type: long

--

*`couchbase.node.cpu_utilization_rate.pct`*::
+
--
The CPU utilization rate (%).


type: scaled_float

--

*`couchbase.node.current_items.value`*::
+
--
Number of current items.


type: long

--

*`couchbase.node.current_items.total`*::
+
--
Total number of items associated with the node.


type: long

--

*`couchbase.node.ep_bg_fetched`*::
+
--
Number of disk fetches performed since the server was started.


type: long

--

*`couchbase.node.get_hits`*::
+
--
Number of get hits.


type: double

--

*`couchbase.node.hostname`*::
+
--
The hostname of the node.


type: keyword

--

*`couchbase.node.mcd_memory.allocated.bytes`*::
+
--
Amount of memcached memory allocated (bytes).


type: long

format: bytes

--

*`couchbase.node.mcd_memory.reserved.bytes`*::
+
--
Amount of memcached memory reserved (bytes).


type: long

--

*`couchbase.node.memory.free.bytes`*::
+
--
Amount of memory free for the node (bytes).


type: long

--

*`couchbase.node.memory.total.bytes`*::
+
--
Total memory available to the node (bytes).


type: long

--

*`couchbase.node.memory.used.bytes`*::
+
--
Memory used by the node (bytes).


type: long

--

*`couchbase.node.ops`*::
+
--
Number of operations performed on Couchbase.


type: double

--

*`couchbase.node.swap.total.bytes`*::
+
--
Total swap size allocated (bytes).


type: long

--

*`couchbase.node.swap.used.bytes`*::
+
--
Amount of swap space used (bytes).


type: long

--

*`couchbase.node.uptime.sec`*::
+
--
Time during which the node was in operation (sec).


type: long

--

*`couchbase.node.vb_replica_curr_items`*::
+
--
Number of items/documents that are replicas.


type: long

--

[[exported-fields-couchdb]]
== CouchDB fields

couchdb module



[float]
=== couchdb

Couchdb metrics


[float]
=== server

Contains CouchDB server stats



[float]
=== httpd

HTTP statistics



*`couchdb.server.httpd.view_reads`*::
+
--
Number of view reads


type: long

--

*`couchdb.server.httpd.bulk_requests`*::
+
--
Number of bulk requests


type: long

--

*`couchdb.server.httpd.clients_requesting_changes`*::
+
--
Number of clients for continuous _changes


type: long

--

*`couchdb.server.httpd.temporary_view_reads`*::
+
--
Number of temporary view reads


type: long

--

*`couchdb.server.httpd.requests`*::
+
--
Number of HTTP requests


type: long

--

[float]
=== httpd_request_methods

HTTP request methods



*`couchdb.server.httpd_request_methods.COPY`*::
+
--
Number of HTTP COPY requests


type: long

--

*`couchdb.server.httpd_request_methods.HEAD`*::
+
--
Number of HTTP HEAD requests


type: long

--

*`couchdb.server.httpd_request_methods.POST`*::
+
--
Number of HTTP POST requests


type: long

--

*`couchdb.server.httpd_request_methods.DELETE`*::
+
--
Number of HTTP DELETE requests


type: long

--

*`couchdb.server.httpd_request_methods.GET`*::
+
--
Number of HTTP GET requests


type: long

--

*`couchdb.server.httpd_request_methods.PUT`*::
+
--
Number of HTTP PUT requests


type: long

--

[float]
=== httpd_status_codes

HTTP status codes statistics



*`couchdb.server.httpd_status_codes.200`*::
+
--
Number of HTTP 200 OK responses


type: long

--

*`couchdb.server.httpd_status_codes.201`*::
+
--
Number of HTTP 201 Created responses


type: long

--

*`couchdb.server.httpd_status_codes.202`*::
+
--
Number of HTTP 202 Accepted responses


type: long

--

*`couchdb.server.httpd_status_codes.301`*::
+
--
Number of HTTP 301 Moved Permanently responses


type: long

--

*`couchdb.server.httpd_status_codes.304`*::
+
--
Number of HTTP 304 Not Modified responses


type: long

--

*`couchdb.server.httpd_status_codes.400`*::
+
--
Number of HTTP 400 Bad Request responses


type: long

--

*`couchdb.server.httpd_status_codes.401`*::
+
--
Number of HTTP 401 Unauthorized responses


type: long

--

*`couchdb.server.httpd_status_codes.403`*::
+
--
Number of HTTP 403 Forbidden responses


type: long

--

*`couchdb.server.httpd_status_codes.404`*::
+
--
Number of HTTP 404 Not Found responses


type: long

--

*`couchdb.server.httpd_status_codes.405`*::
+
--
Number of HTTP 405 Method Not Allowed responses


type: long

--

*`couchdb.server.httpd_status_codes.409`*::
+
--
Number of HTTP 409 Conflict responses


type: long

--

*`couchdb.server.httpd_status_codes.412`*::
+
--
Number of HTTP 412 Precondition Failed responses


type: long

--

*`couchdb.server.httpd_status_codes.500`*::
+
--
Number of HTTP 500 Internal Server Error responses


type: long

--

[float]
=== couchdb

couchdb statistics



*`couchdb.server.couchdb.database_writes`*::
+
--
Number of times a database was changed


type: long

--

*`couchdb.server.couchdb.open_databases`*::
+
--
Number of open databases


type: long

--

*`couchdb.server.couchdb.auth_cache_misses`*::
+
--
Number of authentication cache misses


type: long

--

*`couchdb.server.couchdb.request_time`*::
+
--
Length of a request inside CouchDB without MochiWeb


type: long

--

*`couchdb.server.couchdb.database_reads`*::
+
--
Number of times a document was read from a database


type: long

--

*`couchdb.server.couchdb.auth_cache_hits`*::
+
--
Number of authentication cache hits


type: long

--

*`couchdb.server.couchdb.open_os_files`*::
+
--
Number of file descriptors CouchDB has open


type: long

--

[[exported-fields-docker-processor]]
== Docker fields

Docker stats collected from Docker.




*`docker.container.id`*::
+
--
type: alias

alias to: container.id

--

*`docker.container.image`*::
+
--
type: alias

alias to: container.image.name

--

*`docker.container.name`*::
+
--
type: alias

alias to: container.name

--

*`docker.container.labels`*::
+
--
Image labels.


type: object

--

[[exported-fields-docker]]
== Docker fields

Docker stats collected from Docker.



[float]
=== docker

Information and statistics about docker's running containers.



[float]
=== container

Docker container metrics.



*`docker.container.command`*::
+
--
Command that was executed in the Docker container.


type: keyword

--

*`docker.container.created`*::
+
--
Date when the container was created.


type: date

--

*`docker.container.status`*::
+
--
Container status.


type: keyword

--

*`docker.container.ip_addresses`*::
+
--
Container IP addresses.


type: ip

--

[float]
=== size

Container size metrics.



*`docker.container.size.root_fs`*::
+
--
Total size of all the files in the container.


type: long

--

*`docker.container.size.rw`*::
+
--
Size of the files that have been created or changed since creation.


type: long

--

*`docker.container.tags`*::
+
--
Image tags.


type: keyword

--

[float]
=== cpu

Runtime CPU metrics.



*`docker.cpu.kernel.pct`*::
+
--
Percentage of time in kernel space.


type: scaled_float

format: percent

--

*`docker.cpu.kernel.norm.pct`*::
+
--
Percentage of time in kernel space normalized by the number of CPU cores.


type: scaled_float

format: percent

--

*`docker.cpu.kernel.ticks`*::
+
--
CPU ticks in kernel space.


type: long

--

*`docker.cpu.system.pct`*::
+
--
Percentage of total CPU time in the system.


type: scaled_float

format: percent

--

*`docker.cpu.system.norm.pct`*::
+
--
Percentage of total CPU time in the system normalized by the number of CPU cores.


type: scaled_float

format: percent

--

*`docker.cpu.system.ticks`*::
+
--
CPU system ticks.


type: long

--

*`docker.cpu.user.pct`*::
+
--
Percentage of time in user space.


type: scaled_float

format: percent

--

*`docker.cpu.user.norm.pct`*::
+
--
Percentage of time in user space normalized by the number of CPU cores.


type: scaled_float

format: percent

--

*`docker.cpu.user.ticks`*::
+
--
CPU ticks in user space.


type: long

--

*`docker.cpu.total.pct`*::
+
--
Total CPU usage.


type: scaled_float

format: percent

--

*`docker.cpu.total.norm.pct`*::
+
--
Total CPU usage normalized by the number of CPU cores.


type: scaled_float

format: percent

--

*`docker.cpu.core.*.pct`*::
+
--
Percentage of CPU time in this core.


type: object

format: percent

--

*`docker.cpu.core.*.norm.pct`*::
+
--
Percentage of CPU time in this core, normalized by the number of CPU cores.


type: object

format: percent

--

*`docker.cpu.core.*.ticks`*::
+
--
Number of CPU ticks in this core.


type: object

--

[float]
=== diskio

Disk I/O metrics.



[float]
=== read

Accumulated reads during the life of the container



*`docker.diskio.read.ops`*::
+
--
Number of reads during the life of the container


type: long

--

*`docker.diskio.read.bytes`*::
+
--
Bytes read during the life of the container


type: long

format: bytes

--

*`docker.diskio.read.rate`*::
+
--
Number of current reads per second


type: long

--

*`docker.diskio.read.service_time`*::
+
--
Total time to service IO requests, in nanoseconds


type: long

--

*`docker.diskio.read.wait_time`*::
+
--
Total time requests spent waiting in queues for service, in nanoseconds


type: long

--

*`docker.diskio.read.queued`*::
+
--
Total number of queued requests


type: long

--

*`docker.diskio.reads`*::
+
--

deprecated:[6.4]

Number of current reads per second


type: scaled_float

--

[float]
=== write

Accumulated writes during the life of the container



*`docker.diskio.write.ops`*::
+
--
Number of writes during the life of the container


type: long

--

*`docker.diskio.write.bytes`*::
+
--
Bytes written during the life of the container


type: long

format: bytes

--

*`docker.diskio.write.rate`*::
+
--
Number of current writes per second


type: long

--

*`docker.diskio.write.service_time`*::
+
--
Total time to service IO requests, in nanoseconds


type: long

--

*`docker.diskio.write.wait_time`*::
+
--
Total time requests spent waiting in queues for service, in nanoseconds


type: long

--

*`docker.diskio.write.queued`*::
+
--
Total number of queued requests


type: long

--

*`docker.diskio.writes`*::
+
--

deprecated:[6.4]

Number of current writes per second


type: scaled_float

--

[float]
=== summary

Accumulated reads and writes during the life of the container



*`docker.diskio.summary.ops`*::
+
--
Number of I/O operations during the life of the container


type: long

--

*`docker.diskio.summary.bytes`*::
+
--
Bytes read and written during the life of the container


type: long

format: bytes

--

*`docker.diskio.summary.rate`*::
+
--
Number of current operations per second


type: long

--

*`docker.diskio.summary.service_time`*::
+
--
Total time to service IO requests, in nanoseconds


type: long

--

*`docker.diskio.summary.wait_time`*::
+
--
Total time requests spent waiting in queues for service, in nanoseconds


type: long

--

*`docker.diskio.summary.queued`*::
+
--
Total number of queued requests


type: long

--

*`docker.diskio.total`*::
+
--

deprecated:[6.4]

Number of reads and writes per second


type: scaled_float

--

[float]
=== event

Docker event



*`docker.event.status`*::
+
--
Event status


type: keyword

--

*`docker.event.id`*::
+
--
Event id when available


type: keyword

--

*`docker.event.from`*::
+
--
Event source


type: keyword

--

*`docker.event.type`*::
+
--
The type of object emitting the event


type: keyword

--

*`docker.event.action`*::
+
--
The type of event


type: keyword

--

[float]
=== actor

Actor



*`docker.event.actor.id`*::
+
--
The ID of the object emitting the event


type: keyword

--

*`docker.event.actor.attributes`*::
+
--
Various key/value attributes of the object, depending on its type


type: object

--

[float]
=== healthcheck

Docker healthcheck metrics.
Healthcheck data will only be available from docker containers where the docker `HEALTHCHECK` instruction has been used to build the docker image.



*`docker.healthcheck.failingstreak`*::
+
--
concurent failed check


type: integer

--

*`docker.healthcheck.status`*::
+
--
Healthcheck status code


type: keyword

--

[float]
=== event

event fields.



*`docker.healthcheck.event.end_date`*::
+
--
Healthcheck end date


type: date

--

*`docker.healthcheck.event.start_date`*::
+
--
Healthcheck start date


type: date

--

*`docker.healthcheck.event.output`*::
+
--
Healthcheck output


type: keyword

--

*`docker.healthcheck.event.exit_code`*::
+
--
Healthcheck status code


type: integer

--

[float]
=== image

Docker image metrics.



[float]
=== id

The image layers identifier.



*`docker.image.id.current`*::
+
--
Unique image identifier given upon its creation.


type: keyword

--

*`docker.image.id.parent`*::
+
--
Identifier of the image, if it exists, from which the current image directly descends.


type: keyword

--

*`docker.image.created`*::
+
--
Date and time when the image was created.


type: date

--

[float]
=== size

Image size layers.



*`docker.image.size.virtual`*::
+
--
Size of the image.


type: long

--

*`docker.image.size.regular`*::
+
--
Total size of the all cached images associated to the current image.


type: long

--

*`docker.image.labels`*::
+
--
Image labels.


type: object

--

*`docker.image.tags`*::
+
--
Image tags.


type: keyword

--

[float]
=== info

Info metrics based on https://docs.docker.com/engine/reference/api/docker_remote_api_v1.24/#/display-system-wide-information.



[float]
=== containers

Overall container stats.



*`docker.info.containers.paused`*::
+
--
Total number of paused containers.


type: long

--

*`docker.info.containers.running`*::
+
--
Total number of running containers.


type: long

--

*`docker.info.containers.stopped`*::
+
--
Total number of stopped containers.


type: long

--

*`docker.info.containers.total`*::
+
--
Total number of existing containers.


type: long

--

*`docker.info.id`*::
+
--
Unique Docker host identifier.


type: keyword

--

*`docker.info.images`*::
+
--
Total number of existing images.


type: long

--

[float]
=== memory

Memory metrics.



*`docker.memory.stats.*`*::
+
--
Raw memory stats from the cgroups memory.stat interface


type: object

--

[float]
=== commit

Committed bytes on Windows



*`docker.memory.commit.total`*::
+
--
Total bytes


type: long

format: bytes

--

*`docker.memory.commit.peak`*::
+
--
Peak committed bytes on Windows


type: long

format: bytes

--

*`docker.memory.private_working_set.total`*::
+
--
private working sets on Windows


type: long

format: bytes

--

*`docker.memory.fail.count`*::
+
--
Fail counter.


type: scaled_float

--

*`docker.memory.limit`*::
+
--
Memory limit.


type: long

format: bytes

--

[float]
=== rss

RSS memory stats.



*`docker.memory.rss.total`*::
+
--
Total memory resident set size.


type: long

format: bytes

--

*`docker.memory.rss.pct`*::
+
--
Memory resident set size percentage.


type: scaled_float

format: percent

--

[float]
=== usage

Usage memory stats.



*`docker.memory.usage.max`*::
+
--
Max memory usage.


type: long

format: bytes

--

*`docker.memory.usage.pct`*::
+
--
Memory usage percentage.


type: scaled_float

format: percent

--

*`docker.memory.usage.total`*::
+
--
Total memory usage.


type: long

format: bytes

--

[float]
=== network

Network metrics.



*`docker.network.interface`*::
+
--
Network interface name.


type: keyword

--

[float]
=== in

Incoming network stats per second.



*`docker.network.in.bytes`*::
+
--
Total number of incoming bytes.


type: long

format: bytes

--

*`docker.network.in.dropped`*::
+
--
Total number of dropped incoming packets.


type: scaled_float

--

*`docker.network.in.errors`*::
+
--
Total errors on incoming packets.


type: long

--

*`docker.network.in.packets`*::
+
--
Total number of incoming packets.


type: long

--

[float]
=== out

Outgoing network stats per second.



*`docker.network.out.bytes`*::
+
--
Total number of outgoing bytes.


type: long

format: bytes

--

*`docker.network.out.dropped`*::
+
--
Total number of dropped outgoing packets.


type: scaled_float

--

*`docker.network.out.errors`*::
+
--
Total errors on outgoing packets.


type: long

--

*`docker.network.out.packets`*::
+
--
Total number of outgoing packets.


type: long

--

[float]
=== inbound

Incoming network stats since the container started.



*`docker.network.inbound.bytes`*::
+
--
Total number of incoming bytes.


type: long

format: bytes

--

*`docker.network.inbound.dropped`*::
+
--
Total number of dropped incoming packets.


type: long

--

*`docker.network.inbound.errors`*::
+
--
Total errors on incoming packets.


type: long

--

*`docker.network.inbound.packets`*::
+
--
Total number of incoming packets.


type: long

--

[float]
=== outbound

Outgoing network stats since the container started.



*`docker.network.outbound.bytes`*::
+
--
Total number of outgoing bytes.


type: long

format: bytes

--

*`docker.network.outbound.dropped`*::
+
--
Total number of dropped outgoing packets.


type: long

--

*`docker.network.outbound.errors`*::
+
--
Total errors on outgoing packets.


type: long

--

*`docker.network.outbound.packets`*::
+
--
Total number of outgoing packets.


type: long

--

[float]
=== network_summary

network_summary



*`docker.network_summary.ip.*`*::
+
--
IP counters


type: object

--

*`docker.network_summary.tcp.*`*::
+
--
TCP counters


type: object

--

*`docker.network_summary.udp.*`*::
+
--
UDP counters


type: object

--

*`docker.network_summary.udp_lite.*`*::
+
--
UDP Lite counters


type: object

--

*`docker.network_summary.icmp.*`*::
+
--
ICMP counters


type: object

--

*`docker.network_summary.namespace.pid`*::
+
--
The root PID of the container, corresponding to /proc/[pid]/net


type: long

--

*`docker.network_summary.namespace.id`*::
+
--
The ID of the network namespace used by the container, corresponding to /proc/[pid]/ns/net


type: long

--

[[exported-fields-dropwizard]]
== Dropwizard fields

Stats collected from Dropwizard.



[float]
=== dropwizard




[[exported-fields-ecs]]
== ECS fields


This section defines Elastic Common Schema (ECS) fields—a common set of fields
to be used when storing event data in {es}.

This is an exhaustive list, and fields listed here are not necessarily used by {beatname_uc}.
The goal of ECS is to enable and encourage users of {es} to normalize their event data,
so that they can better analyze, visualize, and correlate the data represented in their events.

See the {ecs-ref}[ECS reference] for more information.

*`@timestamp`*::
+
--
Date/time when the event originated.
This is the date/time extracted from the event, typically representing when the event was generated by the source.
If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.
Required field for all events.

type: date

example: 2016-05-23T08:05:34.853Z

required: True

--

*`labels`*::
+
--
Custom key/value pairs.
Can be used to add meta information to events. Should not contain nested objects. All values are stored as keyword.
Example: `docker` and `k8s` labels.

type: object

example: {"application": "foo-bar", "env": "production"}

--

*`message`*::
+
--
For log events the message field contains the log message, optimized for viewing in a log viewer.
For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.
If multiple messages exist, they can be combined into one message.

type: match_only_text

example: Hello World

--

*`tags`*::
+
--
List of keywords used to tag each event.

type: keyword

example: ["production", "env2"]

--

[float]
=== agent

The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.
Examples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.


*`agent.build.original`*::
+
--
Extended build information for the agent.
This field is intended to contain any build information that a data source may provide, no specific formatting is required.

type: keyword

example: metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]

--

*`agent.ephemeral_id`*::
+
--
Ephemeral identifier of this agent (if one exists).
This id normally changes across restarts, but `agent.id` does not.

type: keyword

example: 8a4f500f

--

*`agent.id`*::
+
--
Unique identifier of this agent (if one exists).
Example: For Beats this would be beat.id.

type: keyword

example: 8a4f500d

--

*`agent.name`*::
+
--
Custom name of the agent.
This is a name that can be given to an agent. This can be helpful if for example two Filebeat instances are running on the same host but a human readable separation is needed on which Filebeat instance data is coming from.
If no name is given, the name is often left empty.

type: keyword

example: foo

--

*`agent.type`*::
+
--
Type of the agent.
The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.

type: keyword

example: filebeat

--

*`agent.version`*::
+
--
Version of the agent.

type: keyword

example: 6.0.0-rc2

--

[float]
=== as

An autonomous system (AS) is a collection of connected Internet Protocol (IP) routing prefixes under the control of one or more network operators on behalf of a single administrative entity or domain that presents a common, clearly defined routing policy to the internet.


*`as.number`*::
+
--
Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet.

type: long

example: 15169

--

*`as.organization.name`*::
+
--
Organization name.

type: keyword

example: Google LLC

--

*`as.organization.name.text`*::
+
--
type: match_only_text

--

[float]
=== client

A client is defined as the initiator of a network connection for events regarding sessions, connections, or bidirectional flow records.
For TCP events, the client is the initiator of the TCP connection that sends the SYN packet(s). For other protocols, the client is generally the initiator or requestor in the network transaction. Some systems use the term "originator" to refer the client in TCP connections. The client fields describe details about the system acting as the client in the network event. Client fields are usually populated in conjunction with server fields. Client fields are generally not populated for packet-level events.
Client / server representations can add semantic context to an exchange, which is helpful to visualize the data in certain situations. If your context falls in that category, you should still ensure that source and destination are filled appropriately.


*`client.address`*::
+
--
Some event client addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.
Then it should be duplicated to `.ip` or `.domain`, depending on which one it is.

type: keyword

--

*`client.as.number`*::
+
--
Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet.

type: long

example: 15169

--

*`client.as.organization.name`*::
+
--
Organization name.

type: keyword

example: Google LLC

--

*`client.as.organization.name.text`*::
+
--
type: match_only_text

--

*`client.bytes`*::
+
--
Bytes sent from the client to the server.

type: long

example: 184

format: bytes

--

*`client.domain`*::
+
--
Client domain.

type: keyword

--

*`client.geo.city_name`*::
+
--
City name.

type: keyword

example: Montreal

--

*`client.geo.continent_code`*::
+
--
Two-letter code representing continent's name.

type: keyword

example: NA

--

*`client.geo.continent_name`*::
+
--
Name of the continent.

type: keyword

example: North America

--

*`client.geo.country_iso_code`*::
+
--
Country ISO code.

type: keyword

example: CA

--

*`client.geo.country_name`*::
+
--
Country name.

type: keyword

example: Canada

--

*`client.geo.location`*::
+
--
Longitude and latitude.

type: geo_point

example: { "lon": -73.614830, "lat": 45.505918 }

--

*`client.geo.name`*::
+
--
User-defined description of a location, at the level of granularity they care about.
Could be the name of their data centers, the floor number, if this describes a local physical entity, city names.
Not typically used in automated geolocation.

type: keyword

example: boston-dc

--

*`client.geo.postal_code`*::
+
--
Postal code associated with the location.
Values appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.

type: keyword

example: 94040

--

*`client.geo.region_iso_code`*::
+
--
Region ISO code.

type: keyword

example: CA-QC

--

*`client.geo.region_name`*::
+
--
Region name.

type: keyword

example: Quebec

--

*`client.geo.timezone`*::
+
--
The time zone of the location, such as IANA time zone name.

type: keyword

example: America/Argentina/Buenos_Aires

--

*`client.ip`*::
+
--
IP address of the client (IPv4 or IPv6).

type: ip

--

*`client.mac`*::
+
--
MAC address of the client.
The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.

type: keyword

example: 00-00-5E-00-53-23

--

*`client.nat.ip`*::
+
--
Translated IP of source based NAT sessions (e.g. internal client to internet).
Typically connections traversing load balancers, firewalls, or routers.

type: ip

--

*`client.nat.port`*::
+
--
Translated port of source based NAT sessions (e.g. internal client to internet).
Typically connections traversing load balancers, firewalls, or routers.

type: long

format: string

--

*`client.packets`*::
+
--
Packets sent from the client to the server.

type: long

example: 12

--

*`client.port`*::
+
--
Port of the client.

type: long

format: string

--

*`client.registered_domain`*::
+
--
The highest registered client domain, stripped of the subdomain.
For example, the registered domain for "foo.example.com" is "example.com".
This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk".

type: keyword

example: example.com

--

*`client.subdomain`*::
+
--
The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain.  In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain.
For example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period.

type: keyword

example: east

--

*`client.top_level_domain`*::
+
--
The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com".
This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk".

type: keyword

example: co.uk

--

*`client.user.domain`*::
+
--
Name of the directory the user is a member of.
For example, an LDAP or Active Directory domain name.

type: keyword

--

*`client.user.email`*::
+
--
User email address.

type: keyword

--

*`client.user.full_name`*::
+
--
User's full name, if available.

type: keyword

example: Albert Einstein

--

*`client.user.full_name.text`*::
+
--
type: match_only_text

--

*`client.user.group.domain`*::
+
--
Name of the directory the group is a member of.
For example, an LDAP or Active Directory domain name.

type: keyword

--

*`client.user.group.id`*::
+
--
Unique identifier for the group on the system/platform.

type: keyword

--

*`client.user.group.name`*::
+
--
Name of the group.

type: keyword

--

*`client.user.hash`*::
+
--
Unique user hash to correlate information for a user in anonymized form.
Useful if `user.id` or `user.name` contain confidential information and cannot be used.

type: keyword

--

*`client.user.id`*::
+
--
Unique identifier of the user.

type: keyword

example: S-1-5-21-202424912787-2692429404-2351956786-1000

--

*`client.user.name`*::
+
--
Short name or login of the user.

type: keyword

example: a.einstein

--

*`client.user.name.text`*::
+
--
type: match_only_text

--

*`client.user.roles`*::
+
--
Array of user roles at the time of the event.

type: keyword

example: ["kibana_admin", "reporting_user"]

--

[float]
=== cloud

Fields related to the cloud or infrastructure the events are coming from.


*`cloud.account.id`*::
+
--
The cloud account or organization id used to identify different entities in a multi-tenant environment.
Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.

type: keyword

example: 666777888999

--

*`cloud.account.name`*::
+
--
The cloud account name or alias used to identify different entities in a multi-tenant environment.
Examples: AWS account name, Google Cloud ORG display name.

type: keyword

example: elastic-dev

--

*`cloud.availability_zone`*::
+
--
Availability zone in which this host, resource, or service is located.

type: keyword

example: us-east-1c

--

*`cloud.instance.id`*::
+
--
Instance ID of the host machine.

type: keyword

example: i-1234567890abcdef0

--

*`cloud.instance.name`*::
+
--
Instance name of the host machine.

type: keyword

--

*`cloud.machine.type`*::
+
--
Machine type of the host machine.

type: keyword

example: t2.medium

--

*`cloud.project.id`*::
+
--
The cloud project identifier.
Examples: Google Cloud Project id, Azure Project id.

type: keyword

example: my-project

--

*`cloud.project.name`*::
+
--
The cloud project name.
Examples: Google Cloud Project name, Azure Project name.

type: keyword

example: my project

--

*`cloud.provider`*::
+
--
Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.

type: keyword

example: aws

--

*`cloud.region`*::
+
--
Region in which this host, resource, or service is located.

type: keyword

example: us-east-1

--

*`cloud.service.name`*::
+
--
The cloud service name is intended to distinguish services running on different platforms within a provider, eg AWS EC2 vs Lambda, GCP GCE vs App Engine, Azure VM vs App Server.
Examples: app engine, app service, cloud run, fargate, lambda.

type: keyword

example: lambda

--

[float]
=== code_signature

These fields contain information about binary code signatures.


*`code_signature.digest_algorithm`*::
+
--
The hashing algorithm used to sign the process.
This value can distinguish signatures when a file is signed multiple times by the same signer but with a different digest algorithm.

type: keyword

example: sha256

--

*`code_signature.exists`*::
+
--
Boolean to capture if a signature is present.

type: boolean

example: true

--

*`code_signature.signing_id`*::
+
--
The identifier used to sign the process.
This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.

type: keyword

example: com.apple.xpc.proxy

--

*`code_signature.status`*::
+
--
Additional information about the certificate status.
This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.

type: keyword

example: ERROR_UNTRUSTED_ROOT

--

*`code_signature.subject_name`*::
+
--
Subject name of the code signer

type: keyword

example: Microsoft Corporation

--

*`code_signature.team_id`*::
+
--
The team identifier used to sign the process.
This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.

type: keyword

example: EQHXZ8M8AV

--

*`code_signature.timestamp`*::
+
--
Date and time when the code signature was generated and signed.

type: date

example: 2021-01-01T12:10:30Z

--

*`code_signature.trusted`*::
+
--
Stores the trust status of the certificate chain.
Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.

type: boolean

example: true

--

*`code_signature.valid`*::
+
--
Boolean to capture if the digital signature is verified against the binary content.
Leave unpopulated if a certificate was unchecked.

type: boolean

example: true

--

[float]
=== container

Container fields are used for meta information about the specific container that is the source of information.
These fields help correlate data based containers from any runtime.


*`container.id`*::
+
--
Unique container id.

type: keyword

--

*`container.image.name`*::
+
--
Name of the image the container was built on.

type: keyword

--

*`container.image.tag`*::
+
--
Container image tags.

type: keyword

--

*`container.labels`*::
+
--
Image labels.

type: object

--

*`container.name`*::
+
--
Container name.

type: keyword

--

*`container.runtime`*::
+
--
Runtime managing this container.

type: keyword

example: docker

--

[float]
=== data_stream

The data_stream fields take part in defining the new data stream naming scheme.
In the new data stream naming scheme the value of the data stream fields combine to the name of the actual data stream in the following manner: `{data_stream.type}-{data_stream.dataset}-{data_stream.namespace}`. This means the fields can only contain characters that are valid as part of names of data streams. More details about this can be found in this https://www.elastic.co/blog/an-introduction-to-the-elastic-data-stream-naming-scheme[blog post].
An Elasticsearch data stream consists of one or more backing indices, and a data stream name forms part of the backing indices names. Due to this convention, data streams must also follow index naming restrictions. For example, data stream names cannot include `\`, `/`, `*`, `?`, `"`, `<`, `>`, `|`, ` ` (space character), `,`, or `#`. Please see the Elasticsearch reference for additional https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-create-index.html#indices-create-api-path-params[restrictions].


*`data_stream.dataset`*::
+
--
The field can contain anything that makes sense to signify the source of the data.
Examples include `nginx.access`, `prometheus`, `endpoint` etc. For data streams that otherwise fit, but that do not have dataset set we use the value "generic" for the dataset value. `event.dataset` should have the same value as `data_stream.dataset`.
Beyond the Elasticsearch data stream naming criteria noted above, the `dataset` value has additional restrictions:
  * Must not contain `-`
  * No longer than 100 characters

type: constant_keyword

example: nginx.access

--

*`data_stream.namespace`*::
+
--
A user defined namespace. Namespaces are useful to allow grouping of data.
Many users already organize their indices this way, and the data stream naming scheme now provides this best practice as a default. Many users will populate this field with `default`. If no value is used, it falls back to `default`.
Beyond the Elasticsearch index naming criteria noted above, `namespace` value has the additional restrictions:
  * Must not contain `-`
  * No longer than 100 characters

type: constant_keyword

example: production

--

*`data_stream.type`*::
+
--
An overarching type for the data stream.
Currently allowed values are "logs" and "metrics". We expect to also add "traces" and "synthetics" in the near future.

type: constant_keyword

example: logs

--

[float]
=== destination

Destination fields capture details about the receiver of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.
Destination fields are usually populated in conjunction with source fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.


*`destination.address`*::
+
--
Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.
Then it should be duplicated to `.ip` or `.domain`, depending on which one it is.

type: keyword

--

*`destination.as.number`*::
+
--
Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet.

type: long

example: 15169

--

*`destination.as.organization.name`*::
+
--
Organization name.

type: keyword

example: Google LLC

--

*`destination.as.organization.name.text`*::
+
--
type: match_only_text

--

*`destination.bytes`*::
+
--
Bytes sent from the destination to the source.

type: long

example: 184

format: bytes

--

*`destination.domain`*::
+
--
Destination domain.

type: keyword

--

*`destination.geo.city_name`*::
+
--
City name.

type: keyword

example: Montreal

--

*`destination.geo.continent_code`*::
+
--
Two-letter code representing continent's name.

type: keyword

example: NA

--

*`destination.geo.continent_name`*::
+
--
Name of the continent.

type: keyword

example: North America

--

*`destination.geo.country_iso_code`*::
+
--
Country ISO code.

type: keyword

example: CA

--

*`destination.geo.country_name`*::
+
--
Country name.

type: keyword

example: Canada

--

*`destination.geo.location`*::
+
--
Longitude and latitude.

type: geo_point

example: { "lon": -73.614830, "lat": 45.505918 }

--

*`destination.geo.name`*::
+
--
User-defined description of a location, at the level of granularity they care about.
Could be the name of their data centers, the floor number, if this describes a local physical entity, city names.
Not typically used in automated geolocation.

type: keyword

example: boston-dc

--

*`destination.geo.postal_code`*::
+
--
Postal code associated with the location.
Values appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.

type: keyword

example: 94040

--

*`destination.geo.region_iso_code`*::
+
--
Region ISO code.

type: keyword

example: CA-QC

--

*`destination.geo.region_name`*::
+
--
Region name.

type: keyword

example: Quebec

--

*`destination.geo.timezone`*::
+
--
The time zone of the location, such as IANA time zone name.

type: keyword

example: America/Argentina/Buenos_Aires

--

*`destination.ip`*::
+
--
IP address of the destination (IPv4 or IPv6).

type: ip

--

*`destination.mac`*::
+
--
MAC address of the destination.
The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.

type: keyword

example: 00-00-5E-00-53-23

--

*`destination.nat.ip`*::
+
--
Translated ip of destination based NAT sessions (e.g. internet to private DMZ)
Typically used with load balancers, firewalls, or routers.

type: ip

--

*`destination.nat.port`*::
+
--
Port the source session is translated to by NAT Device.
Typically used with load balancers, firewalls, or routers.

type: long

format: string

--

*`destination.packets`*::
+
--
Packets sent from the destination to the source.

type: long

example: 12

--

*`destination.port`*::
+
--
Port of the destination.

type: long

format: string

--

*`destination.registered_domain`*::
+
--
The highest registered destination domain, stripped of the subdomain.
For example, the registered domain for "foo.example.com" is "example.com".
This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk".

type: keyword

example: example.com

--

*`destination.subdomain`*::
+
--
The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain.  In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain.
For example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period.

type: keyword

example: east

--

*`destination.top_level_domain`*::
+
--
The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com".
This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk".

type: keyword

example: co.uk

--

*`destination.user.domain`*::
+
--
Name of the directory the user is a member of.
For example, an LDAP or Active Directory domain name.

type: keyword

--

*`destination.user.email`*::
+
--
User email address.

type: keyword

--

*`destination.user.full_name`*::
+
--
User's full name, if available.

type: keyword

example: Albert Einstein

--

*`destination.user.full_name.text`*::
+
--
type: match_only_text

--

*`destination.user.group.domain`*::
+
--
Name of the directory the group is a member of.
For example, an LDAP or Active Directory domain name.

type: keyword

--

*`destination.user.group.id`*::
+
--
Unique identifier for the group on the system/platform.

type: keyword

--

*`destination.user.group.name`*::
+
--
Name of the group.

type: keyword

--

*`destination.user.hash`*::
+
--
Unique user hash to correlate information for a user in anonymized form.
Useful if `user.id` or `user.name` contain confidential information and cannot be used.

type: keyword

--

*`destination.user.id`*::
+
--
Unique identifier of the user.

type: keyword

example: S-1-5-21-202424912787-2692429404-2351956786-1000

--

*`destination.user.name`*::
+
--
Short name or login of the user.

type: keyword

example: a.einstein

--

*`destination.user.name.text`*::
+
--
type: match_only_text

--

*`destination.user.roles`*::
+
--
Array of user roles at the time of the event.

type: keyword

example: ["kibana_admin", "reporting_user"]

--

[float]
=== dll

These fields contain information about code libraries dynamically loaded into processes.

Many operating systems refer to "shared code libraries" with different names, but this field set refers to all of the following:
* Dynamic-link library (`.dll`) commonly used on Windows
* Shared Object (`.so`) commonly used on Unix-like operating systems
* Dynamic library (`.dylib`) commonly used on macOS


*`dll.code_signature.digest_algorithm`*::
+
--
The hashing algorithm used to sign the process.
This value can distinguish signatures when a file is signed multiple times by the same signer but with a different digest algorithm.

type: keyword

example: sha256

--

*`dll.code_signature.exists`*::
+
--
Boolean to capture if a signature is present.

type: boolean

example: true

--

*`dll.code_signature.signing_id`*::
+
--
The identifier used to sign the process.
This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.

type: keyword

example: com.apple.xpc.proxy

--

*`dll.code_signature.status`*::
+
--
Additional information about the certificate status.
This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.

type: keyword

example: ERROR_UNTRUSTED_ROOT

--

*`dll.code_signature.subject_name`*::
+
--
Subject name of the code signer

type: keyword

example: Microsoft Corporation

--

*`dll.code_signature.team_id`*::
+
--
The team identifier used to sign the process.
This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.

type: keyword

example: EQHXZ8M8AV

--

*`dll.code_signature.timestamp`*::
+
--
Date and time when the code signature was generated and signed.

type: date

example: 2021-01-01T12:10:30Z

--

*`dll.code_signature.trusted`*::
+
--
Stores the trust status of the certificate chain.
Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.

type: boolean

example: true

--

*`dll.code_signature.valid`*::
+
--
Boolean to capture if the digital signature is verified against the binary content.
Leave unpopulated if a certificate was unchecked.

type: boolean

example: true

--

*`dll.hash.md5`*::
+
--
MD5 hash.

type: keyword

--

*`dll.hash.sha1`*::
+
--
SHA1 hash.

type: keyword

--

*`dll.hash.sha256`*::
+
--
SHA256 hash.

type: keyword

--

*`dll.hash.sha512`*::
+
--
SHA512 hash.

type: keyword

--

*`dll.hash.ssdeep`*::
+
--
SSDEEP hash.

type: keyword

--

*`dll.name`*::
+
--
Name of the library.
This generally maps to the name of the file on disk.

type: keyword

example: kernel32.dll

--

*`dll.path`*::
+
--
Full file path of the library.

type: keyword

example: C:\Windows\System32\kernel32.dll

--

*`dll.pe.architecture`*::
+
--
CPU architecture target for the file.

type: keyword

example: x64

--

*`dll.pe.company`*::
+
--
Internal company name of the file, provided at compile-time.

type: keyword

example: Microsoft Corporation

--

*`dll.pe.description`*::
+
--
Internal description of the file, provided at compile-time.

type: keyword

example: Paint

--

*`dll.pe.file_version`*::
+
--
Internal version of the file, provided at compile-time.

type: keyword

example: 6.3.9600.17415

--

*`dll.pe.imphash`*::
+
--
A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.

type: keyword

example: 0c6803c4e922103c4dca5963aad36ddf

--

*`dll.pe.original_file_name`*::
+
--
Internal name of the file, provided at compile-time.

type: keyword

example: MSPAINT.EXE

--

*`dll.pe.product`*::
+
--
Internal product name of the file, provided at compile-time.

type: keyword

example: Microsoft® Windows® Operating System

--

[float]
=== dns

Fields describing DNS queries and answers.
DNS events should either represent a single DNS query prior to getting answers (`dns.type:query`) or they should represent a full exchange and contain the query details as well as all of the answers that were provided for this query (`dns.type:answer`).


*`dns.answers`*::
+
--
An array containing an object for each answer section returned by the server.
The main keys that should be present in these objects are defined by ECS. Records that have more information may contain more keys than what ECS defines.
Not all DNS data sources give all details about DNS answers. At minimum, answer objects must contain the `data` key. If more information is available, map as much of it to ECS as possible, and add any additional fields to the answer objects as custom fields.

type: object

--

*`dns.answers.class`*::
+
--
The class of DNS data contained in this resource record.

type: keyword

example: IN

--

*`dns.answers.data`*::
+
--
The data describing the resource.
The meaning of this data depends on the type and class of the resource record.

type: keyword

example: 10.10.10.10

--

*`dns.answers.name`*::
+
--
The domain name to which this resource record pertains.
If a chain of CNAME is being resolved, each answer's `name` should be the one that corresponds with the answer's `data`. It should not simply be the original `question.name` repeated.

type: keyword

example: www.example.com

--

*`dns.answers.ttl`*::
+
--
The time interval in seconds that this resource record may be cached before it should be discarded. Zero values mean that the data should not be cached.

type: long

example: 180

--

*`dns.answers.type`*::
+
--
The type of data contained in this resource record.

type: keyword

example: CNAME

--

*`dns.header_flags`*::
+
--
Array of 2 letter DNS header flags.
Expected values are: AA, TC, RD, RA, AD, CD, DO.

type: keyword

example: ["RD", "RA"]

--

*`dns.id`*::
+
--
The DNS packet identifier assigned by the program that generated the query. The identifier is copied to the response.

type: keyword

example: 62111

--

*`dns.op_code`*::
+
--
The DNS operation code that specifies the kind of query in the message. This value is set by the originator of a query and copied into the response.

type: keyword

example: QUERY

--

*`dns.question.class`*::
+
--
The class of records being queried.

type: keyword

example: IN

--

*`dns.question.name`*::
+
--
The name being queried.
If the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \t, \r, and \n respectively.

type: keyword

example: www.example.com

--

*`dns.question.registered_domain`*::
+
--
The highest registered domain, stripped of the subdomain.
For example, the registered domain for "foo.example.com" is "example.com".
This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk".

type: keyword

example: example.com

--

*`dns.question.subdomain`*::
+
--
The subdomain is all of the labels under the registered_domain.
If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period.

type: keyword

example: www

--

*`dns.question.top_level_domain`*::
+
--
The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com".
This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk".

type: keyword

example: co.uk

--

*`dns.question.type`*::
+
--
The type of record being queried.

type: keyword

example: AAAA

--

*`dns.resolved_ip`*::
+
--
Array containing all IPs seen in `answers.data`.
The `answers` array can be difficult to use, because of the variety of data formats it can contain. Extracting all IP addresses seen in there to `dns.resolved_ip` makes it possible to index them as IP addresses, and makes them easier to visualize and query for.

type: ip

example: ["10.10.10.10", "10.10.10.11"]

--

*`dns.response_code`*::
+
--
The DNS response code.

type: keyword

example: NOERROR

--

*`dns.type`*::
+
--
The type of DNS event captured, query or answer.
If your source of DNS events only gives you DNS queries, you should only create dns events of type `dns.type:query`.
If your source of DNS events gives you answers as well, you should create one event per query (optionally as soon as the query is seen). And a second event containing all query details as well as an array of answers.

type: keyword

example: answer

--

[float]
=== ecs

Meta-information specific to ECS.


*`ecs.version`*::
+
--
ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.
When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.

type: keyword

example: 1.0.0

required: True

--

[float]
=== elf

These fields contain Linux Executable Linkable Format (ELF) metadata.


*`elf.architecture`*::
+
--
Machine architecture of the ELF file.

type: keyword

example: x86-64

--

*`elf.byte_order`*::
+
--
Byte sequence of ELF file.

type: keyword

example: Little Endian

--

*`elf.cpu_type`*::
+
--
CPU type of the ELF file.

type: keyword

example: Intel

--

*`elf.creation_date`*::
+
--
Extracted when possible from the file's metadata. Indicates when it was built or compiled. It can also be faked by malware creators.

type: date

--

*`elf.exports`*::
+
--
List of exported element names and types.

type: flattened

--

*`elf.header.abi_version`*::
+
--
Version of the ELF Application Binary Interface (ABI).

type: keyword

--

*`elf.header.class`*::
+
--
Header class of the ELF file.

type: keyword

--

*`elf.header.data`*::
+
--
Data table of the ELF header.

type: keyword

--

*`elf.header.entrypoint`*::
+
--
Header entrypoint of the ELF file.

type: long

format: string

--

*`elf.header.object_version`*::
+
--
"0x1" for original ELF files.

type: keyword

--

*`elf.header.os_abi`*::
+
--
Application Binary Interface (ABI) of the Linux OS.

type: keyword

--

*`elf.header.type`*::
+
--
Header type of the ELF file.

type: keyword

--

*`elf.header.version`*::
+
--
Version of the ELF header.

type: keyword

--

*`elf.imports`*::
+
--
List of imported element names and types.

type: flattened

--

*`elf.sections`*::
+
--
An array containing an object for each section of the ELF file.
The keys that should be present in these objects are defined by sub-fields underneath `elf.sections.*`.

type: nested

--

*`elf.sections.chi2`*::
+
--
Chi-square probability distribution of the section.

type: long

format: number

--

*`elf.sections.entropy`*::
+
--
Shannon entropy calculation from the section.

type: long

format: number

--

*`elf.sections.flags`*::
+
--
ELF Section List flags.

type: keyword

--

*`elf.sections.name`*::
+
--
ELF Section List name.

type: keyword

--

*`elf.sections.physical_offset`*::
+
--
ELF Section List offset.

type: keyword

--

*`elf.sections.physical_size`*::
+
--
ELF Section List physical size.

type: long

format: bytes

--

*`elf.sections.type`*::
+
--
ELF Section List type.

type: keyword

--

*`elf.sections.virtual_address`*::
+
--
ELF Section List virtual address.

type: long

format: string

--

*`elf.sections.virtual_size`*::
+
--
ELF Section List virtual size.

type: long

format: string

--

*`elf.segments`*::
+
--
An array containing an object for each segment of the ELF file.
The keys that should be present in these objects are defined by sub-fields underneath `elf.segments.*`.

type: nested

--

*`elf.segments.sections`*::
+
--
ELF object segment sections.

type: keyword

--

*`elf.segments.type`*::
+
--
ELF object segment type.

type: keyword

--

*`elf.shared_libraries`*::
+
--
List of shared libraries used by this ELF object.

type: keyword

--

*`elf.telfhash`*::
+
--
telfhash symbol hash for ELF file.

type: keyword

--

[float]
=== error

These fields can represent errors of any kind.
Use them for errors that happen while fetching events or in cases where the event itself contains an error.


*`error.code`*::
+
--
Error code describing the error.

type: keyword

--

*`error.id`*::
+
--
Unique identifier for the error.

type: keyword

--

*`error.message`*::
+
--
Error message.

type: match_only_text

--

*`error.stack_trace`*::
+
--
The stack trace of this error in plain text.

type: wildcard

--

*`error.stack_trace.text`*::
+
--
type: match_only_text

--

*`error.type`*::
+
--
The type of the error, for example the class name of the exception.

type: keyword

example: java.lang.NullPointerException

--

[float]
=== event

The event fields are used for context information about the log or metric event itself.
A log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.


*`event.action`*::
+
--
The action captured by the event.
This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.

type: keyword

example: user-password-change

--

*`event.agent_id_status`*::
+
--
Agents are normally responsible for populating the `agent.id` field value. If the system receiving events is capable of validating the value based on authentication information for the client then this field can be used to reflect the outcome of that validation.
For example if the agent's connection is authenticated with mTLS and the client cert contains the ID of the agent to which the cert was issued then the `agent.id` value in events can be checked against the certificate. If the values match then `event.agent_id_status: verified` is added to the event, otherwise one of the other allowed values should be used.
If no validation is performed then the field should be omitted.
The allowed values are:
`verified` - The `agent.id` field value matches expected value obtained from auth metadata.
`mismatch` - The `agent.id` field value does not match the expected value obtained from auth metadata.
`missing` - There was no `agent.id` field in the event to validate.
`auth_metadata_missing` - There was no auth metadata or it was missing information about the agent ID.

type: keyword

example: verified

--

*`event.category`*::
+
--
This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.
`event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.
This field is an array. This will allow proper categorization of some events that fall in multiple categories.

type: keyword

example: authentication

--

*`event.code`*::
+
--
Identification code for this event, if one exists.
Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.

type: keyword

example: 4648

--

*`event.created`*::
+
--
event.created contains the date/time when the event was first read by an agent, or by your pipeline.
This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event.
In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.
In case the two timestamps are identical, @timestamp should be used.

type: date

example: 2016-05-23T08:05:34.857Z

--

*`event.dataset`*::
+
--
Name of the dataset.
If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.
It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.

type: keyword

example: apache.access

--

*`event.duration`*::
+
--
Duration of the event in nanoseconds.
If event.start and event.end are known this value should be the difference between the end and start time.

type: long

format: duration

--

*`event.end`*::
+
--
event.end contains the date when the event ended or when the activity was last observed.

type: date

--

*`event.hash`*::
+
--
Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.

type: keyword

example: 123456789012345678901234567890ABCD

--

*`event.id`*::
+
--
Unique ID to describe the event.

type: keyword

example: 8a4f500d

--

*`event.ingested`*::
+
--
Timestamp when an event arrived in the central data store.
This is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.
In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.

type: date

example: 2016-05-23T08:05:35.101Z

--

*`event.kind`*::
+
--
This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.
`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.
The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not.

type: keyword

example: alert

--

*`event.module`*::
+
--
Name of the module this data is coming from.
If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.

type: keyword

example: apache

--

*`event.original`*::
+
--
Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex.
This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`.

type: keyword

example: Sep 19 08:26:10 host CEF:0&#124;Security&#124; threatmanager&#124;1.0&#124;100&#124; worm successfully stopped&#124;10&#124;src=10.0.0.1 dst=2.1.2.2spt=1232

Field is not indexed.

--

*`event.outcome`*::
+
--
This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.
`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.
Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.
Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.
Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.

type: keyword

example: success

--

*`event.provider`*::
+
--
Source of the event.
Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).

type: keyword

example: kernel

--

*`event.reason`*::
+
--
Reason why this event happened, according to the source.
This describes the why of a particular action or outcome captured in the event. Where `event.action` captures the action from the event, `event.reason` describes why that action was taken. For example, a web proxy with an `event.action` which denied the request may also populate `event.reason` with the reason why (e.g. `blocked site`).

type: keyword

example: Terminated an unexpected process

--

*`event.reference`*::
+
--
Reference URL linking to additional information about this event.
This URL links to a static definition of this event. Alert events, indicated by `event.kind:alert`, are a common use case for this field.

type: keyword

example: https://system.example.com/event/#0001234

--

*`event.risk_score`*::
+
--
Risk score or priority of the event (e.g. security solutions). Use your system's original value here.

type: float

--

*`event.risk_score_norm`*::
+
--
Normalized risk score or priority of the event, on a scale of 0 to 100.
This is mainly useful if you use more than one system that assigns risk scores, and you want to see a normalized value across all systems.

type: float

--

*`event.sequence`*::
+
--
Sequence number of the event.
The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.

type: long

format: string

--

*`event.severity`*::
+
--
The numeric severity of the event according to your event source.
What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.
The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.

type: long

example: 7

format: string

--

*`event.start`*::
+
--
event.start contains the date when the event started or when the activity was first observed.

type: date

--

*`event.timezone`*::
+
--
This field should be populated when the event's timestamp does not include timezone information already (e.g. default Syslog timestamps). It's optional otherwise.
Acceptable timezone formats are: a canonical ID (e.g. "Europe/Amsterdam"), abbreviated (e.g. "EST") or an HH:mm differential (e.g. "-05:00").

type: keyword

--

*`event.type`*::
+
--
This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.
`event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.
This field is an array. This will allow proper categorization of some events that fall in multiple event types.

type: keyword

--

*`event.url`*::
+
--
URL linking to an external system to continue investigation of this event.
This URL links to another system where in-depth investigation of the specific occurrence of this event can take place. Alert events, indicated by `event.kind:alert`, are a common use case for this field.

type: keyword

example: https://mysystem.example.com/alert/5271dedb-f5b0-4218-87f0-4ac4870a38fe

--

[float]
=== file

A file is defined as a set of information that has been created on, or has existed on a filesystem.
File objects can be associated with host events, network events, and/or file events (e.g., those produced by File Integrity Monitoring [FIM] products or services). File fields provide details about the affected file associated with the event or metric.


*`file.accessed`*::
+
--
Last time the file was accessed.
Note that not all filesystems keep track of access time.

type: date

--

*`file.attributes`*::
+
--
Array of file attributes.
Attributes names will vary by platform. Here's a non-exhaustive list of values that are expected in this field: archive, compressed, directory, encrypted, execute, hidden, read, readonly, system, write.

type: keyword

example: ["readonly", "system"]

--

*`file.code_signature.digest_algorithm`*::
+
--
The hashing algorithm used to sign the process.
This value can distinguish signatures when a file is signed multiple times by the same signer but with a different digest algorithm.

type: keyword

example: sha256

--

*`file.code_signature.exists`*::
+
--
Boolean to capture if a signature is present.

type: boolean

example: true

--

*`file.code_signature.signing_id`*::
+
--
The identifier used to sign the process.
This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.

type: keyword

example: com.apple.xpc.proxy

--

*`file.code_signature.status`*::
+
--
Additional information about the certificate status.
This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.

type: keyword

example: ERROR_UNTRUSTED_ROOT

--

*`file.code_signature.subject_name`*::
+
--
Subject name of the code signer

type: keyword

example: Microsoft Corporation

--

*`file.code_signature.team_id`*::
+
--
The team identifier used to sign the process.
This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.

type: keyword

example: EQHXZ8M8AV

--

*`file.code_signature.timestamp`*::
+
--
Date and time when the code signature was generated and signed.

type: date

example: 2021-01-01T12:10:30Z

--

*`file.code_signature.trusted`*::
+
--
Stores the trust status of the certificate chain.
Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.

type: boolean

example: true

--

*`file.code_signature.valid`*::
+
--
Boolean to capture if the digital signature is verified against the binary content.
Leave unpopulated if a certificate was unchecked.

type: boolean

example: true

--

*`file.created`*::
+
--
File creation time.
Note that not all filesystems store the creation time.

type: date

--

*`file.ctime`*::
+
--
Last time the file attributes or metadata changed.
Note that changes to the file content will update `mtime`. This implies `ctime` will be adjusted at the same time, since `mtime` is an attribute of the file.

type: date

--

*`file.device`*::
+
--
Device that is the source of the file.

type: keyword

example: sda

--

*`file.directory`*::
+
--
Directory where the file is located. It should include the drive letter, when appropriate.

type: keyword

example: /home/alice

--

*`file.drive_letter`*::
+
--
Drive letter where the file is located. This field is only relevant on Windows.
The value should be uppercase, and not include the colon.

type: keyword

example: C

--

*`file.elf.architecture`*::
+
--
Machine architecture of the ELF file.

type: keyword

example: x86-64

--

*`file.elf.byte_order`*::
+
--
Byte sequence of ELF file.

type: keyword

example: Little Endian

--

*`file.elf.cpu_type`*::
+
--
CPU type of the ELF file.

type: keyword

example: Intel

--

*`file.elf.creation_date`*::
+
--
Extracted when possible from the file's metadata. Indicates when it was built or compiled. It can also be faked by malware creators.

type: date

--

*`file.elf.exports`*::
+
--
List of exported element names and types.

type: flattened

--

*`file.elf.header.abi_version`*::
+
--
Version of the ELF Application Binary Interface (ABI).

type: keyword

--

*`file.elf.header.class`*::
+
--
Header class of the ELF file.

type: keyword

--

*`file.elf.header.data`*::
+
--
Data table of the ELF header.

type: keyword

--

*`file.elf.header.entrypoint`*::
+
--
Header entrypoint of the ELF file.

type: long

format: string

--

*`file.elf.header.object_version`*::
+
--
"0x1" for original ELF files.

type: keyword

--

*`file.elf.header.os_abi`*::
+
--
Application Binary Interface (ABI) of the Linux OS.

type: keyword

--

*`file.elf.header.type`*::
+
--
Header type of the ELF file.

type: keyword

--

*`file.elf.header.version`*::
+
--
Version of the ELF header.

type: keyword

--

*`file.elf.imports`*::
+
--
List of imported element names and types.

type: flattened

--

*`file.elf.sections`*::
+
--
An array containing an object for each section of the ELF file.
The keys that should be present in these objects are defined by sub-fields underneath `elf.sections.*`.

type: nested

--

*`file.elf.sections.chi2`*::
+
--
Chi-square probability distribution of the section.

type: long

format: number

--

*`file.elf.sections.entropy`*::
+
--
Shannon entropy calculation from the section.

type: long

format: number

--

*`file.elf.sections.flags`*::
+
--
ELF Section List flags.

type: keyword

--

*`file.elf.sections.name`*::
+
--
ELF Section List name.

type: keyword

--

*`file.elf.sections.physical_offset`*::
+
--
ELF Section List offset.

type: keyword

--

*`file.elf.sections.physical_size`*::
+
--
ELF Section List physical size.

type: long

format: bytes

--

*`file.elf.sections.type`*::
+
--
ELF Section List type.

type: keyword

--

*`file.elf.sections.virtual_address`*::
+
--
ELF Section List virtual address.

type: long

format: string

--

*`file.elf.sections.virtual_size`*::
+
--
ELF Section List virtual size.

type: long

format: string

--

*`file.elf.segments`*::
+
--
An array containing an object for each segment of the ELF file.
The keys that should be present in these objects are defined by sub-fields underneath `elf.segments.*`.

type: nested

--

*`file.elf.segments.sections`*::
+
--
ELF object segment sections.

type: keyword

--

*`file.elf.segments.type`*::
+
--
ELF object segment type.

type: keyword

--

*`file.elf.shared_libraries`*::
+
--
List of shared libraries used by this ELF object.

type: keyword

--

*`file.elf.telfhash`*::
+
--
telfhash symbol hash for ELF file.

type: keyword

--

*`file.extension`*::
+
--
File extension, excluding the leading dot.
Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").

type: keyword

example: png

--

*`file.fork_name`*::
+
--
A fork is additional data associated with a filesystem object.
On Linux, a resource fork is used to store additional data with a filesystem object. A file always has at least one fork for the data portion, and additional forks may exist.
On NTFS, this is analogous to an Alternate Data Stream (ADS), and the default data stream for a file is just called $DATA. Zone.Identifier is commonly used by Windows to track contents downloaded from the Internet. An ADS is typically of the form: `C:\path\to\filename.extension:some_fork_name`, and `some_fork_name` is the value that should populate `fork_name`. `filename.extension` should populate `file.name`, and `extension` should populate `file.extension`. The full path, `file.path`, will include the fork name.

type: keyword

example: Zone.Identifer

--

*`file.gid`*::
+
--
Primary group ID (GID) of the file.

type: keyword

example: 1001

--

*`file.group`*::
+
--
Primary group name of the file.

type: keyword

example: alice

--

*`file.hash.md5`*::
+
--
MD5 hash.

type: keyword

--

*`file.hash.sha1`*::
+
--
SHA1 hash.

type: keyword

--

*`file.hash.sha256`*::
+
--
SHA256 hash.

type: keyword

--

*`file.hash.sha512`*::
+
--
SHA512 hash.

type: keyword

--

*`file.hash.ssdeep`*::
+
--
SSDEEP hash.

type: keyword

--

*`file.inode`*::
+
--
Inode representing the file in the filesystem.

type: keyword

example: 256383

--

*`file.mime_type`*::
+
--
MIME type should identify the format of the file or stream of bytes using https://www.iana.org/assignments/media-types/media-types.xhtml[IANA official types], where possible. When more than one type is applicable, the most specific type should be used.

type: keyword

--

*`file.mode`*::
+
--
Mode of the file in octal representation.

type: keyword

example: 0640

--

*`file.mtime`*::
+
--
Last time the file content was modified.

type: date

--

*`file.name`*::
+
--
Name of the file including the extension, without the directory.

type: keyword

example: example.png

--

*`file.owner`*::
+
--
File owner's username.

type: keyword

example: alice

--

*`file.path`*::
+
--
Full path to the file, including the file name. It should include the drive letter, when appropriate.

type: keyword

example: /home/alice/example.png

--

*`file.path.text`*::
+
--
type: match_only_text

--

*`file.pe.architecture`*::
+
--
CPU architecture target for the file.

type: keyword

example: x64

--

*`file.pe.company`*::
+
--
Internal company name of the file, provided at compile-time.

type: keyword

example: Microsoft Corporation

--

*`file.pe.description`*::
+
--
Internal description of the file, provided at compile-time.

type: keyword

example: Paint

--

*`file.pe.file_version`*::
+
--
Internal version of the file, provided at compile-time.

type: keyword

example: 6.3.9600.17415

--

*`file.pe.imphash`*::
+
--
A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.

type: keyword

example: 0c6803c4e922103c4dca5963aad36ddf

--

*`file.pe.original_file_name`*::
+
--
Internal name of the file, provided at compile-time.

type: keyword

example: MSPAINT.EXE

--

*`file.pe.product`*::
+
--
Internal product name of the file, provided at compile-time.

type: keyword

example: Microsoft® Windows® Operating System

--

*`file.size`*::
+
--
File size in bytes.
Only relevant when `file.type` is "file".

type: long

example: 16384

--

*`file.target_path`*::
+
--
Target path for symlinks.

type: keyword

--

*`file.target_path.text`*::
+
--
type: match_only_text

--

*`file.type`*::
+
--
File type (file, dir, or symlink).

type: keyword

example: file

--

*`file.uid`*::
+
--
The user ID (UID) or security identifier (SID) of the file owner.

type: keyword

example: 1001

--

*`file.x509.alternative_names`*::
+
--
List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses.

type: keyword

example: *.elastic.co

--

*`file.x509.issuer.common_name`*::
+
--
List of common name (CN) of issuing certificate authority.

type: keyword

example: Example SHA2 High Assurance Server CA

--

*`file.x509.issuer.country`*::
+
--
List of country (C) codes

type: keyword

example: US

--

*`file.x509.issuer.distinguished_name`*::
+
--
Distinguished name (DN) of issuing certificate authority.

type: keyword

example: C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA

--

*`file.x509.issuer.locality`*::
+
--
List of locality names (L)

type: keyword

example: Mountain View

--

*`file.x509.issuer.organization`*::
+
--
List of organizations (O) of issuing certificate authority.

type: keyword

example: Example Inc

--

*`file.x509.issuer.organizational_unit`*::
+
--
List of organizational units (OU) of issuing certificate authority.

type: keyword

example: www.example.com

--

*`file.x509.issuer.state_or_province`*::
+
--
List of state or province names (ST, S, or P)

type: keyword

example: California

--

*`file.x509.not_after`*::
+
--
Time at which the certificate is no longer considered valid.

type: date

example: 2020-07-16 03:15:39+00:00

--

*`file.x509.not_before`*::
+
--
Time at which the certificate is first considered valid.

type: date

example: 2019-08-16 01:40:25+00:00

--

*`file.x509.public_key_algorithm`*::
+
--
Algorithm used to generate the public key.

type: keyword

example: RSA

--

*`file.x509.public_key_curve`*::
+
--
The curve used by the elliptic curve public key algorithm. This is algorithm specific.

type: keyword

example: nistp521

--

*`file.x509.public_key_exponent`*::
+
--
Exponent used to derive the public key. This is algorithm specific.

type: long

example: 65537

Field is not indexed.

--

*`file.x509.public_key_size`*::
+
--
The size of the public key space in bits.

type: long

example: 2048

--

*`file.x509.serial_number`*::
+
--
Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters.

type: keyword

example: 55FBB9C7DEBF09809D12CCAA

--

*`file.x509.signature_algorithm`*::
+
--
Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353.

type: keyword

example: SHA256-RSA

--

*`file.x509.subject.common_name`*::
+
--
List of common names (CN) of subject.

type: keyword

example: shared.global.example.net

--

*`file.x509.subject.country`*::
+
--
List of country (C) code

type: keyword

example: US

--

*`file.x509.subject.distinguished_name`*::
+
--
Distinguished name (DN) of the certificate subject entity.

type: keyword

example: C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net

--

*`file.x509.subject.locality`*::
+
--
List of locality names (L)

type: keyword

example: San Francisco

--

*`file.x509.subject.organization`*::
+
--
List of organizations (O) of subject.

type: keyword

example: Example, Inc.

--

*`file.x509.subject.organizational_unit`*::
+
--
List of organizational units (OU) of subject.

type: keyword

--

*`file.x509.subject.state_or_province`*::
+
--
List of state or province names (ST, S, or P)

type: keyword

example: California

--

*`file.x509.version_number`*::
+
--
Version of x509 format.

type: keyword

example: 3

--

[float]
=== geo

Geo fields can carry data about a specific location related to an event.
This geolocation information can be derived from techniques such as Geo IP, or be user-supplied.


*`geo.city_name`*::
+
--
City name.

type: keyword

example: Montreal

--

*`geo.continent_code`*::
+
--
Two-letter code representing continent's name.

type: keyword

example: NA

--

*`geo.continent_name`*::
+
--
Name of the continent.

type: keyword

example: North America

--

*`geo.country_iso_code`*::
+
--
Country ISO code.

type: keyword

example: CA

--

*`geo.country_name`*::
+
--
Country name.

type: keyword

example: Canada

--

*`geo.location`*::
+
--
Longitude and latitude.

type: geo_point

example: { "lon": -73.614830, "lat": 45.505918 }

--

*`geo.name`*::
+
--
User-defined description of a location, at the level of granularity they care about.
Could be the name of their data centers, the floor number, if this describes a local physical entity, city names.
Not typically used in automated geolocation.

type: keyword

example: boston-dc

--

*`geo.postal_code`*::
+
--
Postal code associated with the location.
Values appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.

type: keyword

example: 94040

--

*`geo.region_iso_code`*::
+
--
Region ISO code.

type: keyword

example: CA-QC

--

*`geo.region_name`*::
+
--
Region name.

type: keyword

example: Quebec

--

*`geo.timezone`*::
+
--
The time zone of the location, such as IANA time zone name.

type: keyword

example: America/Argentina/Buenos_Aires

--

[float]
=== group

The group fields are meant to represent groups that are relevant to the event.


*`group.domain`*::
+
--
Name of the directory the group is a member of.
For example, an LDAP or Active Directory domain name.

type: keyword

--

*`group.id`*::
+
--
Unique identifier for the group on the system/platform.

type: keyword

--

*`group.name`*::
+
--
Name of the group.

type: keyword

--

[float]
=== hash

The hash fields represent different bitwise hash algorithms and their values.
Field names for common hashes (e.g. MD5, SHA1) are predefined. Add fields for other hashes by lowercasing the hash algorithm name and using underscore separators as appropriate (snake case, e.g. sha3_512).
Note that this fieldset is used for common hashes that may be computed over a range of generic bytes. Entity-specific hashes such as ja3 or imphash are placed in the fieldsets to which they relate (tls and pe, respectively).


*`hash.md5`*::
+
--
MD5 hash.

type: keyword

--

*`hash.sha1`*::
+
--
SHA1 hash.

type: keyword

--

*`hash.sha256`*::
+
--
SHA256 hash.

type: keyword

--

*`hash.sha512`*::
+
--
SHA512 hash.

type: keyword

--

*`hash.ssdeep`*::
+
--
SSDEEP hash.

type: keyword

--

[float]
=== host

A host is defined as a general computing instance.
ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.


*`host.architecture`*::
+
--
Operating system architecture.

type: keyword

example: x86_64

--

*`host.cpu.usage`*::
+
--
Percent CPU used which is normalized by the number of CPU cores and it ranges from 0 to 1.
Scaling factor: 1000.
For example: For a two core host, this value should be the average of the two cores, between 0 and 1.

type: scaled_float

--

*`host.disk.read.bytes`*::
+
--
The total number of bytes (gauge) read successfully (aggregated from all disks) since the last metric collection.

type: long

--

*`host.disk.write.bytes`*::
+
--
The total number of bytes (gauge) written successfully (aggregated from all disks) since the last metric collection.

type: long

--

*`host.domain`*::
+
--
Name of the domain of which the host is a member.
For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.

type: keyword

example: CONTOSO

--

*`host.geo.city_name`*::
+
--
City name.

type: keyword

example: Montreal

--

*`host.geo.continent_code`*::
+
--
Two-letter code representing continent's name.

type: keyword

example: NA

--

*`host.geo.continent_name`*::
+
--
Name of the continent.

type: keyword

example: North America

--

*`host.geo.country_iso_code`*::
+
--
Country ISO code.

type: keyword

example: CA

--

*`host.geo.country_name`*::
+
--
Country name.

type: keyword

example: Canada

--

*`host.geo.location`*::
+
--
Longitude and latitude.

type: geo_point

example: { "lon": -73.614830, "lat": 45.505918 }

--

*`host.geo.name`*::
+
--
User-defined description of a location, at the level of granularity they care about.
Could be the name of their data centers, the floor number, if this describes a local physical entity, city names.
Not typically used in automated geolocation.

type: keyword

example: boston-dc

--

*`host.geo.postal_code`*::
+
--
Postal code associated with the location.
Values appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.

type: keyword

example: 94040

--

*`host.geo.region_iso_code`*::
+
--
Region ISO code.

type: keyword

example: CA-QC

--

*`host.geo.region_name`*::
+
--
Region name.

type: keyword

example: Quebec

--

*`host.geo.timezone`*::
+
--
The time zone of the location, such as IANA time zone name.

type: keyword

example: America/Argentina/Buenos_Aires

--

*`host.hostname`*::
+
--
Hostname of the host.
It normally contains what the `hostname` command returns on the host machine.

type: keyword

--

*`host.id`*::
+
--
Unique host id.
As hostname is not always unique, use values that are meaningful in your environment.
Example: The current usage of `beat.name`.

type: keyword

--

*`host.ip`*::
+
--
Host ip addresses.

type: ip

--

*`host.mac`*::
+
--
Host MAC addresses.
The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.

type: keyword

example: ["00-00-5E-00-53-23", "00-00-5E-00-53-24"]

--

*`host.name`*::
+
--
Name of the host.
It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.

type: keyword

--

*`host.network.egress.bytes`*::
+
--
The number of bytes (gauge) sent out on all network interfaces by the host since the last metric collection.

type: long

--

*`host.network.egress.packets`*::
+
--
The number of packets (gauge) sent out on all network interfaces by the host since the last metric collection.

type: long

--

*`host.network.ingress.bytes`*::
+
--
The number of bytes received (gauge) on all network interfaces by the host since the last metric collection.

type: long

--

*`host.network.ingress.packets`*::
+
--
The number of packets (gauge) received on all network interfaces by the host since the last metric collection.

type: long

--

*`host.os.family`*::
+
--
OS family (such as redhat, debian, freebsd, windows).

type: keyword

example: debian

--

*`host.os.full`*::
+
--
Operating system name, including the version or code name.

type: keyword

example: Mac OS Mojave

--

*`host.os.full.text`*::
+
--
type: match_only_text

--

*`host.os.kernel`*::
+
--
Operating system kernel version as a raw string.

type: keyword

example: 4.4.0-112-generic

--

*`host.os.name`*::
+
--
Operating system name, without the version.

type: keyword

example: Mac OS X

--

*`host.os.name.text`*::
+
--
type: match_only_text

--

*`host.os.platform`*::
+
--
Operating system platform (such centos, ubuntu, windows).

type: keyword

example: darwin

--

*`host.os.type`*::
+
--
Use the `os.type` field to categorize the operating system into one of the broad commercial families.
One of these following values should be used (lowercase): linux, macos, unix, windows.
If the OS you're dealing with is not in the list, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.

type: keyword

example: macos

--

*`host.os.version`*::
+
--
Operating system version as a raw string.

type: keyword

example: 10.14.1

--

*`host.type`*::
+
--
Type of host.
For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.

type: keyword

--

*`host.uptime`*::
+
--
Seconds the host has been up.

type: long

example: 1325

--

*`host.user.domain`*::
+
--
Name of the directory the user is a member of.
For example, an LDAP or Active Directory domain name.

type: keyword

--

*`host.user.email`*::
+
--
User email address.

type: keyword

--

*`host.user.full_name`*::
+
--
User's full name, if available.

type: keyword

example: Albert Einstein

--

*`host.user.full_name.text`*::
+
--
type: match_only_text

--

*`host.user.group.domain`*::
+
--
Name of the directory the group is a member of.
For example, an LDAP or Active Directory domain name.

type: keyword

--

*`host.user.group.id`*::
+
--
Unique identifier for the group on the system/platform.

type: keyword

--

*`host.user.group.name`*::
+
--
Name of the group.

type: keyword

--

*`host.user.hash`*::
+
--
Unique user hash to correlate information for a user in anonymized form.
Useful if `user.id` or `user.name` contain confidential information and cannot be used.

type: keyword

--

*`host.user.id`*::
+
--
Unique identifier of the user.

type: keyword

example: S-1-5-21-202424912787-2692429404-2351956786-1000

--

*`host.user.name`*::
+
--
Short name or login of the user.

type: keyword

example: a.einstein

--

*`host.user.name.text`*::
+
--
type: match_only_text

--

*`host.user.roles`*::
+
--
Array of user roles at the time of the event.

type: keyword

example: ["kibana_admin", "reporting_user"]

--

[float]
=== http

Fields related to HTTP activity. Use the `url` field set to store the url of the request.


*`http.request.body.bytes`*::
+
--
Size in bytes of the request body.

type: long

example: 887

format: bytes

--

*`http.request.body.content`*::
+
--
The full HTTP request body.

type: wildcard

example: Hello world

--

*`http.request.body.content.text`*::
+
--
type: match_only_text

--

*`http.request.bytes`*::
+
--
Total size in bytes of the request (body and headers).

type: long

example: 1437

format: bytes

--

*`http.request.id`*::
+
--
A unique identifier for each HTTP request to correlate logs between clients and servers in transactions.
The id may be contained in a non-standard HTTP header, such as `X-Request-ID` or `X-Correlation-ID`.

type: keyword

example: 123e4567-e89b-12d3-a456-426614174000

--

*`http.request.method`*::
+
--
HTTP request method.
Prior to ECS 1.6.0 the following guidance was provided:
"The field value must be normalized to lowercase for querying."
As of ECS 1.6.0, the guidance is deprecated because the original case of the method may be useful in anomaly detection.  Original case will be mandated in ECS 2.0.0

type: keyword

example: GET, POST, PUT, PoST

--

*`http.request.mime_type`*::
+
--
Mime type of the body of the request.
This value must only be populated based on the content of the request body, not on the `Content-Type` header. Comparing the mime type of a request with the request's Content-Type header can be helpful in detecting threats or misconfigured clients.

type: keyword

example: image/gif

--

*`http.request.referrer`*::
+
--
Referrer for this HTTP request.

type: keyword

example: https://blog.example.com/

--

*`http.response.body.bytes`*::
+
--
Size in bytes of the response body.

type: long

example: 887

format: bytes

--

*`http.response.body.content`*::
+
--
The full HTTP response body.

type: wildcard

example: Hello world

--

*`http.response.body.content.text`*::
+
--
type: match_only_text

--

*`http.response.bytes`*::
+
--
Total size in bytes of the response (body and headers).

type: long

example: 1437

format: bytes

--

*`http.response.mime_type`*::
+
--
Mime type of the body of the response.
This value must only be populated based on the content of the response body, not on the `Content-Type` header. Comparing the mime type of a response with the response's Content-Type header can be helpful in detecting misconfigured servers.

type: keyword

example: image/gif

--

*`http.response.status_code`*::
+
--
HTTP response status code.

type: long

example: 404

format: string

--

*`http.version`*::
+
--
HTTP version.

type: keyword

example: 1.1

--

[float]
=== interface

The interface fields are used to record ingress and egress interface information when reported by an observer (e.g. firewall, router, load balancer) in the context of the observer handling a network connection.  In the case of a single observer interface (e.g. network sensor on a span port) only the observer.ingress information should be populated.


*`interface.alias`*::
+
--
Interface alias as reported by the system, typically used in firewall implementations for e.g. inside, outside, or dmz logical interface naming.

type: keyword

example: outside

--

*`interface.id`*::
+
--
Interface ID as reported by an observer (typically SNMP interface ID).

type: keyword

example: 10

--

*`interface.name`*::
+
--
Interface name as reported by the system.

type: keyword

example: eth0

--

[float]
=== log

Details about the event's logging mechanism or logging transport.
The log.* fields are typically populated with details about the logging mechanism used to create and/or transport the event. For example, syslog details belong under `log.syslog.*`.
The details specific to your event source are typically not logged under `log.*`, but rather in `event.*` or in other ECS fields.


*`log.file.path`*::
+
--
Full path to the log file this event came from, including the file name. It should include the drive letter, when appropriate.
If the event wasn't read from a log file, do not populate this field.

type: keyword

example: /var/log/fun-times.log

--

*`log.level`*::
+
--
Original log level of the log event.
If the source of the event provides a log level or textual severity, this is the one that goes in `log.level`. If your source doesn't specify one, you may put your event transport's severity here (e.g. Syslog severity).
Some examples are `warn`, `err`, `i`, `informational`.

type: keyword

example: error

--

*`log.logger`*::
+
--
The name of the logger inside an application. This is usually the name of the class which initialized the logger, or can be a custom name.

type: keyword

example: org.elasticsearch.bootstrap.Bootstrap

--

*`log.origin.file.line`*::
+
--
The line number of the file containing the source code which originated the log event.

type: integer

example: 42

--

*`log.origin.file.name`*::
+
--
The name of the file containing the source code which originated the log event.
Note that this field is not meant to capture the log file. The correct field to capture the log file is `log.file.path`.

type: keyword

example: Bootstrap.java

--

*`log.origin.function`*::
+
--
The name of the function or method which originated the log event.

type: keyword

example: init

--

*`log.original`*::
+
--
Deprecated for removal in next major version release. This field is superseded by  `event.original`.
This is the original log message and contains the full log message before splitting it up in multiple parts.
In contrast to the `message` field which can contain an extracted part of the log message, this field contains the original, full log message. It can have already some modifications applied like encoding or new lines removed to clean up the log message.
This field is not indexed and doc_values are disabled so it can't be queried but the value can be retrieved from `_source`.

type: keyword

example: Sep 19 08:26:10 localhost My log

Field is not indexed.

--

*`log.syslog`*::
+
--
The Syslog metadata of the event, if the event was transmitted via Syslog. Please see RFCs 5424 or 3164.

type: object

--

*`log.syslog.facility.code`*::
+
--
The Syslog numeric facility of the log event, if available.
According to RFCs 5424 and 3164, this value should be an integer between 0 and 23.

type: long

example: 23

format: string

--

*`log.syslog.facility.name`*::
+
--
The Syslog text-based facility of the log event, if available.

type: keyword

example: local7

--

*`log.syslog.priority`*::
+
--
Syslog numeric priority of the event, if available.
According to RFCs 5424 and 3164, the priority is 8 * facility + severity. This number is therefore expected to contain a value between 0 and 191.

type: long

example: 135

format: string

--

*`log.syslog.severity.code`*::
+
--
The Syslog numeric severity of the log event, if available.
If the event source publishing via Syslog provides a different numeric severity value (e.g. firewall, IDS), your source's numeric severity should go to `event.severity`. If the event source does not specify a distinct severity, you can optionally copy the Syslog severity to `event.severity`.

type: long

example: 3

--

*`log.syslog.severity.name`*::
+
--
The Syslog numeric severity of the log event, if available.
If the event source publishing via Syslog provides a different severity value (e.g. firewall, IDS), your source's text severity should go to `log.level`. If the event source does not specify a distinct severity, you can optionally copy the Syslog severity to `log.level`.

type: keyword

example: Error

--

[float]
=== network

The network is defined as the communication path over which a host or network event happens.
The network.* fields should be populated with details about the network activity associated with an event.


*`network.application`*::
+
--
A name given to an application level protocol. This can be arbitrarily assigned for things like microservices, but also apply to things like skype, icq, facebook, twitter. This would be used in situations where the vendor or service can be decoded such as from the source/dest IP owners, ports, or wire format.
The field value must be normalized to lowercase for querying. See the documentation section "Implementing ECS".

type: keyword

example: aim

--

*`network.bytes`*::
+
--
Total bytes transferred in both directions.
If `source.bytes` and `destination.bytes` are known, `network.bytes` is their sum.

type: long

example: 368

format: bytes

--

*`network.community_id`*::
+
--
A hash of source and destination IPs and ports, as well as the protocol used in a communication. This is a tool-agnostic standard to identify flows.
Learn more at https://github.com/corelight/community-id-spec.

type: keyword

example: 1:hO+sN4H+MG5MY/8hIrXPqc4ZQz0=

--

*`network.direction`*::
+
--
Direction of the network traffic.
Recommended values are:
  * ingress
  * egress
  * inbound
  * outbound
  * internal
  * external
  * unknown

When mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values "ingress" or "egress".
When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external".
Note that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers.

type: keyword

example: inbound

--

*`network.forwarded_ip`*::
+
--
Host IP address when the source IP address is the proxy.

type: ip

example: 192.1.1.2

--

*`network.iana_number`*::
+
--
IANA Protocol Number (https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml). Standardized list of protocols. This aligns well with NetFlow and sFlow related logs which use the IANA Protocol Number.

type: keyword

example: 6

--

*`network.inner`*::
+
--
Network.inner fields are added in addition to network.vlan fields to describe the innermost VLAN when q-in-q VLAN tagging is present. Allowed fields include vlan.id and vlan.name. Inner vlan fields are typically used when sending traffic with multiple 802.1q encapsulations to a network sensor (e.g. Zeek, Wireshark.)

type: object

--

*`network.inner.vlan.id`*::
+
--
VLAN ID as reported by the observer.

type: keyword

example: 10

--

*`network.inner.vlan.name`*::
+
--
Optional VLAN name as reported by the observer.

type: keyword

example: outside

--

*`network.name`*::
+
--
Name given by operators to sections of their network.

type: keyword

example: Guest Wifi

--

*`network.packets`*::
+
--
Total packets transferred in both directions.
If `source.packets` and `destination.packets` are known, `network.packets` is their sum.

type: long

example: 24

--

*`network.protocol`*::
+
--
L7 Network protocol name. ex. http, lumberjack, transport protocol.
The field value must be normalized to lowercase for querying. See the documentation section "Implementing ECS".

type: keyword

example: http

--

*`network.transport`*::
+
--
Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)
The field value must be normalized to lowercase for querying. See the documentation section "Implementing ECS".

type: keyword

example: tcp

--

*`network.type`*::
+
--
In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc
The field value must be normalized to lowercase for querying. See the documentation section "Implementing ECS".

type: keyword

example: ipv4

--

*`network.vlan.id`*::
+
--
VLAN ID as reported by the observer.

type: keyword

example: 10

--

*`network.vlan.name`*::
+
--
Optional VLAN name as reported by the observer.

type: keyword

example: outside

--

[float]
=== observer

An observer is defined as a special network, security, or application device used to detect, observe, or create network, security, or application-related events and metrics.
This could be a custom hardware appliance or a server that has been configured to run special network, security, or application software. Examples include firewalls, web proxies, intrusion detection/prevention systems, network monitoring sensors, web application firewalls, data loss prevention systems, and APM servers. The observer.* fields shall be populated with details of the system, if any, that detects, observes and/or creates a network, security, or application event or metric. Message queues and ETL components used in processing events or metrics are not considered observers in ECS.


*`observer.egress`*::
+
--
Observer.egress holds information like interface number and name, vlan, and zone information to classify egress traffic.  Single armed monitoring such as a network sensor on a span port should only use observer.ingress to categorize traffic.

type: object

--

*`observer.egress.interface.alias`*::
+
--
Interface alias as reported by the system, typically used in firewall implementations for e.g. inside, outside, or dmz logical interface naming.

type: keyword

example: outside

--

*`observer.egress.interface.id`*::
+
--
Interface ID as reported by an observer (typically SNMP interface ID).

type: keyword

example: 10

--

*`observer.egress.interface.name`*::
+
--
Interface name as reported by the system.

type: keyword

example: eth0

--

*`observer.egress.vlan.id`*::
+
--
VLAN ID as reported by the observer.

type: keyword

example: 10

--

*`observer.egress.vlan.name`*::
+
--
Optional VLAN name as reported by the observer.

type: keyword

example: outside

--

*`observer.egress.zone`*::
+
--
Network zone of outbound traffic as reported by the observer to categorize the destination area of egress traffic, e.g. Internal, External, DMZ, HR, Legal, etc.

type: keyword

example: Public_Internet

--

*`observer.geo.city_name`*::
+
--
City name.

type: keyword

example: Montreal

--

*`observer.geo.continent_code`*::
+
--
Two-letter code representing continent's name.

type: keyword

example: NA

--

*`observer.geo.continent_name`*::
+
--
Name of the continent.

type: keyword

example: North America

--

*`observer.geo.country_iso_code`*::
+
--
Country ISO code.

type: keyword

example: CA

--

*`observer.geo.country_name`*::
+
--
Country name.

type: keyword

example: Canada

--

*`observer.geo.location`*::
+
--
Longitude and latitude.

type: geo_point

example: { "lon": -73.614830, "lat": 45.505918 }

--

*`observer.geo.name`*::
+
--
User-defined description of a location, at the level of granularity they care about.
Could be the name of their data centers, the floor number, if this describes a local physical entity, city names.
Not typically used in automated geolocation.

type: keyword

example: boston-dc

--

*`observer.geo.postal_code`*::
+
--
Postal code associated with the location.
Values appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.

type: keyword

example: 94040

--

*`observer.geo.region_iso_code`*::
+
--
Region ISO code.

type: keyword

example: CA-QC

--

*`observer.geo.region_name`*::
+
--
Region name.

type: keyword

example: Quebec

--

*`observer.geo.timezone`*::
+
--
The time zone of the location, such as IANA time zone name.

type: keyword

example: America/Argentina/Buenos_Aires

--

*`observer.hostname`*::
+
--
Hostname of the observer.

type: keyword

--

*`observer.ingress`*::
+
--
Observer.ingress holds information like interface number and name, vlan, and zone information to classify ingress traffic.  Single armed monitoring such as a network sensor on a span port should only use observer.ingress to categorize traffic.

type: object

--

*`observer.ingress.interface.alias`*::
+
--
Interface alias as reported by the system, typically used in firewall implementations for e.g. inside, outside, or dmz logical interface naming.

type: keyword

example: outside

--

*`observer.ingress.interface.id`*::
+
--
Interface ID as reported by an observer (typically SNMP interface ID).

type: keyword

example: 10

--

*`observer.ingress.interface.name`*::
+
--
Interface name as reported by the system.

type: keyword

example: eth0

--

*`observer.ingress.vlan.id`*::
+
--
VLAN ID as reported by the observer.

type: keyword

example: 10

--

*`observer.ingress.vlan.name`*::
+
--
Optional VLAN name as reported by the observer.

type: keyword

example: outside

--

*`observer.ingress.zone`*::
+
--
Network zone of incoming traffic as reported by the observer to categorize the source area of ingress traffic. e.g. internal, External, DMZ, HR, Legal, etc.

type: keyword

example: DMZ

--

*`observer.ip`*::
+
--
IP addresses of the observer.

type: ip

--

*`observer.mac`*::
+
--
MAC addresses of the observer.
The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.

type: keyword

example: ["00-00-5E-00-53-23", "00-00-5E-00-53-24"]

--

*`observer.name`*::
+
--
Custom name of the observer.
This is a name that can be given to an observer. This can be helpful for example if multiple firewalls of the same model are used in an organization.
If no custom name is needed, the field can be left empty.

type: keyword

example: 1_proxySG

--

*`observer.os.family`*::
+
--
OS family (such as redhat, debian, freebsd, windows).

type: keyword

example: debian

--

*`observer.os.full`*::
+
--
Operating system name, including the version or code name.

type: keyword

example: Mac OS Mojave

--

*`observer.os.full.text`*::
+
--
type: match_only_text

--

*`observer.os.kernel`*::
+
--
Operating system kernel version as a raw string.

type: keyword

example: 4.4.0-112-generic

--

*`observer.os.name`*::
+
--
Operating system name, without the version.

type: keyword

example: Mac OS X

--

*`observer.os.name.text`*::
+
--
type: match_only_text

--

*`observer.os.platform`*::
+
--
Operating system platform (such centos, ubuntu, windows).

type: keyword

example: darwin

--

*`observer.os.type`*::
+
--
Use the `os.type` field to categorize the operating system into one of the broad commercial families.
One of these following values should be used (lowercase): linux, macos, unix, windows.
If the OS you're dealing with is not in the list, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.

type: keyword

example: macos

--

*`observer.os.version`*::
+
--
Operating system version as a raw string.

type: keyword

example: 10.14.1

--

*`observer.product`*::
+
--
The product name of the observer.

type: keyword

example: s200

--

*`observer.serial_number`*::
+
--
Observer serial number.

type: keyword

--

*`observer.type`*::
+
--
The type of the observer the data is coming from.
There is no predefined list of observer types. Some examples are `forwarder`, `firewall`, `ids`, `ips`, `proxy`, `poller`, `sensor`, `APM server`.

type: keyword

example: firewall

--

*`observer.vendor`*::
+
--
Vendor name of the observer.

type: keyword

example: Symantec

--

*`observer.version`*::
+
--
Observer version.

type: keyword

--

[float]
=== orchestrator

Fields that describe the resources which container orchestrators manage or act upon.


*`orchestrator.api_version`*::
+
--
API version being used to carry out the action

type: keyword

example: v1beta1

--

*`orchestrator.cluster.name`*::
+
--
Name of the cluster.

type: keyword

--

*`orchestrator.cluster.url`*::
+
--
URL of the API used to manage the cluster.

type: keyword

--

*`orchestrator.cluster.version`*::
+
--
The version of the cluster.

type: keyword

--

*`orchestrator.namespace`*::
+
--
Namespace in which the action is taking place.

type: keyword

example: kube-system

--

*`orchestrator.organization`*::
+
--
Organization affected by the event (for multi-tenant orchestrator setups).

type: keyword

example: elastic

--

*`orchestrator.resource.name`*::
+
--
Name of the resource being acted upon.

type: keyword

example: test-pod-cdcws

--

*`orchestrator.resource.type`*::
+
--
Type of resource being acted upon.

type: keyword

example: service

--

*`orchestrator.type`*::
+
--
Orchestrator cluster type (e.g. kubernetes, nomad or cloudfoundry).

type: keyword

example: kubernetes

--

[float]
=== organization

The organization fields enrich data with information about the company or entity the data is associated with.
These fields help you arrange or filter data stored in an index by one or multiple organizations.


*`organization.id`*::
+
--
Unique identifier for the organization.

type: keyword

--

*`organization.name`*::
+
--
Organization name.

type: keyword

--

*`organization.name.text`*::
+
--
type: match_only_text

--

[float]
=== os

The OS fields contain information about the operating system.


*`os.family`*::
+
--
OS family (such as redhat, debian, freebsd, windows).

type: keyword

example: debian

--

*`os.full`*::
+
--
Operating system name, including the version or code name.

type: keyword

example: Mac OS Mojave

--

*`os.full.text`*::
+
--
type: match_only_text

--

*`os.kernel`*::
+
--
Operating system kernel version as a raw string.

type: keyword

example: 4.4.0-112-generic

--

*`os.name`*::
+
--
Operating system name, without the version.

type: keyword

example: Mac OS X

--

*`os.name.text`*::
+
--
type: match_only_text

--

*`os.platform`*::
+
--
Operating system platform (such centos, ubuntu, windows).

type: keyword

example: darwin

--

*`os.type`*::
+
--
Use the `os.type` field to categorize the operating system into one of the broad commercial families.
One of these following values should be used (lowercase): linux, macos, unix, windows.
If the OS you're dealing with is not in the list, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.

type: keyword

example: macos

--

*`os.version`*::
+
--
Operating system version as a raw string.

type: keyword

example: 10.14.1

--

[float]
=== package

These fields contain information about an installed software package. It contains general information about a package, such as name, version or size. It also contains installation details, such as time or location.


*`package.architecture`*::
+
--
Package architecture.

type: keyword

example: x86_64

--

*`package.build_version`*::
+
--
Additional information about the build version of the installed package.
For example use the commit SHA of a non-released package.

type: keyword

example: 36f4f7e89dd61b0988b12ee000b98966867710cd

--

*`package.checksum`*::
+
--
Checksum of the installed package for verification.

type: keyword

example: 68b329da9893e34099c7d8ad5cb9c940

--

*`package.description`*::
+
--
Description of the package.

type: keyword

example: Open source programming language to build simple/reliable/efficient software.

--

*`package.install_scope`*::
+
--
Indicating how the package was installed, e.g. user-local, global.

type: keyword

example: global

--

*`package.installed`*::
+
--
Time when package was installed.

type: date

--

*`package.license`*::
+
--
License under which the package was released.
Use a short name, e.g. the license identifier from SPDX License List where possible (https://spdx.org/licenses/).

type: keyword

example: Apache License 2.0

--

*`package.name`*::
+
--
Package name

type: keyword

example: go

--

*`package.path`*::
+
--
Path where the package is installed.

type: keyword

example: /usr/local/Cellar/go/1.12.9/

--

*`package.reference`*::
+
--
Home page or reference URL of the software in this package, if available.

type: keyword

example: https://golang.org

--

*`package.size`*::
+
--
Package size in bytes.

type: long

example: 62231

format: string

--

*`package.type`*::
+
--
Type of package.
This should contain the package file type, rather than the package manager name. Examples: rpm, dpkg, brew, npm, gem, nupkg, jar.

type: keyword

example: rpm

--

*`package.version`*::
+
--
Package version

type: keyword

example: 1.12.9

--

[float]
=== pe

These fields contain Windows Portable Executable (PE) metadata.


*`pe.architecture`*::
+
--
CPU architecture target for the file.

type: keyword

example: x64

--

*`pe.company`*::
+
--
Internal company name of the file, provided at compile-time.

type: keyword

example: Microsoft Corporation

--

*`pe.description`*::
+
--
Internal description of the file, provided at compile-time.

type: keyword

example: Paint

--

*`pe.file_version`*::
+
--
Internal version of the file, provided at compile-time.

type: keyword

example: 6.3.9600.17415

--

*`pe.imphash`*::
+
--
A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.

type: keyword

example: 0c6803c4e922103c4dca5963aad36ddf

--

*`pe.original_file_name`*::
+
--
Internal name of the file, provided at compile-time.

type: keyword

example: MSPAINT.EXE

--

*`pe.product`*::
+
--
Internal product name of the file, provided at compile-time.

type: keyword

example: Microsoft® Windows® Operating System

--

[float]
=== process

These fields contain information about a process.
These fields can help you correlate metrics information with a process id/name from a log message.  The `process.pid` often stays in the metric itself and is copied to the global field for correlation.


*`process.args`*::
+
--
Array of process arguments, starting with the absolute path to the executable.
May be filtered to protect sensitive information.

type: keyword

example: ["/usr/bin/ssh", "-l", "user", "10.0.0.16"]

--

*`process.args_count`*::
+
--
Length of the process.args array.
This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.

type: long

example: 4

--

*`process.code_signature.digest_algorithm`*::
+
--
The hashing algorithm used to sign the process.
This value can distinguish signatures when a file is signed multiple times by the same signer but with a different digest algorithm.

type: keyword

example: sha256

--

*`process.code_signature.exists`*::
+
--
Boolean to capture if a signature is present.

type: boolean

example: true

--

*`process.code_signature.signing_id`*::
+
--
The identifier used to sign the process.
This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.

type: keyword

example: com.apple.xpc.proxy

--

*`process.code_signature.status`*::
+
--
Additional information about the certificate status.
This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.

type: keyword

example: ERROR_UNTRUSTED_ROOT

--

*`process.code_signature.subject_name`*::
+
--
Subject name of the code signer

type: keyword

example: Microsoft Corporation

--

*`process.code_signature.team_id`*::
+
--
The team identifier used to sign the process.
This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.

type: keyword

example: EQHXZ8M8AV

--

*`process.code_signature.timestamp`*::
+
--
Date and time when the code signature was generated and signed.

type: date

example: 2021-01-01T12:10:30Z

--

*`process.code_signature.trusted`*::
+
--
Stores the trust status of the certificate chain.
Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.

type: boolean

example: true

--

*`process.code_signature.valid`*::
+
--
Boolean to capture if the digital signature is verified against the binary content.
Leave unpopulated if a certificate was unchecked.

type: boolean

example: true

--

*`process.command_line`*::
+
--
Full command line that started the process, including the absolute path to the executable, and all arguments.
Some arguments may be filtered to protect sensitive information.

type: wildcard

example: /usr/bin/ssh -l user 10.0.0.16

--

*`process.command_line.text`*::
+
--
type: match_only_text

--

*`process.elf.architecture`*::
+
--
Machine architecture of the ELF file.

type: keyword

example: x86-64

--

*`process.elf.byte_order`*::
+
--
Byte sequence of ELF file.

type: keyword

example: Little Endian

--

*`process.elf.cpu_type`*::
+
--
CPU type of the ELF file.

type: keyword

example: Intel

--

*`process.elf.creation_date`*::
+
--
Extracted when possible from the file's metadata. Indicates when it was built or compiled. It can also be faked by malware creators.

type: date

--

*`process.elf.exports`*::
+
--
List of exported element names and types.

type: flattened

--

*`process.elf.header.abi_version`*::
+
--
Version of the ELF Application Binary Interface (ABI).

type: keyword

--

*`process.elf.header.class`*::
+
--
Header class of the ELF file.

type: keyword

--

*`process.elf.header.data`*::
+
--
Data table of the ELF header.

type: keyword

--

*`process.elf.header.entrypoint`*::
+
--
Header entrypoint of the ELF file.

type: long

format: string

--

*`process.elf.header.object_version`*::
+
--
"0x1" for original ELF files.

type: keyword

--

*`process.elf.header.os_abi`*::
+
--
Application Binary Interface (ABI) of the Linux OS.

type: keyword

--

*`process.elf.header.type`*::
+
--
Header type of the ELF file.

type: keyword

--

*`process.elf.header.version`*::
+
--
Version of the ELF header.

type: keyword

--

*`process.elf.imports`*::
+
--
List of imported element names and types.

type: flattened

--

*`process.elf.sections`*::
+
--
An array containing an object for each section of the ELF file.
The keys that should be present in these objects are defined by sub-fields underneath `elf.sections.*`.

type: nested

--

*`process.elf.sections.chi2`*::
+
--
Chi-square probability distribution of the section.

type: long

format: number

--

*`process.elf.sections.entropy`*::
+
--
Shannon entropy calculation from the section.

type: long

format: number

--

*`process.elf.sections.flags`*::
+
--
ELF Section List flags.

type: keyword

--

*`process.elf.sections.name`*::
+
--
ELF Section List name.

type: keyword

--

*`process.elf.sections.physical_offset`*::
+
--
ELF Section List offset.

type: keyword

--

*`process.elf.sections.physical_size`*::
+
--
ELF Section List physical size.

type: long

format: bytes

--

*`process.elf.sections.type`*::
+
--
ELF Section List type.

type: keyword

--

*`process.elf.sections.virtual_address`*::
+
--
ELF Section List virtual address.

type: long

format: string

--

*`process.elf.sections.virtual_size`*::
+
--
ELF Section List virtual size.

type: long

format: string

--

*`process.elf.segments`*::
+
--
An array containing an object for each segment of the ELF file.
The keys that should be present in these objects are defined by sub-fields underneath `elf.segments.*`.

type: nested

--

*`process.elf.segments.sections`*::
+
--
ELF object segment sections.

type: keyword

--

*`process.elf.segments.type`*::
+
--
ELF object segment type.

type: keyword

--

*`process.elf.shared_libraries`*::
+
--
List of shared libraries used by this ELF object.

type: keyword

--

*`process.elf.telfhash`*::
+
--
telfhash symbol hash for ELF file.

type: keyword

--

*`process.end`*::
+
--
The time the process ended.

type: date

example: 2016-05-23T08:05:34.853Z

--

*`process.entity_id`*::
+
--
Unique identifier for the process.
The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.

type: keyword

example: c2c455d9f99375d

--

*`process.executable`*::
+
--
Absolute path to the process executable.

type: keyword

example: /usr/bin/ssh

--

*`process.executable.text`*::
+
--
type: match_only_text

--

*`process.exit_code`*::
+
--
The exit code of the process, if this is a termination event.
The field should be absent if there is no exit code for the event (e.g. process start).

type: long

example: 137

--

*`process.hash.md5`*::
+
--
MD5 hash.

type: keyword

--

*`process.hash.sha1`*::
+
--
SHA1 hash.

type: keyword

--

*`process.hash.sha256`*::
+
--
SHA256 hash.

type: keyword

--

*`process.hash.sha512`*::
+
--
SHA512 hash.

type: keyword

--

*`process.hash.ssdeep`*::
+
--
SSDEEP hash.

type: keyword

--

*`process.name`*::
+
--
Process name.
Sometimes called program name or similar.

type: keyword

example: ssh

--

*`process.name.text`*::
+
--
type: match_only_text

--

*`process.parent.args`*::
+
--
Array of process arguments, starting with the absolute path to the executable.
May be filtered to protect sensitive information.

type: keyword

example: ["/usr/bin/ssh", "-l", "user", "10.0.0.16"]

--

*`process.parent.args_count`*::
+
--
Length of the process.args array.
This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.

type: long

example: 4

--

*`process.parent.code_signature.digest_algorithm`*::
+
--
The hashing algorithm used to sign the process.
This value can distinguish signatures when a file is signed multiple times by the same signer but with a different digest algorithm.

type: keyword

example: sha256

--

*`process.parent.code_signature.exists`*::
+
--
Boolean to capture if a signature is present.

type: boolean

example: true

--

*`process.parent.code_signature.signing_id`*::
+
--
The identifier used to sign the process.
This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.

type: keyword

example: com.apple.xpc.proxy

--

*`process.parent.code_signature.status`*::
+
--
Additional information about the certificate status.
This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.

type: keyword

example: ERROR_UNTRUSTED_ROOT

--

*`process.parent.code_signature.subject_name`*::
+
--
Subject name of the code signer

type: keyword

example: Microsoft Corporation

--

*`process.parent.code_signature.team_id`*::
+
--
The team identifier used to sign the process.
This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.

type: keyword

example: EQHXZ8M8AV

--

*`process.parent.code_signature.timestamp`*::
+
--
Date and time when the code signature was generated and signed.

type: date

example: 2021-01-01T12:10:30Z

--

*`process.parent.code_signature.trusted`*::
+
--
Stores the trust status of the certificate chain.
Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.

type: boolean

example: true

--

*`process.parent.code_signature.valid`*::
+
--
Boolean to capture if the digital signature is verified against the binary content.
Leave unpopulated if a certificate was unchecked.

type: boolean

example: true

--

*`process.parent.command_line`*::
+
--
Full command line that started the process, including the absolute path to the executable, and all arguments.
Some arguments may be filtered to protect sensitive information.

type: wildcard

example: /usr/bin/ssh -l user 10.0.0.16

--

*`process.parent.command_line.text`*::
+
--
type: match_only_text

--

*`process.parent.elf.architecture`*::
+
--
Machine architecture of the ELF file.

type: keyword

example: x86-64

--

*`process.parent.elf.byte_order`*::
+
--
Byte sequence of ELF file.

type: keyword

example: Little Endian

--

*`process.parent.elf.cpu_type`*::
+
--
CPU type of the ELF file.

type: keyword

example: Intel

--

*`process.parent.elf.creation_date`*::
+
--
Extracted when possible from the file's metadata. Indicates when it was built or compiled. It can also be faked by malware creators.

type: date

--

*`process.parent.elf.exports`*::
+
--
List of exported element names and types.

type: flattened

--

*`process.parent.elf.header.abi_version`*::
+
--
Version of the ELF Application Binary Interface (ABI).

type: keyword

--

*`process.parent.elf.header.class`*::
+
--
Header class of the ELF file.

type: keyword

--

*`process.parent.elf.header.data`*::
+
--
Data table of the ELF header.

type: keyword

--

*`process.parent.elf.header.entrypoint`*::
+
--
Header entrypoint of the ELF file.

type: long

format: string

--

*`process.parent.elf.header.object_version`*::
+
--
"0x1" for original ELF files.

type: keyword

--

*`process.parent.elf.header.os_abi`*::
+
--
Application Binary Interface (ABI) of the Linux OS.

type: keyword

--

*`process.parent.elf.header.type`*::
+
--
Header type of the ELF file.

type: keyword

--

*`process.parent.elf.header.version`*::
+
--
Version of the ELF header.

type: keyword

--

*`process.parent.elf.imports`*::
+
--
List of imported element names and types.

type: flattened

--

*`process.parent.elf.sections`*::
+
--
An array containing an object for each section of the ELF file.
The keys that should be present in these objects are defined by sub-fields underneath `elf.sections.*`.

type: nested

--

*`process.parent.elf.sections.chi2`*::
+
--
Chi-square probability distribution of the section.

type: long

format: number

--

*`process.parent.elf.sections.entropy`*::
+
--
Shannon entropy calculation from the section.

type: long

format: number

--

*`process.parent.elf.sections.flags`*::
+
--
ELF Section List flags.

type: keyword

--

*`process.parent.elf.sections.name`*::
+
--
ELF Section List name.

type: keyword

--

*`process.parent.elf.sections.physical_offset`*::
+
--
ELF Section List offset.

type: keyword

--

*`process.parent.elf.sections.physical_size`*::
+
--
ELF Section List physical size.

type: long

format: bytes

--

*`process.parent.elf.sections.type`*::
+
--
ELF Section List type.

type: keyword

--

*`process.parent.elf.sections.virtual_address`*::
+
--
ELF Section List virtual address.

type: long

format: string

--

*`process.parent.elf.sections.virtual_size`*::
+
--
ELF Section List virtual size.

type: long

format: string

--

*`process.parent.elf.segments`*::
+
--
An array containing an object for each segment of the ELF file.
The keys that should be present in these objects are defined by sub-fields underneath `elf.segments.*`.

type: nested

--

*`process.parent.elf.segments.sections`*::
+
--
ELF object segment sections.

type: keyword

--

*`process.parent.elf.segments.type`*::
+
--
ELF object segment type.

type: keyword

--

*`process.parent.elf.shared_libraries`*::
+
--
List of shared libraries used by this ELF object.

type: keyword

--

*`process.parent.elf.telfhash`*::
+
--
telfhash symbol hash for ELF file.

type: keyword

--

*`process.parent.end`*::
+
--
The time the process ended.

type: date

example: 2016-05-23T08:05:34.853Z

--

*`process.parent.entity_id`*::
+
--
Unique identifier for the process.
The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.

type: keyword

example: c2c455d9f99375d

--

*`process.parent.executable`*::
+
--
Absolute path to the process executable.

type: keyword

example: /usr/bin/ssh

--

*`process.parent.executable.text`*::
+
--
type: match_only_text

--

*`process.parent.exit_code`*::
+
--
The exit code of the process, if this is a termination event.
The field should be absent if there is no exit code for the event (e.g. process start).

type: long

example: 137

--

*`process.parent.hash.md5`*::
+
--
MD5 hash.

type: keyword

--

*`process.parent.hash.sha1`*::
+
--
SHA1 hash.

type: keyword

--

*`process.parent.hash.sha256`*::
+
--
SHA256 hash.

type: keyword

--

*`process.parent.hash.sha512`*::
+
--
SHA512 hash.

type: keyword

--

*`process.parent.hash.ssdeep`*::
+
--
SSDEEP hash.

type: keyword

--

*`process.parent.name`*::
+
--
Process name.
Sometimes called program name or similar.

type: keyword

example: ssh

--

*`process.parent.name.text`*::
+
--
type: match_only_text

--

*`process.parent.pe.architecture`*::
+
--
CPU architecture target for the file.

type: keyword

example: x64

--

*`process.parent.pe.company`*::
+
--
Internal company name of the file, provided at compile-time.

type: keyword

example: Microsoft Corporation

--

*`process.parent.pe.description`*::
+
--
Internal description of the file, provided at compile-time.

type: keyword

example: Paint

--

*`process.parent.pe.file_version`*::
+
--
Internal version of the file, provided at compile-time.

type: keyword

example: 6.3.9600.17415

--

*`process.parent.pe.imphash`*::
+
--
A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.

type: keyword

example: 0c6803c4e922103c4dca5963aad36ddf

--

*`process.parent.pe.original_file_name`*::
+
--
Internal name of the file, provided at compile-time.

type: keyword

example: MSPAINT.EXE

--

*`process.parent.pe.product`*::
+
--
Internal product name of the file, provided at compile-time.

type: keyword

example: Microsoft® Windows® Operating System

--

*`process.parent.pgid`*::
+
--
Identifier of the group of processes the process belongs to.

type: long

format: string

--

*`process.parent.pid`*::
+
--
Process id.

type: long

example: 4242

format: string

--

*`process.parent.ppid`*::
+
--
Parent process' pid.

type: long

example: 4241

format: string

--

*`process.parent.start`*::
+
--
The time the process started.

type: date

example: 2016-05-23T08:05:34.853Z

--

*`process.parent.thread.id`*::
+
--
Thread ID.

type: long

example: 4242

format: string

--

*`process.parent.thread.name`*::
+
--
Thread name.

type: keyword

example: thread-0

--

*`process.parent.title`*::
+
--
Process title.
The proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened.

type: keyword

--

*`process.parent.title.text`*::
+
--
type: match_only_text

--

*`process.parent.uptime`*::
+
--
Seconds the process has been up.

type: long

example: 1325

--

*`process.parent.working_directory`*::
+
--
The working directory of the process.

type: keyword

example: /home/alice

--

*`process.parent.working_directory.text`*::
+
--
type: match_only_text

--

*`process.pe.architecture`*::
+
--
CPU architecture target for the file.

type: keyword

example: x64

--

*`process.pe.company`*::
+
--
Internal company name of the file, provided at compile-time.

type: keyword

example: Microsoft Corporation

--

*`process.pe.description`*::
+
--
Internal description of the file, provided at compile-time.

type: keyword

example: Paint

--

*`process.pe.file_version`*::
+
--
Internal version of the file, provided at compile-time.

type: keyword

example: 6.3.9600.17415

--

*`process.pe.imphash`*::
+
--
A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.

type: keyword

example: 0c6803c4e922103c4dca5963aad36ddf

--

*`process.pe.original_file_name`*::
+
--
Internal name of the file, provided at compile-time.

type: keyword

example: MSPAINT.EXE

--

*`process.pe.product`*::
+
--
Internal product name of the file, provided at compile-time.

type: keyword

example: Microsoft® Windows® Operating System

--

*`process.pgid`*::
+
--
Identifier of the group of processes the process belongs to.

type: long

format: string

--

*`process.pid`*::
+
--
Process id.

type: long

example: 4242

format: string

--

*`process.ppid`*::
+
--
Parent process' pid.

type: long

example: 4241

format: string

--

*`process.start`*::
+
--
The time the process started.

type: date

example: 2016-05-23T08:05:34.853Z

--

*`process.thread.id`*::
+
--
Thread ID.

type: long

example: 4242

format: string

--

*`process.thread.name`*::
+
--
Thread name.

type: keyword

example: thread-0

--

*`process.title`*::
+
--
Process title.
The proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened.

type: keyword

--

*`process.title.text`*::
+
--
type: match_only_text

--

*`process.uptime`*::
+
--
Seconds the process has been up.

type: long

example: 1325

--

*`process.working_directory`*::
+
--
The working directory of the process.

type: keyword

example: /home/alice

--

*`process.working_directory.text`*::
+
--
type: match_only_text

--

[float]
=== registry

Fields related to Windows Registry operations.


*`registry.data.bytes`*::
+
--
Original bytes written with base64 encoding.
For Windows registry operations, such as SetValueEx and RegQueryValueEx, this corresponds to the data pointed by `lp_data`. This is optional but provides better recoverability and should be populated for REG_BINARY encoded values.

type: keyword

example: ZQBuAC0AVQBTAAAAZQBuAAAAAAA=

--

*`registry.data.strings`*::
+
--
Content when writing string types.
Populated as an array when writing string data to the registry. For single string registry types (REG_SZ, REG_EXPAND_SZ), this should be an array with one string. For sequences of string with REG_MULTI_SZ, this array will be variable length. For numeric data, such as REG_DWORD and REG_QWORD, this should be populated with the decimal representation (e.g `"1"`).

type: wildcard

example: ["C:\rta\red_ttp\bin\myapp.exe"]

--

*`registry.data.type`*::
+
--
Standard registry type for encoding contents

type: keyword

example: REG_SZ

--

*`registry.hive`*::
+
--
Abbreviated name for the hive.

type: keyword

example: HKLM

--

*`registry.key`*::
+
--
Hive-relative path of keys.

type: keyword

example: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe

--

*`registry.path`*::
+
--
Full path, including hive, key and value

type: keyword

example: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe\Debugger

--

*`registry.value`*::
+
--
Name of the value written.

type: keyword

example: Debugger

--

[float]
=== related

This field set is meant to facilitate pivoting around a piece of data.
Some pieces of information can be seen in many places in an ECS event. To facilitate searching for them, store an array of all seen values to their corresponding field in `related.`.
A concrete example is IP addresses, which can be under host, observer, source, destination, client, server, and network.forwarded_ip. If you append all IPs to `related.ip`, you can then search for a given IP trivially, no matter where it appeared, by querying `related.ip:192.0.2.15`.


*`related.hash`*::
+
--
All the hashes seen on your event. Populating this field, then using it to search for hashes can help in situations where you're unsure what the hash algorithm is (and therefore which key name to search).

type: keyword

--

*`related.hosts`*::
+
--
All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases.

type: keyword

--

*`related.ip`*::
+
--
All of the IPs seen on your event.

type: ip

--

*`related.user`*::
+
--
All the user names or other user identifiers seen on the event.

type: keyword

--

[float]
=== rule

Rule fields are used to capture the specifics of any observer or agent rules that generate alerts or other notable events.
Examples of data sources that would populate the rule fields include: network admission control platforms, network or host IDS/IPS, network firewalls, web application firewalls, url filters, endpoint detection and response (EDR) systems, etc.


*`rule.author`*::
+
--
Name, organization, or pseudonym of the author or authors who created the rule used to generate this event.

type: keyword

example: ["Star-Lord"]

--

*`rule.category`*::
+
--
A categorization value keyword used by the entity using the rule for detection of this event.

type: keyword

example: Attempted Information Leak

--

*`rule.description`*::
+
--
The description of the rule generating the event.

type: keyword

example: Block requests to public DNS over HTTPS / TLS protocols

--

*`rule.id`*::
+
--
A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.

type: keyword

example: 101

--

*`rule.license`*::
+
--
Name of the license under which the rule used to generate this event is made available.

type: keyword

example: Apache 2.0

--

*`rule.name`*::
+
--
The name of the rule or signature generating the event.

type: keyword

example: BLOCK_DNS_over_TLS

--

*`rule.reference`*::
+
--
Reference URL to additional information about the rule used to generate this event.
The URL can point to the vendor's documentation about the rule. If that's not available, it can also be a link to a more general page describing this type of alert.

type: keyword

example: https://en.wikipedia.org/wiki/DNS_over_TLS

--

*`rule.ruleset`*::
+
--
Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.

type: keyword

example: Standard_Protocol_Filters

--

*`rule.uuid`*::
+
--
A rule ID that is unique within the scope of a set or group of agents, observers, or other entities using the rule for detection of this event.

type: keyword

example: 1100110011

--

*`rule.version`*::
+
--
The version / revision of the rule being used for analysis.

type: keyword

example: 1.1

--

[float]
=== server

A Server is defined as the responder in a network connection for events regarding sessions, connections, or bidirectional flow records.
For TCP events, the server is the receiver of the initial SYN packet(s) of the TCP connection. For other protocols, the server is generally the responder in the network transaction. Some systems actually use the term "responder" to refer the server in TCP connections. The server fields describe details about the system acting as the server in the network event. Server fields are usually populated in conjunction with client fields. Server fields are generally not populated for packet-level events.
Client / server representations can add semantic context to an exchange, which is helpful to visualize the data in certain situations. If your context falls in that category, you should still ensure that source and destination are filled appropriately.


*`server.address`*::
+
--
Some event server addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.
Then it should be duplicated to `.ip` or `.domain`, depending on which one it is.

type: keyword

--

*`server.as.number`*::
+
--
Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet.

type: long

example: 15169

--

*`server.as.organization.name`*::
+
--
Organization name.

type: keyword

example: Google LLC

--

*`server.as.organization.name.text`*::
+
--
type: match_only_text

--

*`server.bytes`*::
+
--
Bytes sent from the server to the client.

type: long

example: 184

format: bytes

--

*`server.domain`*::
+
--
Server domain.

type: keyword

--

*`server.geo.city_name`*::
+
--
City name.

type: keyword

example: Montreal

--

*`server.geo.continent_code`*::
+
--
Two-letter code representing continent's name.

type: keyword

example: NA

--

*`server.geo.continent_name`*::
+
--
Name of the continent.

type: keyword

example: North America

--

*`server.geo.country_iso_code`*::
+
--
Country ISO code.

type: keyword

example: CA

--

*`server.geo.country_name`*::
+
--
Country name.

type: keyword

example: Canada

--

*`server.geo.location`*::
+
--
Longitude and latitude.

type: geo_point

example: { "lon": -73.614830, "lat": 45.505918 }

--

*`server.geo.name`*::
+
--
User-defined description of a location, at the level of granularity they care about.
Could be the name of their data centers, the floor number, if this describes a local physical entity, city names.
Not typically used in automated geolocation.

type: keyword

example: boston-dc

--

*`server.geo.postal_code`*::
+
--
Postal code associated with the location.
Values appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.

type: keyword

example: 94040

--

*`server.geo.region_iso_code`*::
+
--
Region ISO code.

type: keyword

example: CA-QC

--

*`server.geo.region_name`*::
+
--
Region name.

type: keyword

example: Quebec

--

*`server.geo.timezone`*::
+
--
The time zone of the location, such as IANA time zone name.

type: keyword

example: America/Argentina/Buenos_Aires

--

*`server.ip`*::
+
--
IP address of the server (IPv4 or IPv6).

type: ip

--

*`server.mac`*::
+
--
MAC address of the server.
The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.

type: keyword

example: 00-00-5E-00-53-23

--

*`server.nat.ip`*::
+
--
Translated ip of destination based NAT sessions (e.g. internet to private DMZ)
Typically used with load balancers, firewalls, or routers.

type: ip

--

*`server.nat.port`*::
+
--
Translated port of destination based NAT sessions (e.g. internet to private DMZ)
Typically used with load balancers, firewalls, or routers.

type: long

format: string

--

*`server.packets`*::
+
--
Packets sent from the server to the client.

type: long

example: 12

--

*`server.port`*::
+
--
Port of the server.

type: long

format: string

--

*`server.registered_domain`*::
+
--
The highest registered server domain, stripped of the subdomain.
For example, the registered domain for "foo.example.com" is "example.com".
This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk".

type: keyword

example: example.com

--

*`server.subdomain`*::
+
--
The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain.  In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain.
For example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period.

type: keyword

example: east

--

*`server.top_level_domain`*::
+
--
The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com".
This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk".

type: keyword

example: co.uk

--

*`server.user.domain`*::
+
--
Name of the directory the user is a member of.
For example, an LDAP or Active Directory domain name.

type: keyword

--

*`server.user.email`*::
+
--
User email address.

type: keyword

--

*`server.user.full_name`*::
+
--
User's full name, if available.

type: keyword

example: Albert Einstein

--

*`server.user.full_name.text`*::
+
--
type: match_only_text

--

*`server.user.group.domain`*::
+
--
Name of the directory the group is a member of.
For example, an LDAP or Active Directory domain name.

type: keyword

--

*`server.user.group.id`*::
+
--
Unique identifier for the group on the system/platform.

type: keyword

--

*`server.user.group.name`*::
+
--
Name of the group.

type: keyword

--

*`server.user.hash`*::
+
--
Unique user hash to correlate information for a user in anonymized form.
Useful if `user.id` or `user.name` contain confidential information and cannot be used.

type: keyword

--

*`server.user.id`*::
+
--
Unique identifier of the user.

type: keyword

example: S-1-5-21-202424912787-2692429404-2351956786-1000

--

*`server.user.name`*::
+
--
Short name or login of the user.

type: keyword

example: a.einstein

--

*`server.user.name.text`*::
+
--
type: match_only_text

--

*`server.user.roles`*::
+
--
Array of user roles at the time of the event.

type: keyword

example: ["kibana_admin", "reporting_user"]

--

[float]
=== service

The service fields describe the service for or from which the data was collected.
These fields help you find and correlate logs for a specific service and version.


*`service.address`*::
+
--
Address where data about this service was collected from.
This should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets).

type: keyword

example: 172.26.0.2:5432

--

*`service.environment`*::
+
--
Identifies the environment where the service is running.
If the same service runs in different environments (production, staging, QA, development, etc.), the environment can identify other instances of the same service. Can also group services and applications from the same environment.

type: keyword

example: production

--

*`service.ephemeral_id`*::
+
--
Ephemeral identifier of this service (if one exists).
This id normally changes across restarts, but `service.id` does not.

type: keyword

example: 8a4f500f

--

*`service.id`*::
+
--
Unique identifier of the running service. If the service is comprised of many nodes, the `service.id` should be the same for all nodes.
This id should uniquely identify the service. This makes it possible to correlate logs and metrics for one specific service, no matter which particular node emitted the event.
Note that if you need to see the events from one specific host of the service, you should filter on that `host.name` or `host.id` instead.

type: keyword

example: d37e5ebfe0ae6c4972dbe9f0174a1637bb8247f6

--

*`service.name`*::
+
--
Name of the service data is collected from.
The name of the service is normally user given. This allows for distributed services that run on multiple hosts to correlate the related instances based on the name.
In the case of Elasticsearch the `service.name` could contain the cluster name. For Beats the `service.name` is by default a copy of the `service.type` field if no name is specified.

type: keyword

example: elasticsearch-metrics

--

*`service.node.name`*::
+
--
Name of a service node.
This allows for two nodes of the same service running on the same host to be differentiated. Therefore, `service.node.name` should typically be unique across nodes of a given service.
In the case of Elasticsearch, the `service.node.name` could contain the unique node name within the Elasticsearch cluster. In cases where the service doesn't have the concept of a node name, the host name or container name can be used to distinguish running instances that make up this service. If those do not provide uniqueness (e.g. multiple instances of the service running on the same host) - the node name can be manually set.

type: keyword

example: instance-0000000016

--

*`service.state`*::
+
--
Current state of the service.

type: keyword

--

*`service.type`*::
+
--
The type of the service data is collected from.
The type can be used to group and correlate logs and metrics from one service type.
Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`.

type: keyword

example: elasticsearch

--

*`service.version`*::
+
--
Version of the service the data was collected from.
This allows to look at a data set only for a specific version of a service.

type: keyword

example: 3.2.4

--

[float]
=== source

Source fields capture details about the sender of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.
Source fields are usually populated in conjunction with destination fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.


*`source.address`*::
+
--
Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.
Then it should be duplicated to `.ip` or `.domain`, depending on which one it is.

type: keyword

--

*`source.as.number`*::
+
--
Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet.

type: long

example: 15169

--

*`source.as.organization.name`*::
+
--
Organization name.

type: keyword

example: Google LLC

--

*`source.as.organization.name.text`*::
+
--
type: match_only_text

--

*`source.bytes`*::
+
--
Bytes sent from the source to the destination.

type: long

example: 184

format: bytes

--

*`source.domain`*::
+
--
Source domain.

type: keyword

--

*`source.geo.city_name`*::
+
--
City name.

type: keyword

example: Montreal

--

*`source.geo.continent_code`*::
+
--
Two-letter code representing continent's name.

type: keyword

example: NA

--

*`source.geo.continent_name`*::
+
--
Name of the continent.

type: keyword

example: North America

--

*`source.geo.country_iso_code`*::
+
--
Country ISO code.

type: keyword

example: CA

--

*`source.geo.country_name`*::
+
--
Country name.

type: keyword

example: Canada

--

*`source.geo.location`*::
+
--
Longitude and latitude.

type: geo_point

example: { "lon": -73.614830, "lat": 45.505918 }

--

*`source.geo.name`*::
+
--
User-defined description of a location, at the level of granularity they care about.
Could be the name of their data centers, the floor number, if this describes a local physical entity, city names.
Not typically used in automated geolocation.

type: keyword

example: boston-dc

--

*`source.geo.postal_code`*::
+
--
Postal code associated with the location.
Values appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.

type: keyword

example: 94040

--

*`source.geo.region_iso_code`*::
+
--
Region ISO code.

type: keyword

example: CA-QC

--

*`source.geo.region_name`*::
+
--
Region name.

type: keyword

example: Quebec

--

*`source.geo.timezone`*::
+
--
The time zone of the location, such as IANA time zone name.

type: keyword

example: America/Argentina/Buenos_Aires

--

*`source.ip`*::
+
--
IP address of the source (IPv4 or IPv6).

type: ip

--

*`source.mac`*::
+
--
MAC address of the source.
The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.

type: keyword

example: 00-00-5E-00-53-23

--

*`source.nat.ip`*::
+
--
Translated ip of source based NAT sessions (e.g. internal client to internet)
Typically connections traversing load balancers, firewalls, or routers.

type: ip

--

*`source.nat.port`*::
+
--
Translated port of source based NAT sessions. (e.g. internal client to internet)
Typically used with load balancers, firewalls, or routers.

type: long

format: string

--

*`source.packets`*::
+
--
Packets sent from the source to the destination.

type: long

example: 12

--

*`source.port`*::
+
--
Port of the source.

type: long

format: string

--

*`source.registered_domain`*::
+
--
The highest registered source domain, stripped of the subdomain.
For example, the registered domain for "foo.example.com" is "example.com".
This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk".

type: keyword

example: example.com

--

*`source.subdomain`*::
+
--
The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain.  In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain.
For example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period.

type: keyword

example: east

--

*`source.top_level_domain`*::
+
--
The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com".
This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk".

type: keyword

example: co.uk

--

*`source.user.domain`*::
+
--
Name of the directory the user is a member of.
For example, an LDAP or Active Directory domain name.

type: keyword

--

*`source.user.email`*::
+
--
User email address.

type: keyword

--

*`source.user.full_name`*::
+
--
User's full name, if available.

type: keyword

example: Albert Einstein

--

*`source.user.full_name.text`*::
+
--
type: match_only_text

--

*`source.user.group.domain`*::
+
--
Name of the directory the group is a member of.
For example, an LDAP or Active Directory domain name.

type: keyword

--

*`source.user.group.id`*::
+
--
Unique identifier for the group on the system/platform.

type: keyword

--

*`source.user.group.name`*::
+
--
Name of the group.

type: keyword

--

*`source.user.hash`*::
+
--
Unique user hash to correlate information for a user in anonymized form.
Useful if `user.id` or `user.name` contain confidential information and cannot be used.

type: keyword

--

*`source.user.id`*::
+
--
Unique identifier of the user.

type: keyword

example: S-1-5-21-202424912787-2692429404-2351956786-1000

--

*`source.user.name`*::
+
--
Short name or login of the user.

type: keyword

example: a.einstein

--

*`source.user.name.text`*::
+
--
type: match_only_text

--

*`source.user.roles`*::
+
--
Array of user roles at the time of the event.

type: keyword

example: ["kibana_admin", "reporting_user"]

--

[float]
=== threat

Fields to classify events and alerts according to a threat taxonomy such as the MITRE ATT&CK® framework.
These fields are for users to classify alerts from all of their sources (e.g. IDS, NGFW, etc.) within a common taxonomy. The threat.tactic.* are meant to capture the high level category of the threat (e.g. "impact"). The threat.technique.* fields are meant to capture which kind of approach is used by this detected threat, to accomplish the goal (e.g. "endpoint denial of service").


*`threat.enrichments`*::
+
--
A list of associated indicators objects enriching the event, and the context of that association/enrichment.

type: nested

--

*`threat.enrichments.indicator`*::
+
--
Object containing associated indicators enriching the event.

type: object

--

*`threat.enrichments.indicator.as.number`*::
+
--
Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet.

type: long

example: 15169

--

*`threat.enrichments.indicator.as.organization.name`*::
+
--
Organization name.

type: keyword

example: Google LLC

--

*`threat.enrichments.indicator.as.organization.name.text`*::
+
--
type: match_only_text

--

*`threat.enrichments.indicator.confidence`*::
+
--
Identifies the confidence rating assigned by the provider using STIX confidence scales. Expected values:
  * Not Specified, None, Low, Medium, High
  * 0-10
  * Admirality Scale (1-6)
  * DNI Scale (5-95)
  * WEP Scale (Impossible - Certain)

type: keyword

example: High

--

*`threat.enrichments.indicator.description`*::
+
--
Describes the type of action conducted by the threat.

type: keyword

example: IP x.x.x.x was observed delivering the Angler EK.

--

*`threat.enrichments.indicator.email.address`*::
+
--
Identifies a threat indicator as an email address (irrespective of direction).

type: keyword

example: phish@example.com

--

*`threat.enrichments.indicator.file.accessed`*::
+
--
Last time the file was accessed.
Note that not all filesystems keep track of access time.

type: date

--

*`threat.enrichments.indicator.file.attributes`*::
+
--
Array of file attributes.
Attributes names will vary by platform. Here's a non-exhaustive list of values that are expected in this field: archive, compressed, directory, encrypted, execute, hidden, read, readonly, system, write.

type: keyword

example: ["readonly", "system"]

--

*`threat.enrichments.indicator.file.code_signature.digest_algorithm`*::
+
--
The hashing algorithm used to sign the process.
This value can distinguish signatures when a file is signed multiple times by the same signer but with a different digest algorithm.

type: keyword

example: sha256

--

*`threat.enrichments.indicator.file.code_signature.exists`*::
+
--
Boolean to capture if a signature is present.

type: boolean

example: true

--

*`threat.enrichments.indicator.file.code_signature.signing_id`*::
+
--
The identifier used to sign the process.
This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.

type: keyword

example: com.apple.xpc.proxy

--

*`threat.enrichments.indicator.file.code_signature.status`*::
+
--
Additional information about the certificate status.
This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.

type: keyword

example: ERROR_UNTRUSTED_ROOT

--

*`threat.enrichments.indicator.file.code_signature.subject_name`*::
+
--
Subject name of the code signer

type: keyword

example: Microsoft Corporation

--

*`threat.enrichments.indicator.file.code_signature.team_id`*::
+
--
The team identifier used to sign the process.
This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.

type: keyword

example: EQHXZ8M8AV

--

*`threat.enrichments.indicator.file.code_signature.timestamp`*::
+
--
Date and time when the code signature was generated and signed.

type: date

example: 2021-01-01T12:10:30Z

--

*`threat.enrichments.indicator.file.code_signature.trusted`*::
+
--
Stores the trust status of the certificate chain.
Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.

type: boolean

example: true

--

*`threat.enrichments.indicator.file.code_signature.valid`*::
+
--
Boolean to capture if the digital signature is verified against the binary content.
Leave unpopulated if a certificate was unchecked.

type: boolean

example: true

--

*`threat.enrichments.indicator.file.created`*::
+
--
File creation time.
Note that not all filesystems store the creation time.

type: date

--

*`threat.enrichments.indicator.file.ctime`*::
+
--
Last time the file attributes or metadata changed.
Note that changes to the file content will update `mtime`. This implies `ctime` will be adjusted at the same time, since `mtime` is an attribute of the file.

type: date

--

*`threat.enrichments.indicator.file.device`*::
+
--
Device that is the source of the file.

type: keyword

example: sda

--

*`threat.enrichments.indicator.file.directory`*::
+
--
Directory where the file is located. It should include the drive letter, when appropriate.

type: keyword

example: /home/alice

--

*`threat.enrichments.indicator.file.drive_letter`*::
+
--
Drive letter where the file is located. This field is only relevant on Windows.
The value should be uppercase, and not include the colon.

type: keyword

example: C

--

*`threat.enrichments.indicator.file.elf.architecture`*::
+
--
Machine architecture of the ELF file.

type: keyword

example: x86-64

--

*`threat.enrichments.indicator.file.elf.byte_order`*::
+
--
Byte sequence of ELF file.

type: keyword

example: Little Endian

--

*`threat.enrichments.indicator.file.elf.cpu_type`*::
+
--
CPU type of the ELF file.

type: keyword

example: Intel

--

*`threat.enrichments.indicator.file.elf.creation_date`*::
+
--
Extracted when possible from the file's metadata. Indicates when it was built or compiled. It can also be faked by malware creators.

type: date

--

*`threat.enrichments.indicator.file.elf.exports`*::
+
--
List of exported element names and types.

type: flattened

--

*`threat.enrichments.indicator.file.elf.header.abi_version`*::
+
--
Version of the ELF Application Binary Interface (ABI).

type: keyword

--

*`threat.enrichments.indicator.file.elf.header.class`*::
+
--
Header class of the ELF file.

type: keyword

--

*`threat.enrichments.indicator.file.elf.header.data`*::
+
--
Data table of the ELF header.

type: keyword

--

*`threat.enrichments.indicator.file.elf.header.entrypoint`*::
+
--
Header entrypoint of the ELF file.

type: long

format: string

--

*`threat.enrichments.indicator.file.elf.header.object_version`*::
+
--
"0x1" for original ELF files.

type: keyword

--

*`threat.enrichments.indicator.file.elf.header.os_abi`*::
+
--
Application Binary Interface (ABI) of the Linux OS.

type: keyword

--

*`threat.enrichments.indicator.file.elf.header.type`*::
+
--
Header type of the ELF file.

type: keyword

--

*`threat.enrichments.indicator.file.elf.header.version`*::
+
--
Version of the ELF header.

type: keyword

--

*`threat.enrichments.indicator.file.elf.imports`*::
+
--
List of imported element names and types.

type: flattened

--

*`threat.enrichments.indicator.file.elf.sections`*::
+
--
An array containing an object for each section of the ELF file.
The keys that should be present in these objects are defined by sub-fields underneath `elf.sections.*`.

type: nested

--

*`threat.enrichments.indicator.file.elf.sections.chi2`*::
+
--
Chi-square probability distribution of the section.

type: long

format: number

--

*`threat.enrichments.indicator.file.elf.sections.entropy`*::
+
--
Shannon entropy calculation from the section.

type: long

format: number

--

*`threat.enrichments.indicator.file.elf.sections.flags`*::
+
--
ELF Section List flags.

type: keyword

--

*`threat.enrichments.indicator.file.elf.sections.name`*::
+
--
ELF Section List name.

type: keyword

--

*`threat.enrichments.indicator.file.elf.sections.physical_offset`*::
+
--
ELF Section List offset.

type: keyword

--

*`threat.enrichments.indicator.file.elf.sections.physical_size`*::
+
--
ELF Section List physical size.

type: long

format: bytes

--

*`threat.enrichments.indicator.file.elf.sections.type`*::
+
--
ELF Section List type.

type: keyword

--

*`threat.enrichments.indicator.file.elf.sections.virtual_address`*::
+
--
ELF Section List virtual address.

type: long

format: string

--

*`threat.enrichments.indicator.file.elf.sections.virtual_size`*::
+
--
ELF Section List virtual size.

type: long

format: string

--

*`threat.enrichments.indicator.file.elf.segments`*::
+
--
An array containing an object for each segment of the ELF file.
The keys that should be present in these objects are defined by sub-fields underneath `elf.segments.*`.

type: nested

--

*`threat.enrichments.indicator.file.elf.segments.sections`*::
+
--
ELF object segment sections.

type: keyword

--

*`threat.enrichments.indicator.file.elf.segments.type`*::
+
--
ELF object segment type.

type: keyword

--

*`threat.enrichments.indicator.file.elf.shared_libraries`*::
+
--
List of shared libraries used by this ELF object.

type: keyword

--

*`threat.enrichments.indicator.file.elf.telfhash`*::
+
--
telfhash symbol hash for ELF file.

type: keyword

--

*`threat.enrichments.indicator.file.extension`*::
+
--
File extension, excluding the leading dot.
Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").

type: keyword

example: png

--

*`threat.enrichments.indicator.file.fork_name`*::
+
--
A fork is additional data associated with a filesystem object.
On Linux, a resource fork is used to store additional data with a filesystem object. A file always has at least one fork for the data portion, and additional forks may exist.
On NTFS, this is analogous to an Alternate Data Stream (ADS), and the default data stream for a file is just called $DATA. Zone.Identifier is commonly used by Windows to track contents downloaded from the Internet. An ADS is typically of the form: `C:\path\to\filename.extension:some_fork_name`, and `some_fork_name` is the value that should populate `fork_name`. `filename.extension` should populate `file.name`, and `extension` should populate `file.extension`. The full path, `file.path`, will include the fork name.

type: keyword

example: Zone.Identifer

--

*`threat.enrichments.indicator.file.gid`*::
+
--
Primary group ID (GID) of the file.

type: keyword

example: 1001

--

*`threat.enrichments.indicator.file.group`*::
+
--
Primary group name of the file.

type: keyword

example: alice

--

*`threat.enrichments.indicator.file.hash.md5`*::
+
--
MD5 hash.

type: keyword

--

*`threat.enrichments.indicator.file.hash.sha1`*::
+
--
SHA1 hash.

type: keyword

--

*`threat.enrichments.indicator.file.hash.sha256`*::
+
--
SHA256 hash.

type: keyword

--

*`threat.enrichments.indicator.file.hash.sha512`*::
+
--
SHA512 hash.

type: keyword

--

*`threat.enrichments.indicator.file.hash.ssdeep`*::
+
--
SSDEEP hash.

type: keyword

--

*`threat.enrichments.indicator.file.inode`*::
+
--
Inode representing the file in the filesystem.

type: keyword

example: 256383

--

*`threat.enrichments.indicator.file.mime_type`*::
+
--
MIME type should identify the format of the file or stream of bytes using https://www.iana.org/assignments/media-types/media-types.xhtml[IANA official types], where possible. When more than one type is applicable, the most specific type should be used.

type: keyword

--

*`threat.enrichments.indicator.file.mode`*::
+
--
Mode of the file in octal representation.

type: keyword

example: 0640

--

*`threat.enrichments.indicator.file.mtime`*::
+
--
Last time the file content was modified.

type: date

--

*`threat.enrichments.indicator.file.name`*::
+
--
Name of the file including the extension, without the directory.

type: keyword

example: example.png

--

*`threat.enrichments.indicator.file.owner`*::
+
--
File owner's username.

type: keyword

example: alice

--

*`threat.enrichments.indicator.file.path`*::
+
--
Full path to the file, including the file name. It should include the drive letter, when appropriate.

type: keyword

example: /home/alice/example.png

--

*`threat.enrichments.indicator.file.path.text`*::
+
--
type: match_only_text

--

*`threat.enrichments.indicator.file.pe.architecture`*::
+
--
CPU architecture target for the file.

type: keyword

example: x64

--

*`threat.enrichments.indicator.file.pe.company`*::
+
--
Internal company name of the file, provided at compile-time.

type: keyword

example: Microsoft Corporation

--

*`threat.enrichments.indicator.file.pe.description`*::
+
--
Internal description of the file, provided at compile-time.

type: keyword

example: Paint

--

*`threat.enrichments.indicator.file.pe.file_version`*::
+
--
Internal version of the file, provided at compile-time.

type: keyword

example: 6.3.9600.17415

--

*`threat.enrichments.indicator.file.pe.imphash`*::
+
--
A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.

type: keyword

example: 0c6803c4e922103c4dca5963aad36ddf

--

*`threat.enrichments.indicator.file.pe.original_file_name`*::
+
--
Internal name of the file, provided at compile-time.

type: keyword

example: MSPAINT.EXE

--

*`threat.enrichments.indicator.file.pe.product`*::
+
--
Internal product name of the file, provided at compile-time.

type: keyword

example: Microsoft® Windows® Operating System

--

*`threat.enrichments.indicator.file.size`*::
+
--
File size in bytes.
Only relevant when `file.type` is "file".

type: long

example: 16384

--

*`threat.enrichments.indicator.file.target_path`*::
+
--
Target path for symlinks.

type: keyword

--

*`threat.enrichments.indicator.file.target_path.text`*::
+
--
type: match_only_text

--

*`threat.enrichments.indicator.file.type`*::
+
--
File type (file, dir, or symlink).

type: keyword

example: file

--

*`threat.enrichments.indicator.file.uid`*::
+
--
The user ID (UID) or security identifier (SID) of the file owner.

type: keyword

example: 1001

--

*`threat.enrichments.indicator.first_seen`*::
+
--
The date and time when intelligence source first reported sighting this indicator.

type: date

example: 2020-11-05T17:25:47.000Z

--

*`threat.enrichments.indicator.geo.city_name`*::
+
--
City name.

type: keyword

example: Montreal

--

*`threat.enrichments.indicator.geo.continent_code`*::
+
--
Two-letter code representing continent's name.

type: keyword

example: NA

--

*`threat.enrichments.indicator.geo.continent_name`*::
+
--
Name of the continent.

type: keyword

example: North America

--

*`threat.enrichments.indicator.geo.country_iso_code`*::
+
--
Country ISO code.

type: keyword

example: CA

--

*`threat.enrichments.indicator.geo.country_name`*::
+
--
Country name.

type: keyword

example: Canada

--

*`threat.enrichments.indicator.geo.location`*::
+
--
Longitude and latitude.

type: geo_point

example: { "lon": -73.614830, "lat": 45.505918 }

--

*`threat.enrichments.indicator.geo.name`*::
+
--
User-defined description of a location, at the level of granularity they care about.
Could be the name of their data centers, the floor number, if this describes a local physical entity, city names.
Not typically used in automated geolocation.

type: keyword

example: boston-dc

--

*`threat.enrichments.indicator.geo.postal_code`*::
+
--
Postal code associated with the location.
Values appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.

type: keyword

example: 94040

--

*`threat.enrichments.indicator.geo.region_iso_code`*::
+
--
Region ISO code.

type: keyword

example: CA-QC

--

*`threat.enrichments.indicator.geo.region_name`*::
+
--
Region name.

type: keyword

example: Quebec

--

*`threat.enrichments.indicator.geo.timezone`*::
+
--
The time zone of the location, such as IANA time zone name.

type: keyword

example: America/Argentina/Buenos_Aires

--

*`threat.enrichments.indicator.ip`*::
+
--
Identifies a threat indicator as an IP address (irrespective of direction).

type: ip

example: 1.2.3.4

--

*`threat.enrichments.indicator.last_seen`*::
+
--
The date and time when intelligence source last reported sighting this indicator.

type: date

example: 2020-11-05T17:25:47.000Z

--

*`threat.enrichments.indicator.marking.tlp`*::
+
--
Traffic Light Protocol sharing markings. Recommended values are:
  * WHITE
  * GREEN
  * AMBER
  * RED

type: keyword

example: White

--

*`threat.enrichments.indicator.modified_at`*::
+
--
The date and time when intelligence source last modified information for this indicator.

type: date

example: 2020-11-05T17:25:47.000Z

--

*`threat.enrichments.indicator.port`*::
+
--
Identifies a threat indicator as a port number (irrespective of direction).

type: long

example: 443

--

*`threat.enrichments.indicator.provider`*::
+
--
The name of the indicator's provider.

type: keyword

example: lrz_urlhaus

--

*`threat.enrichments.indicator.reference`*::
+
--
Reference URL linking to additional information about this indicator.

type: keyword

example: https://system.example.com/indicator/0001234

--

*`threat.enrichments.indicator.registry.data.bytes`*::
+
--
Original bytes written with base64 encoding.
For Windows registry operations, such as SetValueEx and RegQueryValueEx, this corresponds to the data pointed by `lp_data`. This is optional but provides better recoverability and should be populated for REG_BINARY encoded values.

type: keyword

example: ZQBuAC0AVQBTAAAAZQBuAAAAAAA=

--

*`threat.enrichments.indicator.registry.data.strings`*::
+
--
Content when writing string types.
Populated as an array when writing string data to the registry. For single string registry types (REG_SZ, REG_EXPAND_SZ), this should be an array with one string. For sequences of string with REG_MULTI_SZ, this array will be variable length. For numeric data, such as REG_DWORD and REG_QWORD, this should be populated with the decimal representation (e.g `"1"`).

type: wildcard

example: ["C:\rta\red_ttp\bin\myapp.exe"]

--

*`threat.enrichments.indicator.registry.data.type`*::
+
--
Standard registry type for encoding contents

type: keyword

example: REG_SZ

--

*`threat.enrichments.indicator.registry.hive`*::
+
--
Abbreviated name for the hive.

type: keyword

example: HKLM

--

*`threat.enrichments.indicator.registry.key`*::
+
--
Hive-relative path of keys.

type: keyword

example: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe

--

*`threat.enrichments.indicator.registry.path`*::
+
--
Full path, including hive, key and value

type: keyword

example: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe\Debugger

--

*`threat.enrichments.indicator.registry.value`*::
+
--
Name of the value written.

type: keyword

example: Debugger

--

*`threat.enrichments.indicator.scanner_stats`*::
+
--
Count of AV/EDR vendors that successfully detected malicious file or URL.

type: long

example: 4

--

*`threat.enrichments.indicator.sightings`*::
+
--
Number of times this indicator was observed conducting threat activity.

type: long

example: 20

--

*`threat.enrichments.indicator.type`*::
+
--
Type of indicator as represented by Cyber Observable in STIX 2.0. Recommended values:
  * autonomous-system
  * artifact
  * directory
  * domain-name
  * email-addr
  * file
  * ipv4-addr
  * ipv6-addr
  * mac-addr
  * mutex
  * port
  * process
  * software
  * url
  * user-account
  * windows-registry-key
  * x509-certificate

type: keyword

example: ipv4-addr

--

*`threat.enrichments.indicator.url.domain`*::
+
--
Domain of the url, such as "www.elastic.co".
In some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `domain` field.
If the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732), the `[` and `]` characters should also be captured in the `domain` field.

type: keyword

example: www.elastic.co

--

*`threat.enrichments.indicator.url.extension`*::
+
--
The field contains the file extension from the original request url, excluding the leading dot.
The file extension is only set if it exists, as not every url has a file extension.
The leading period must not be included. For example, the value must be "png", not ".png".
Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").

type: keyword

example: png

--

*`threat.enrichments.indicator.url.fragment`*::
+
--
Portion of the url after the `#`, such as "top".
The `#` is not part of the fragment.

type: keyword

--

*`threat.enrichments.indicator.url.full`*::
+
--
If full URLs are important to your use case, they should be stored in `url.full`, whether this field is reconstructed or present in the event source.

type: wildcard

example: https://www.elastic.co:443/search?q=elasticsearch#top

--

*`threat.enrichments.indicator.url.full.text`*::
+
--
type: match_only_text

--

*`threat.enrichments.indicator.url.original`*::
+
--
Unmodified original url as seen in the event source.
Note that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path.
This field is meant to represent the URL as it was observed, complete or not.

type: wildcard

example: https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch

--

*`threat.enrichments.indicator.url.original.text`*::
+
--
type: match_only_text

--

*`threat.enrichments.indicator.url.password`*::
+
--
Password of the request.

type: keyword

--

*`threat.enrichments.indicator.url.path`*::
+
--
Path of the request, such as "/search".

type: wildcard

--

*`threat.enrichments.indicator.url.port`*::
+
--
Port of the request, such as 443.

type: long

example: 443

format: string

--

*`threat.enrichments.indicator.url.query`*::
+
--
The query field describes the query string of the request, such as "q=elasticsearch".
The `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases.

type: keyword

--

*`threat.enrichments.indicator.url.registered_domain`*::
+
--
The highest registered url domain, stripped of the subdomain.
For example, the registered domain for "foo.example.com" is "example.com".
This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk".

type: keyword

example: example.com

--

*`threat.enrichments.indicator.url.scheme`*::
+
--
Scheme of the request, such as "https".
Note: The `:` is not part of the scheme.

type: keyword

example: https

--

*`threat.enrichments.indicator.url.subdomain`*::
+
--
The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain.  In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain.
For example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period.

type: keyword

example: east

--

*`threat.enrichments.indicator.url.top_level_domain`*::
+
--
The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com".
This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk".

type: keyword

example: co.uk

--

*`threat.enrichments.indicator.url.username`*::
+
--
Username of the request.

type: keyword

--

*`threat.enrichments.indicator.x509.alternative_names`*::
+
--
List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses.

type: keyword

example: *.elastic.co

--

*`threat.enrichments.indicator.x509.issuer.common_name`*::
+
--
List of common name (CN) of issuing certificate authority.

type: keyword

example: Example SHA2 High Assurance Server CA

--

*`threat.enrichments.indicator.x509.issuer.country`*::
+
--
List of country (C) codes

type: keyword

example: US

--

*`threat.enrichments.indicator.x509.issuer.distinguished_name`*::
+
--
Distinguished name (DN) of issuing certificate authority.

type: keyword

example: C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA

--

*`threat.enrichments.indicator.x509.issuer.locality`*::
+
--
List of locality names (L)

type: keyword

example: Mountain View

--

*`threat.enrichments.indicator.x509.issuer.organization`*::
+
--
List of organizations (O) of issuing certificate authority.

type: keyword

example: Example Inc

--

*`threat.enrichments.indicator.x509.issuer.organizational_unit`*::
+
--
List of organizational units (OU) of issuing certificate authority.

type: keyword

example: www.example.com

--

*`threat.enrichments.indicator.x509.issuer.state_or_province`*::
+
--
List of state or province names (ST, S, or P)

type: keyword

example: California

--

*`threat.enrichments.indicator.x509.not_after`*::
+
--
Time at which the certificate is no longer considered valid.

type: date

example: 2020-07-16 03:15:39+00:00

--

*`threat.enrichments.indicator.x509.not_before`*::
+
--
Time at which the certificate is first considered valid.

type: date

example: 2019-08-16 01:40:25+00:00

--

*`threat.enrichments.indicator.x509.public_key_algorithm`*::
+
--
Algorithm used to generate the public key.

type: keyword

example: RSA

--

*`threat.enrichments.indicator.x509.public_key_curve`*::
+
--
The curve used by the elliptic curve public key algorithm. This is algorithm specific.

type: keyword

example: nistp521

--

*`threat.enrichments.indicator.x509.public_key_exponent`*::
+
--
Exponent used to derive the public key. This is algorithm specific.

type: long

example: 65537

Field is not indexed.

--

*`threat.enrichments.indicator.x509.public_key_size`*::
+
--
The size of the public key space in bits.

type: long

example: 2048

--

*`threat.enrichments.indicator.x509.serial_number`*::
+
--
Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters.

type: keyword

example: 55FBB9C7DEBF09809D12CCAA

--

*`threat.enrichments.indicator.x509.signature_algorithm`*::
+
--
Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353.

type: keyword

example: SHA256-RSA

--

*`threat.enrichments.indicator.x509.subject.common_name`*::
+
--
List of common names (CN) of subject.

type: keyword

example: shared.global.example.net

--

*`threat.enrichments.indicator.x509.subject.country`*::
+
--
List of country (C) code

type: keyword

example: US

--

*`threat.enrichments.indicator.x509.subject.distinguished_name`*::
+
--
Distinguished name (DN) of the certificate subject entity.

type: keyword

example: C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net

--

*`threat.enrichments.indicator.x509.subject.locality`*::
+
--
List of locality names (L)

type: keyword

example: San Francisco

--

*`threat.enrichments.indicator.x509.subject.organization`*::
+
--
List of organizations (O) of subject.

type: keyword

example: Example, Inc.

--

*`threat.enrichments.indicator.x509.subject.organizational_unit`*::
+
--
List of organizational units (OU) of subject.

type: keyword

--

*`threat.enrichments.indicator.x509.subject.state_or_province`*::
+
--
List of state or province names (ST, S, or P)

type: keyword

example: California

--

*`threat.enrichments.indicator.x509.version_number`*::
+
--
Version of x509 format.

type: keyword

example: 3

--

*`threat.enrichments.matched.atomic`*::
+
--
Identifies the atomic indicator value that matched a local environment endpoint or network event.

type: keyword

example: bad-domain.com

--

*`threat.enrichments.matched.field`*::
+
--
Identifies the field of the atomic indicator that matched a local environment endpoint or network event.

type: keyword

example: file.hash.sha256

--

*`threat.enrichments.matched.id`*::
+
--
Identifies the _id of the indicator document enriching the event.

type: keyword

example: ff93aee5-86a1-4a61-b0e6-0cdc313d01b5

--

*`threat.enrichments.matched.index`*::
+
--
Identifies the _index of the indicator document enriching the event.

type: keyword

example: filebeat-8.0.0-2021.05.23-000011

--

*`threat.enrichments.matched.type`*::
+
--
Identifies the type of match that caused the event to be enriched with the given indicator

type: keyword

example: indicator_match_rule

--

*`threat.framework`*::
+
--
Name of the threat framework used to further categorize and classify the tactic and technique of the reported threat. Framework classification can be provided by detecting systems, evaluated at ingest time, or retrospectively tagged to events.

type: keyword

example: MITRE ATT&CK

--

*`threat.group.alias`*::
+
--
The alias(es) of the group for a set of related intrusion activity that are tracked by a common name in the security community.
While not required, you can use a MITRE ATT&CK® group alias(es).

type: keyword

example: [ "Magecart Group 6" ]

--

*`threat.group.id`*::
+
--
The id of the group for a set of related intrusion activity that are tracked by a common name in the security community.
While not required, you can use a MITRE ATT&CK® group id.

type: keyword

example: G0037

--

*`threat.group.name`*::
+
--
The name of the group for a set of related intrusion activity that are tracked by a common name in the security community.
While not required, you can use a MITRE ATT&CK® group name.

type: keyword

example: FIN6

--

*`threat.group.reference`*::
+
--
The reference URL of the group for a set of related intrusion activity that are tracked by a common name in the security community.
While not required, you can use a MITRE ATT&CK® group reference URL.

type: keyword

example: https://attack.mitre.org/groups/G0037/

--

*`threat.indicator.as.number`*::
+
--
Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet.

type: long

example: 15169

--

*`threat.indicator.as.organization.name`*::
+
--
Organization name.

type: keyword

example: Google LLC

--

*`threat.indicator.as.organization.name.text`*::
+
--
type: match_only_text

--

*`threat.indicator.confidence`*::
+
--
Identifies the confidence rating assigned by the provider using STIX confidence scales.
Recommended values:
  * Not Specified, None, Low, Medium, High
  * 0-10
  * Admirality Scale (1-6)
  * DNI Scale (5-95)
  * WEP Scale (Impossible - Certain)

type: keyword

example: High

--

*`threat.indicator.description`*::
+
--
Describes the type of action conducted by the threat.

type: keyword

example: IP x.x.x.x was observed delivering the Angler EK.

--

*`threat.indicator.email.address`*::
+
--
Identifies a threat indicator as an email address (irrespective of direction).

type: keyword

example: phish@example.com

--

*`threat.indicator.file.accessed`*::
+
--
Last time the file was accessed.
Note that not all filesystems keep track of access time.

type: date

--

*`threat.indicator.file.attributes`*::
+
--
Array of file attributes.
Attributes names will vary by platform. Here's a non-exhaustive list of values that are expected in this field: archive, compressed, directory, encrypted, execute, hidden, read, readonly, system, write.

type: keyword

example: ["readonly", "system"]

--

*`threat.indicator.file.code_signature.digest_algorithm`*::
+
--
The hashing algorithm used to sign the process.
This value can distinguish signatures when a file is signed multiple times by the same signer but with a different digest algorithm.

type: keyword

example: sha256

--

*`threat.indicator.file.code_signature.exists`*::
+
--
Boolean to capture if a signature is present.

type: boolean

example: true

--

*`threat.indicator.file.code_signature.signing_id`*::
+
--
The identifier used to sign the process.
This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.

type: keyword

example: com.apple.xpc.proxy

--

*`threat.indicator.file.code_signature.status`*::
+
--
Additional information about the certificate status.
This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.

type: keyword

example: ERROR_UNTRUSTED_ROOT

--

*`threat.indicator.file.code_signature.subject_name`*::
+
--
Subject name of the code signer

type: keyword

example: Microsoft Corporation

--

*`threat.indicator.file.code_signature.team_id`*::
+
--
The team identifier used to sign the process.
This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.

type: keyword

example: EQHXZ8M8AV

--

*`threat.indicator.file.code_signature.timestamp`*::
+
--
Date and time when the code signature was generated and signed.

type: date

example: 2021-01-01T12:10:30Z

--

*`threat.indicator.file.code_signature.trusted`*::
+
--
Stores the trust status of the certificate chain.
Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.

type: boolean

example: true

--

*`threat.indicator.file.code_signature.valid`*::
+
--
Boolean to capture if the digital signature is verified against the binary content.
Leave unpopulated if a certificate was unchecked.

type: boolean

example: true

--

*`threat.indicator.file.created`*::
+
--
File creation time.
Note that not all filesystems store the creation time.

type: date

--

*`threat.indicator.file.ctime`*::
+
--
Last time the file attributes or metadata changed.
Note that changes to the file content will update `mtime`. This implies `ctime` will be adjusted at the same time, since `mtime` is an attribute of the file.

type: date

--

*`threat.indicator.file.device`*::
+
--
Device that is the source of the file.

type: keyword

example: sda

--

*`threat.indicator.file.directory`*::
+
--
Directory where the file is located. It should include the drive letter, when appropriate.

type: keyword

example: /home/alice

--

*`threat.indicator.file.drive_letter`*::
+
--
Drive letter where the file is located. This field is only relevant on Windows.
The value should be uppercase, and not include the colon.

type: keyword

example: C

--

*`threat.indicator.file.elf.architecture`*::
+
--
Machine architecture of the ELF file.

type: keyword

example: x86-64

--

*`threat.indicator.file.elf.byte_order`*::
+
--
Byte sequence of ELF file.

type: keyword

example: Little Endian

--

*`threat.indicator.file.elf.cpu_type`*::
+
--
CPU type of the ELF file.

type: keyword

example: Intel

--

*`threat.indicator.file.elf.creation_date`*::
+
--
Extracted when possible from the file's metadata. Indicates when it was built or compiled. It can also be faked by malware creators.

type: date

--

*`threat.indicator.file.elf.exports`*::
+
--
List of exported element names and types.

type: flattened

--

*`threat.indicator.file.elf.header.abi_version`*::
+
--
Version of the ELF Application Binary Interface (ABI).

type: keyword

--

*`threat.indicator.file.elf.header.class`*::
+
--
Header class of the ELF file.

type: keyword

--

*`threat.indicator.file.elf.header.data`*::
+
--
Data table of the ELF header.

type: keyword

--

*`threat.indicator.file.elf.header.entrypoint`*::
+
--
Header entrypoint of the ELF file.

type: long

format: string

--

*`threat.indicator.file.elf.header.object_version`*::
+
--
"0x1" for original ELF files.

type: keyword

--

*`threat.indicator.file.elf.header.os_abi`*::
+
--
Application Binary Interface (ABI) of the Linux OS.

type: keyword

--

*`threat.indicator.file.elf.header.type`*::
+
--
Header type of the ELF file.

type: keyword

--

*`threat.indicator.file.elf.header.version`*::
+
--
Version of the ELF header.

type: keyword

--

*`threat.indicator.file.elf.imports`*::
+
--
List of imported element names and types.

type: flattened

--

*`threat.indicator.file.elf.sections`*::
+
--
An array containing an object for each section of the ELF file.
The keys that should be present in these objects are defined by sub-fields underneath `elf.sections.*`.

type: nested

--

*`threat.indicator.file.elf.sections.chi2`*::
+
--
Chi-square probability distribution of the section.

type: long

format: number

--

*`threat.indicator.file.elf.sections.entropy`*::
+
--
Shannon entropy calculation from the section.

type: long

format: number

--

*`threat.indicator.file.elf.sections.flags`*::
+
--
ELF Section List flags.

type: keyword

--

*`threat.indicator.file.elf.sections.name`*::
+
--
ELF Section List name.

type: keyword

--

*`threat.indicator.file.elf.sections.physical_offset`*::
+
--
ELF Section List offset.

type: keyword

--

*`threat.indicator.file.elf.sections.physical_size`*::
+
--
ELF Section List physical size.

type: long

format: bytes

--

*`threat.indicator.file.elf.sections.type`*::
+
--
ELF Section List type.

type: keyword

--

*`threat.indicator.file.elf.sections.virtual_address`*::
+
--
ELF Section List virtual address.

type: long

format: string

--

*`threat.indicator.file.elf.sections.virtual_size`*::
+
--
ELF Section List virtual size.

type: long

format: string

--

*`threat.indicator.file.elf.segments`*::
+
--
An array containing an object for each segment of the ELF file.
The keys that should be present in these objects are defined by sub-fields underneath `elf.segments.*`.

type: nested

--

*`threat.indicator.file.elf.segments.sections`*::
+
--
ELF object segment sections.

type: keyword

--

*`threat.indicator.file.elf.segments.type`*::
+
--
ELF object segment type.

type: keyword

--

*`threat.indicator.file.elf.shared_libraries`*::
+
--
List of shared libraries used by this ELF object.

type: keyword

--

*`threat.indicator.file.elf.telfhash`*::
+
--
telfhash symbol hash for ELF file.

type: keyword

--

*`threat.indicator.file.extension`*::
+
--
File extension, excluding the leading dot.
Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").

type: keyword

example: png

--

*`threat.indicator.file.fork_name`*::
+
--
A fork is additional data associated with a filesystem object.
On Linux, a resource fork is used to store additional data with a filesystem object. A file always has at least one fork for the data portion, and additional forks may exist.
On NTFS, this is analogous to an Alternate Data Stream (ADS), and the default data stream for a file is just called $DATA. Zone.Identifier is commonly used by Windows to track contents downloaded from the Internet. An ADS is typically of the form: `C:\path\to\filename.extension:some_fork_name`, and `some_fork_name` is the value that should populate `fork_name`. `filename.extension` should populate `file.name`, and `extension` should populate `file.extension`. The full path, `file.path`, will include the fork name.

type: keyword

example: Zone.Identifer

--

*`threat.indicator.file.gid`*::
+
--
Primary group ID (GID) of the file.

type: keyword

example: 1001

--

*`threat.indicator.file.group`*::
+
--
Primary group name of the file.

type: keyword

example: alice

--

*`threat.indicator.file.hash.md5`*::
+
--
MD5 hash.

type: keyword

--

*`threat.indicator.file.hash.sha1`*::
+
--
SHA1 hash.

type: keyword

--

*`threat.indicator.file.hash.sha256`*::
+
--
SHA256 hash.

type: keyword

--

*`threat.indicator.file.hash.sha512`*::
+
--
SHA512 hash.

type: keyword

--

*`threat.indicator.file.hash.ssdeep`*::
+
--
SSDEEP hash.

type: keyword

--

*`threat.indicator.file.inode`*::
+
--
Inode representing the file in the filesystem.

type: keyword

example: 256383

--

*`threat.indicator.file.mime_type`*::
+
--
MIME type should identify the format of the file or stream of bytes using https://www.iana.org/assignments/media-types/media-types.xhtml[IANA official types], where possible. When more than one type is applicable, the most specific type should be used.

type: keyword

--

*`threat.indicator.file.mode`*::
+
--
Mode of the file in octal representation.

type: keyword

example: 0640

--

*`threat.indicator.file.mtime`*::
+
--
Last time the file content was modified.

type: date

--

*`threat.indicator.file.name`*::
+
--
Name of the file including the extension, without the directory.

type: keyword

example: example.png

--

*`threat.indicator.file.owner`*::
+
--
File owner's username.

type: keyword

example: alice

--

*`threat.indicator.file.path`*::
+
--
Full path to the file, including the file name. It should include the drive letter, when appropriate.

type: keyword

example: /home/alice/example.png

--

*`threat.indicator.file.path.text`*::
+
--
type: match_only_text

--

*`threat.indicator.file.pe.architecture`*::
+
--
CPU architecture target for the file.

type: keyword

example: x64

--

*`threat.indicator.file.pe.company`*::
+
--
Internal company name of the file, provided at compile-time.

type: keyword

example: Microsoft Corporation

--

*`threat.indicator.file.pe.description`*::
+
--
Internal description of the file, provided at compile-time.

type: keyword

example: Paint

--

*`threat.indicator.file.pe.file_version`*::
+
--
Internal version of the file, provided at compile-time.

type: keyword

example: 6.3.9600.17415

--

*`threat.indicator.file.pe.imphash`*::
+
--
A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.

type: keyword

example: 0c6803c4e922103c4dca5963aad36ddf

--

*`threat.indicator.file.pe.original_file_name`*::
+
--
Internal name of the file, provided at compile-time.

type: keyword

example: MSPAINT.EXE

--

*`threat.indicator.file.pe.product`*::
+
--
Internal product name of the file, provided at compile-time.

type: keyword

example: Microsoft® Windows® Operating System

--

*`threat.indicator.file.size`*::
+
--
File size in bytes.
Only relevant when `file.type` is "file".

type: long

example: 16384

--

*`threat.indicator.file.target_path`*::
+
--
Target path for symlinks.

type: keyword

--

*`threat.indicator.file.target_path.text`*::
+
--
type: match_only_text

--

*`threat.indicator.file.type`*::
+
--
File type (file, dir, or symlink).

type: keyword

example: file

--

*`threat.indicator.file.uid`*::
+
--
The user ID (UID) or security identifier (SID) of the file owner.

type: keyword

example: 1001

--

*`threat.indicator.first_seen`*::
+
--
The date and time when intelligence source first reported sighting this indicator.

type: date

example: 2020-11-05T17:25:47.000Z

--

*`threat.indicator.geo.city_name`*::
+
--
City name.

type: keyword

example: Montreal

--

*`threat.indicator.geo.continent_code`*::
+
--
Two-letter code representing continent's name.

type: keyword

example: NA

--

*`threat.indicator.geo.continent_name`*::
+
--
Name of the continent.

type: keyword

example: North America

--

*`threat.indicator.geo.country_iso_code`*::
+
--
Country ISO code.

type: keyword

example: CA

--

*`threat.indicator.geo.country_name`*::
+
--
Country name.

type: keyword

example: Canada

--

*`threat.indicator.geo.location`*::
+
--
Longitude and latitude.

type: geo_point

example: { "lon": -73.614830, "lat": 45.505918 }

--

*`threat.indicator.geo.name`*::
+
--
User-defined description of a location, at the level of granularity they care about.
Could be the name of their data centers, the floor number, if this describes a local physical entity, city names.
Not typically used in automated geolocation.

type: keyword

example: boston-dc

--

*`threat.indicator.geo.postal_code`*::
+
--
Postal code associated with the location.
Values appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.

type: keyword

example: 94040

--

*`threat.indicator.geo.region_iso_code`*::
+
--
Region ISO code.

type: keyword

example: CA-QC

--

*`threat.indicator.geo.region_name`*::
+
--
Region name.

type: keyword

example: Quebec

--

*`threat.indicator.geo.timezone`*::
+
--
The time zone of the location, such as IANA time zone name.

type: keyword

example: America/Argentina/Buenos_Aires

--

*`threat.indicator.ip`*::
+
--
Identifies a threat indicator as an IP address (irrespective of direction).

type: ip

example: 1.2.3.4

--

*`threat.indicator.last_seen`*::
+
--
The date and time when intelligence source last reported sighting this indicator.

type: date

example: 2020-11-05T17:25:47.000Z

--

*`threat.indicator.marking.tlp`*::
+
--
Traffic Light Protocol sharing markings.
Recommended values are:
  * WHITE
  * GREEN
  * AMBER
  * RED

type: keyword

example: WHITE

--

*`threat.indicator.modified_at`*::
+
--
The date and time when intelligence source last modified information for this indicator.

type: date

example: 2020-11-05T17:25:47.000Z

--

*`threat.indicator.port`*::
+
--
Identifies a threat indicator as a port number (irrespective of direction).

type: long

example: 443

--

*`threat.indicator.provider`*::
+
--
The name of the indicator's provider.

type: keyword

example: lrz_urlhaus

--

*`threat.indicator.reference`*::
+
--
Reference URL linking to additional information about this indicator.

type: keyword

example: https://system.example.com/indicator/0001234

--

*`threat.indicator.registry.data.bytes`*::
+
--
Original bytes written with base64 encoding.
For Windows registry operations, such as SetValueEx and RegQueryValueEx, this corresponds to the data pointed by `lp_data`. This is optional but provides better recoverability and should be populated for REG_BINARY encoded values.

type: keyword

example: ZQBuAC0AVQBTAAAAZQBuAAAAAAA=

--

*`threat.indicator.registry.data.strings`*::
+
--
Content when writing string types.
Populated as an array when writing string data to the registry. For single string registry types (REG_SZ, REG_EXPAND_SZ), this should be an array with one string. For sequences of string with REG_MULTI_SZ, this array will be variable length. For numeric data, such as REG_DWORD and REG_QWORD, this should be populated with the decimal representation (e.g `"1"`).

type: wildcard

example: ["C:\rta\red_ttp\bin\myapp.exe"]

--

*`threat.indicator.registry.data.type`*::
+
--
Standard registry type for encoding contents

type: keyword

example: REG_SZ

--

*`threat.indicator.registry.hive`*::
+
--
Abbreviated name for the hive.

type: keyword

example: HKLM

--

*`threat.indicator.registry.key`*::
+
--
Hive-relative path of keys.

type: keyword

example: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe

--

*`threat.indicator.registry.path`*::
+
--
Full path, including hive, key and value

type: keyword

example: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe\Debugger

--

*`threat.indicator.registry.value`*::
+
--
Name of the value written.

type: keyword

example: Debugger

--

*`threat.indicator.scanner_stats`*::
+
--
Count of AV/EDR vendors that successfully detected malicious file or URL.

type: long

example: 4

--

*`threat.indicator.sightings`*::
+
--
Number of times this indicator was observed conducting threat activity.

type: long

example: 20

--

*`threat.indicator.type`*::
+
--
Type of indicator as represented by Cyber Observable in STIX 2.0.
Recommended values:
  * autonomous-system
  * artifact
  * directory
  * domain-name
  * email-addr
  * file
  * ipv4-addr
  * ipv6-addr
  * mac-addr
  * mutex
  * port
  * process
  * software
  * url
  * user-account
  * windows-registry-key
  * x509-certificate

type: keyword

example: ipv4-addr

--

*`threat.indicator.url.domain`*::
+
--
Domain of the url, such as "www.elastic.co".
In some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `domain` field.
If the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732), the `[` and `]` characters should also be captured in the `domain` field.

type: keyword

example: www.elastic.co

--

*`threat.indicator.url.extension`*::
+
--
The field contains the file extension from the original request url, excluding the leading dot.
The file extension is only set if it exists, as not every url has a file extension.
The leading period must not be included. For example, the value must be "png", not ".png".
Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").

type: keyword

example: png

--

*`threat.indicator.url.fragment`*::
+
--
Portion of the url after the `#`, such as "top".
The `#` is not part of the fragment.

type: keyword

--

*`threat.indicator.url.full`*::
+
--
If full URLs are important to your use case, they should be stored in `url.full`, whether this field is reconstructed or present in the event source.

type: wildcard

example: https://www.elastic.co:443/search?q=elasticsearch#top

--

*`threat.indicator.url.full.text`*::
+
--
type: match_only_text

--

*`threat.indicator.url.original`*::
+
--
Unmodified original url as seen in the event source.
Note that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path.
This field is meant to represent the URL as it was observed, complete or not.

type: wildcard

example: https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch

--

*`threat.indicator.url.original.text`*::
+
--
type: match_only_text

--

*`threat.indicator.url.password`*::
+
--
Password of the request.

type: keyword

--

*`threat.indicator.url.path`*::
+
--
Path of the request, such as "/search".

type: wildcard

--

*`threat.indicator.url.port`*::
+
--
Port of the request, such as 443.

type: long

example: 443

format: string

--

*`threat.indicator.url.query`*::
+
--
The query field describes the query string of the request, such as "q=elasticsearch".
The `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases.

type: keyword

--

*`threat.indicator.url.registered_domain`*::
+
--
The highest registered url domain, stripped of the subdomain.
For example, the registered domain for "foo.example.com" is "example.com".
This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk".

type: keyword

example: example.com

--

*`threat.indicator.url.scheme`*::
+
--
Scheme of the request, such as "https".
Note: The `:` is not part of the scheme.

type: keyword

example: https

--

*`threat.indicator.url.subdomain`*::
+
--
The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain.  In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain.
For example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period.

type: keyword

example: east

--

*`threat.indicator.url.top_level_domain`*::
+
--
The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com".
This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk".

type: keyword

example: co.uk

--

*`threat.indicator.url.username`*::
+
--
Username of the request.

type: keyword

--

*`threat.indicator.x509.alternative_names`*::
+
--
List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses.

type: keyword

example: *.elastic.co

--

*`threat.indicator.x509.issuer.common_name`*::
+
--
List of common name (CN) of issuing certificate authority.

type: keyword

example: Example SHA2 High Assurance Server CA

--

*`threat.indicator.x509.issuer.country`*::
+
--
List of country (C) codes

type: keyword

example: US

--

*`threat.indicator.x509.issuer.distinguished_name`*::
+
--
Distinguished name (DN) of issuing certificate authority.

type: keyword

example: C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA

--

*`threat.indicator.x509.issuer.locality`*::
+
--
List of locality names (L)

type: keyword

example: Mountain View

--

*`threat.indicator.x509.issuer.organization`*::
+
--
List of organizations (O) of issuing certificate authority.

type: keyword

example: Example Inc

--

*`threat.indicator.x509.issuer.organizational_unit`*::
+
--
List of organizational units (OU) of issuing certificate authority.

type: keyword

example: www.example.com

--

*`threat.indicator.x509.issuer.state_or_province`*::
+
--
List of state or province names (ST, S, or P)

type: keyword

example: California

--

*`threat.indicator.x509.not_after`*::
+
--
Time at which the certificate is no longer considered valid.

type: date

example: 2020-07-16 03:15:39+00:00

--

*`threat.indicator.x509.not_before`*::
+
--
Time at which the certificate is first considered valid.

type: date

example: 2019-08-16 01:40:25+00:00

--

*`threat.indicator.x509.public_key_algorithm`*::
+
--
Algorithm used to generate the public key.

type: keyword

example: RSA

--

*`threat.indicator.x509.public_key_curve`*::
+
--
The curve used by the elliptic curve public key algorithm. This is algorithm specific.

type: keyword

example: nistp521

--

*`threat.indicator.x509.public_key_exponent`*::
+
--
Exponent used to derive the public key. This is algorithm specific.

type: long

example: 65537

Field is not indexed.

--

*`threat.indicator.x509.public_key_size`*::
+
--
The size of the public key space in bits.

type: long

example: 2048

--

*`threat.indicator.x509.serial_number`*::
+
--
Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters.

type: keyword

example: 55FBB9C7DEBF09809D12CCAA

--

*`threat.indicator.x509.signature_algorithm`*::
+
--
Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353.

type: keyword

example: SHA256-RSA

--

*`threat.indicator.x509.subject.common_name`*::
+
--
List of common names (CN) of subject.

type: keyword

example: shared.global.example.net

--

*`threat.indicator.x509.subject.country`*::
+
--
List of country (C) code

type: keyword

example: US

--

*`threat.indicator.x509.subject.distinguished_name`*::
+
--
Distinguished name (DN) of the certificate subject entity.

type: keyword

example: C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net

--

*`threat.indicator.x509.subject.locality`*::
+
--
List of locality names (L)

type: keyword

example: San Francisco

--

*`threat.indicator.x509.subject.organization`*::
+
--
List of organizations (O) of subject.

type: keyword

example: Example, Inc.

--

*`threat.indicator.x509.subject.organizational_unit`*::
+
--
List of organizational units (OU) of subject.

type: keyword

--

*`threat.indicator.x509.subject.state_or_province`*::
+
--
List of state or province names (ST, S, or P)

type: keyword

example: California

--

*`threat.indicator.x509.version_number`*::
+
--
Version of x509 format.

type: keyword

example: 3

--

*`threat.software.alias`*::
+
--
The alias(es) of the software for a set of related intrusion activity that are tracked by a common name in the security community.
While not required, you can use a MITRE ATT&CK® associated software description.

type: keyword

example: [ "X-Agent" ]

--

*`threat.software.id`*::
+
--
The id of the software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK®.
While not required, you can use a MITRE ATT&CK® software id.

type: keyword

example: S0552

--

*`threat.software.name`*::
+
--
The name of the software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK®.
While not required, you can use a MITRE ATT&CK® software name.

type: keyword

example: AdFind

--

*`threat.software.platforms`*::
+
--
The platforms of the software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK®.
Recommended Values:
  * AWS
  * Azure
  * Azure AD
  * GCP
  * Linux
  * macOS
  * Network
  * Office 365
  * SaaS
  * Windows

While not required, you can use a MITRE ATT&CK® software platforms.

type: keyword

example: [ "Windows" ]

--

*`threat.software.reference`*::
+
--
The reference URL of the software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK®.
While not required, you can use a MITRE ATT&CK® software reference URL.

type: keyword

example: https://attack.mitre.org/software/S0552/

--

*`threat.software.type`*::
+
--
The type of software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK®.
Recommended values
  * Malware
  * Tool

 While not required, you can use a MITRE ATT&CK® software type.

type: keyword

example: Tool

--

*`threat.tactic.id`*::
+
--
The id of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ )

type: keyword

example: TA0002

--

*`threat.tactic.name`*::
+
--
Name of the type of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/)

type: keyword

example: Execution

--

*`threat.tactic.reference`*::
+
--
The reference url of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ )

type: keyword

example: https://attack.mitre.org/tactics/TA0002/

--

*`threat.technique.id`*::
+
--
The id of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)

type: keyword

example: T1059

--

*`threat.technique.name`*::
+
--
The name of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)

type: keyword

example: Command and Scripting Interpreter

--

*`threat.technique.name.text`*::
+
--
type: match_only_text

--

*`threat.technique.reference`*::
+
--
The reference url of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)

type: keyword

example: https://attack.mitre.org/techniques/T1059/

--

*`threat.technique.subtechnique.id`*::
+
--
The full id of subtechnique used by this threat. You can use a MITRE ATT&CK® subtechnique, for example. (ex. https://attack.mitre.org/techniques/T1059/001/)

type: keyword

example: T1059.001

--

*`threat.technique.subtechnique.name`*::
+
--
The name of subtechnique used by this threat. You can use a MITRE ATT&CK® subtechnique, for example. (ex. https://attack.mitre.org/techniques/T1059/001/)

type: keyword

example: PowerShell

--

*`threat.technique.subtechnique.name.text`*::
+
--
type: match_only_text

--

*`threat.technique.subtechnique.reference`*::
+
--
The reference url of subtechnique used by this threat. You can use a MITRE ATT&CK® subtechnique, for example. (ex. https://attack.mitre.org/techniques/T1059/001/)

type: keyword

example: https://attack.mitre.org/techniques/T1059/001/

--

[float]
=== tls

Fields related to a TLS connection. These fields focus on the TLS protocol itself and intentionally avoids in-depth analysis of the related x.509 certificate files.


*`tls.cipher`*::
+
--
String indicating the cipher used during the current connection.

type: keyword

example: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256

--

*`tls.client.certificate`*::
+
--
PEM-encoded stand-alone certificate offered by the client. This is usually mutually-exclusive of `client.certificate_chain` since this value also exists in that list.

type: keyword

example: MII...

--

*`tls.client.certificate_chain`*::
+
--
Array of PEM-encoded certificates that make up the certificate chain offered by the client. This is usually mutually-exclusive of `client.certificate` since that value should be the first certificate in the chain.

type: keyword

example: ["MII...", "MII..."]

--

*`tls.client.hash.md5`*::
+
--
Certificate fingerprint using the MD5 digest of DER-encoded version of certificate offered by the client. For consistency with other hash values, this value should be formatted as an uppercase hash.

type: keyword

example: 0F76C7F2C55BFD7D8E8B8F4BFBF0C9EC

--

*`tls.client.hash.sha1`*::
+
--
Certificate fingerprint using the SHA1 digest of DER-encoded version of certificate offered by the client. For consistency with other hash values, this value should be formatted as an uppercase hash.

type: keyword

example: 9E393D93138888D288266C2D915214D1D1CCEB2A

--

*`tls.client.hash.sha256`*::
+
--
Certificate fingerprint using the SHA256 digest of DER-encoded version of certificate offered by the client. For consistency with other hash values, this value should be formatted as an uppercase hash.

type: keyword

example: 0687F666A054EF17A08E2F2162EAB4CBC0D265E1D7875BE74BF3C712CA92DAF0

--

*`tls.client.issuer`*::
+
--
Distinguished name of subject of the issuer of the x.509 certificate presented by the client.

type: keyword

example: CN=Example Root CA, OU=Infrastructure Team, DC=example, DC=com

--

*`tls.client.ja3`*::
+
--
A hash that identifies clients based on how they perform an SSL/TLS handshake.

type: keyword

example: d4e5b18d6b55c71272893221c96ba240

--

*`tls.client.not_after`*::
+
--
Date/Time indicating when client certificate is no longer considered valid.

type: date

example: 2021-01-01T00:00:00.000Z

--

*`tls.client.not_before`*::
+
--
Date/Time indicating when client certificate is first considered valid.

type: date

example: 1970-01-01T00:00:00.000Z

--

*`tls.client.server_name`*::
+
--
Also called an SNI, this tells the server which hostname to which the client is attempting to connect to. When this value is available, it should get copied to `destination.domain`.

type: keyword

example: www.elastic.co

--

*`tls.client.subject`*::
+
--
Distinguished name of subject of the x.509 certificate presented by the client.

type: keyword

example: CN=myclient, OU=Documentation Team, DC=example, DC=com

--

*`tls.client.supported_ciphers`*::
+
--
Array of ciphers offered by the client during the client hello.

type: keyword

example: ["TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "..."]

--

*`tls.client.x509.alternative_names`*::
+
--
List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses.

type: keyword

example: *.elastic.co

--

*`tls.client.x509.issuer.common_name`*::
+
--
List of common name (CN) of issuing certificate authority.

type: keyword

example: Example SHA2 High Assurance Server CA

--

*`tls.client.x509.issuer.country`*::
+
--
List of country (C) codes

type: keyword

example: US

--

*`tls.client.x509.issuer.distinguished_name`*::
+
--
Distinguished name (DN) of issuing certificate authority.

type: keyword

example: C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA

--

*`tls.client.x509.issuer.locality`*::
+
--
List of locality names (L)

type: keyword

example: Mountain View

--

*`tls.client.x509.issuer.organization`*::
+
--
List of organizations (O) of issuing certificate authority.

type: keyword

example: Example Inc

--

*`tls.client.x509.issuer.organizational_unit`*::
+
--
List of organizational units (OU) of issuing certificate authority.

type: keyword

example: www.example.com

--

*`tls.client.x509.issuer.state_or_province`*::
+
--
List of state or province names (ST, S, or P)

type: keyword

example: California

--

*`tls.client.x509.not_after`*::
+
--
Time at which the certificate is no longer considered valid.

type: date

example: 2020-07-16 03:15:39+00:00

--

*`tls.client.x509.not_before`*::
+
--
Time at which the certificate is first considered valid.

type: date

example: 2019-08-16 01:40:25+00:00

--

*`tls.client.x509.public_key_algorithm`*::
+
--
Algorithm used to generate the public key.

type: keyword

example: RSA

--

*`tls.client.x509.public_key_curve`*::
+
--
The curve used by the elliptic curve public key algorithm. This is algorithm specific.

type: keyword

example: nistp521

--

*`tls.client.x509.public_key_exponent`*::
+
--
Exponent used to derive the public key. This is algorithm specific.

type: long

example: 65537

Field is not indexed.

--

*`tls.client.x509.public_key_size`*::
+
--
The size of the public key space in bits.

type: long

example: 2048

--

*`tls.client.x509.serial_number`*::
+
--
Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters.

type: keyword

example: 55FBB9C7DEBF09809D12CCAA

--

*`tls.client.x509.signature_algorithm`*::
+
--
Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353.

type: keyword

example: SHA256-RSA

--

*`tls.client.x509.subject.common_name`*::
+
--
List of common names (CN) of subject.

type: keyword

example: shared.global.example.net

--

*`tls.client.x509.subject.country`*::
+
--
List of country (C) code

type: keyword

example: US

--

*`tls.client.x509.subject.distinguished_name`*::
+
--
Distinguished name (DN) of the certificate subject entity.

type: keyword

example: C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net

--

*`tls.client.x509.subject.locality`*::
+
--
List of locality names (L)

type: keyword

example: San Francisco

--

*`tls.client.x509.subject.organization`*::
+
--
List of organizations (O) of subject.

type: keyword

example: Example, Inc.

--

*`tls.client.x509.subject.organizational_unit`*::
+
--
List of organizational units (OU) of subject.

type: keyword

--

*`tls.client.x509.subject.state_or_province`*::
+
--
List of state or province names (ST, S, or P)

type: keyword

example: California

--

*`tls.client.x509.version_number`*::
+
--
Version of x509 format.

type: keyword

example: 3

--

*`tls.curve`*::
+
--
String indicating the curve used for the given cipher, when applicable.

type: keyword

example: secp256r1

--

*`tls.established`*::
+
--
Boolean flag indicating if the TLS negotiation was successful and transitioned to an encrypted tunnel.

type: boolean

--

*`tls.next_protocol`*::
+
--
String indicating the protocol being tunneled. Per the values in the IANA registry (https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml#alpn-protocol-ids), this string should be lower case.

type: keyword

example: http/1.1

--

*`tls.resumed`*::
+
--
Boolean flag indicating if this TLS connection was resumed from an existing TLS negotiation.

type: boolean

--

*`tls.server.certificate`*::
+
--
PEM-encoded stand-alone certificate offered by the server. This is usually mutually-exclusive of `server.certificate_chain` since this value also exists in that list.

type: keyword

example: MII...

--

*`tls.server.certificate_chain`*::
+
--
Array of PEM-encoded certificates that make up the certificate chain offered by the server. This is usually mutually-exclusive of `server.certificate` since that value should be the first certificate in the chain.

type: keyword

example: ["MII...", "MII..."]

--

*`tls.server.hash.md5`*::
+
--
Certificate fingerprint using the MD5 digest of DER-encoded version of certificate offered by the server. For consistency with other hash values, this value should be formatted as an uppercase hash.

type: keyword

example: 0F76C7F2C55BFD7D8E8B8F4BFBF0C9EC

--

*`tls.server.hash.sha1`*::
+
--
Certificate fingerprint using the SHA1 digest of DER-encoded version of certificate offered by the server. For consistency with other hash values, this value should be formatted as an uppercase hash.

type: keyword

example: 9E393D93138888D288266C2D915214D1D1CCEB2A

--

*`tls.server.hash.sha256`*::
+
--
Certificate fingerprint using the SHA256 digest of DER-encoded version of certificate offered by the server. For consistency with other hash values, this value should be formatted as an uppercase hash.

type: keyword

example: 0687F666A054EF17A08E2F2162EAB4CBC0D265E1D7875BE74BF3C712CA92DAF0

--

*`tls.server.issuer`*::
+
--
Subject of the issuer of the x.509 certificate presented by the server.

type: keyword

example: CN=Example Root CA, OU=Infrastructure Team, DC=example, DC=com

--

*`tls.server.ja3s`*::
+
--
A hash that identifies servers based on how they perform an SSL/TLS handshake.

type: keyword

example: 394441ab65754e2207b1e1b457b3641d

--

*`tls.server.not_after`*::
+
--
Timestamp indicating when server certificate is no longer considered valid.

type: date

example: 2021-01-01T00:00:00.000Z

--

*`tls.server.not_before`*::
+
--
Timestamp indicating when server certificate is first considered valid.

type: date

example: 1970-01-01T00:00:00.000Z

--

*`tls.server.subject`*::
+
--
Subject of the x.509 certificate presented by the server.

type: keyword

example: CN=www.example.com, OU=Infrastructure Team, DC=example, DC=com

--

*`tls.server.x509.alternative_names`*::
+
--
List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses.

type: keyword

example: *.elastic.co

--

*`tls.server.x509.issuer.common_name`*::
+
--
List of common name (CN) of issuing certificate authority.

type: keyword

example: Example SHA2 High Assurance Server CA

--

*`tls.server.x509.issuer.country`*::
+
--
List of country (C) codes

type: keyword

example: US

--

*`tls.server.x509.issuer.distinguished_name`*::
+
--
Distinguished name (DN) of issuing certificate authority.

type: keyword

example: C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA

--

*`tls.server.x509.issuer.locality`*::
+
--
List of locality names (L)

type: keyword

example: Mountain View

--

*`tls.server.x509.issuer.organization`*::
+
--
List of organizations (O) of issuing certificate authority.

type: keyword

example: Example Inc

--

*`tls.server.x509.issuer.organizational_unit`*::
+
--
List of organizational units (OU) of issuing certificate authority.

type: keyword

example: www.example.com

--

*`tls.server.x509.issuer.state_or_province`*::
+
--
List of state or province names (ST, S, or P)

type: keyword

example: California

--

*`tls.server.x509.not_after`*::
+
--
Time at which the certificate is no longer considered valid.

type: date

example: 2020-07-16 03:15:39+00:00

--

*`tls.server.x509.not_before`*::
+
--
Time at which the certificate is first considered valid.

type: date

example: 2019-08-16 01:40:25+00:00

--

*`tls.server.x509.public_key_algorithm`*::
+
--
Algorithm used to generate the public key.

type: keyword

example: RSA

--

*`tls.server.x509.public_key_curve`*::
+
--
The curve used by the elliptic curve public key algorithm. This is algorithm specific.

type: keyword

example: nistp521

--

*`tls.server.x509.public_key_exponent`*::
+
--
Exponent used to derive the public key. This is algorithm specific.

type: long

example: 65537

Field is not indexed.

--

*`tls.server.x509.public_key_size`*::
+
--
The size of the public key space in bits.

type: long

example: 2048

--

*`tls.server.x509.serial_number`*::
+
--
Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters.

type: keyword

example: 55FBB9C7DEBF09809D12CCAA

--

*`tls.server.x509.signature_algorithm`*::
+
--
Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353.

type: keyword

example: SHA256-RSA

--

*`tls.server.x509.subject.common_name`*::
+
--
List of common names (CN) of subject.

type: keyword

example: shared.global.example.net

--

*`tls.server.x509.subject.country`*::
+
--
List of country (C) code

type: keyword

example: US

--

*`tls.server.x509.subject.distinguished_name`*::
+
--
Distinguished name (DN) of the certificate subject entity.

type: keyword

example: C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net

--

*`tls.server.x509.subject.locality`*::
+
--
List of locality names (L)

type: keyword

example: San Francisco

--

*`tls.server.x509.subject.organization`*::
+
--
List of organizations (O) of subject.

type: keyword

example: Example, Inc.

--

*`tls.server.x509.subject.organizational_unit`*::
+
--
List of organizational units (OU) of subject.

type: keyword

--

*`tls.server.x509.subject.state_or_province`*::
+
--
List of state or province names (ST, S, or P)

type: keyword

example: California

--

*`tls.server.x509.version_number`*::
+
--
Version of x509 format.

type: keyword

example: 3

--

*`tls.version`*::
+
--
Numeric part of the version parsed from the original string.

type: keyword

example: 1.2

--

*`tls.version_protocol`*::
+
--
Normalized lowercase protocol name parsed from original string.

type: keyword

example: tls

--

*`span.id`*::
+
--
Unique identifier of the span within the scope of its trace.
A span represents an operation within a transaction, such as a request to another service, or a database query.

type: keyword

example: 3ff9a8981b7ccd5a

--

*`trace.id`*::
+
--
Unique identifier of the trace.
A trace groups multiple events like transactions that belong together. For example, a user request handled by multiple inter-connected services.

type: keyword

example: 4bf92f3577b34da6a3ce929d0e0e4736

--

*`transaction.id`*::
+
--
Unique identifier of the transaction within the scope of its trace.
A transaction is the highest level of work measured within a service, such as a request to a server.

type: keyword

example: 00f067aa0ba902b7

--

[float]
=== url

URL fields provide support for complete or partial URLs, and supports the breaking down into scheme, domain, path, and so on.


*`url.domain`*::
+
--
Domain of the url, such as "www.elastic.co".
In some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `domain` field.
If the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732), the `[` and `]` characters should also be captured in the `domain` field.

type: keyword

example: www.elastic.co

--

*`url.extension`*::
+
--
The field contains the file extension from the original request url, excluding the leading dot.
The file extension is only set if it exists, as not every url has a file extension.
The leading period must not be included. For example, the value must be "png", not ".png".
Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").

type: keyword

example: png

--

*`url.fragment`*::
+
--
Portion of the url after the `#`, such as "top".
The `#` is not part of the fragment.

type: keyword

--

*`url.full`*::
+
--
If full URLs are important to your use case, they should be stored in `url.full`, whether this field is reconstructed or present in the event source.

type: wildcard

example: https://www.elastic.co:443/search?q=elasticsearch#top

--

*`url.full.text`*::
+
--
type: match_only_text

--

*`url.original`*::
+
--
Unmodified original url as seen in the event source.
Note that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path.
This field is meant to represent the URL as it was observed, complete or not.

type: wildcard

example: https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch

--

*`url.original.text`*::
+
--
type: match_only_text

--

*`url.password`*::
+
--
Password of the request.

type: keyword

--

*`url.path`*::
+
--
Path of the request, such as "/search".

type: wildcard

--

*`url.port`*::
+
--
Port of the request, such as 443.

type: long

example: 443

format: string

--

*`url.query`*::
+
--
The query field describes the query string of the request, such as "q=elasticsearch".
The `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases.

type: keyword

--

*`url.registered_domain`*::
+
--
The highest registered url domain, stripped of the subdomain.
For example, the registered domain for "foo.example.com" is "example.com".
This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk".

type: keyword

example: example.com

--

*`url.scheme`*::
+
--
Scheme of the request, such as "https".
Note: The `:` is not part of the scheme.

type: keyword

example: https

--

*`url.subdomain`*::
+
--
The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain.  In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain.
For example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period.

type: keyword

example: east

--

*`url.top_level_domain`*::
+
--
The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com".
This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk".

type: keyword

example: co.uk

--

*`url.username`*::
+
--
Username of the request.

type: keyword

--

[float]
=== user

The user fields describe information about the user that is relevant to the event.
Fields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them.


*`user.changes.domain`*::
+
--
Name of the directory the user is a member of.
For example, an LDAP or Active Directory domain name.

type: keyword

--

*`user.changes.email`*::
+
--
User email address.

type: keyword

--

*`user.changes.full_name`*::
+
--
User's full name, if available.

type: keyword

example: Albert Einstein

--

*`user.changes.full_name.text`*::
+
--
type: match_only_text

--

*`user.changes.group.domain`*::
+
--
Name of the directory the group is a member of.
For example, an LDAP or Active Directory domain name.

type: keyword

--

*`user.changes.group.id`*::
+
--
Unique identifier for the group on the system/platform.

type: keyword

--

*`user.changes.group.name`*::
+
--
Name of the group.

type: keyword

--

*`user.changes.hash`*::
+
--
Unique user hash to correlate information for a user in anonymized form.
Useful if `user.id` or `user.name` contain confidential information and cannot be used.

type: keyword

--

*`user.changes.id`*::
+
--
Unique identifier of the user.

type: keyword

example: S-1-5-21-202424912787-2692429404-2351956786-1000

--

*`user.changes.name`*::
+
--
Short name or login of the user.

type: keyword

example: a.einstein

--

*`user.changes.name.text`*::
+
--
type: match_only_text

--

*`user.changes.roles`*::
+
--
Array of user roles at the time of the event.

type: keyword

example: ["kibana_admin", "reporting_user"]

--

*`user.domain`*::
+
--
Name of the directory the user is a member of.
For example, an LDAP or Active Directory domain name.

type: keyword

--

*`user.effective.domain`*::
+
--
Name of the directory the user is a member of.
For example, an LDAP or Active Directory domain name.

type: keyword

--

*`user.effective.email`*::
+
--
User email address.

type: keyword

--

*`user.effective.full_name`*::
+
--
User's full name, if available.

type: keyword

example: Albert Einstein

--

*`user.effective.full_name.text`*::
+
--
type: match_only_text

--

*`user.effective.group.domain`*::
+
--
Name of the directory the group is a member of.
For example, an LDAP or Active Directory domain name.

type: keyword

--

*`user.effective.group.id`*::
+
--
Unique identifier for the group on the system/platform.

type: keyword

--

*`user.effective.group.name`*::
+
--
Name of the group.

type: keyword

--

*`user.effective.hash`*::
+
--
Unique user hash to correlate information for a user in anonymized form.
Useful if `user.id` or `user.name` contain confidential information and cannot be used.

type: keyword

--

*`user.effective.id`*::
+
--
Unique identifier of the user.

type: keyword

example: S-1-5-21-202424912787-2692429404-2351956786-1000

--

*`user.effective.name`*::
+
--
Short name or login of the user.

type: keyword

example: a.einstein

--

*`user.effective.name.text`*::
+
--
type: match_only_text

--

*`user.effective.roles`*::
+
--
Array of user roles at the time of the event.

type: keyword

example: ["kibana_admin", "reporting_user"]

--

*`user.email`*::
+
--
User email address.

type: keyword

--

*`user.full_name`*::
+
--
User's full name, if available.

type: keyword

example: Albert Einstein

--

*`user.full_name.text`*::
+
--
type: match_only_text

--

*`user.group.domain`*::
+
--
Name of the directory the group is a member of.
For example, an LDAP or Active Directory domain name.

type: keyword

--

*`user.group.id`*::
+
--
Unique identifier for the group on the system/platform.

type: keyword

--

*`user.group.name`*::
+
--
Name of the group.

type: keyword

--

*`user.hash`*::
+
--
Unique user hash to correlate information for a user in anonymized form.
Useful if `user.id` or `user.name` contain confidential information and cannot be used.

type: keyword

--

*`user.id`*::
+
--
Unique identifier of the user.

type: keyword

example: S-1-5-21-202424912787-2692429404-2351956786-1000

--

*`user.name`*::
+
--
Short name or login of the user.

type: keyword

example: a.einstein

--

*`user.name.text`*::
+
--
type: match_only_text

--

*`user.roles`*::
+
--
Array of user roles at the time of the event.

type: keyword

example: ["kibana_admin", "reporting_user"]

--

*`user.target.domain`*::
+
--
Name of the directory the user is a member of.
For example, an LDAP or Active Directory domain name.

type: keyword

--

*`user.target.email`*::
+
--
User email address.

type: keyword

--

*`user.target.full_name`*::
+
--
User's full name, if available.

type: keyword

example: Albert Einstein

--

*`user.target.full_name.text`*::
+
--
type: match_only_text

--

*`user.target.group.domain`*::
+
--
Name of the directory the group is a member of.
For example, an LDAP or Active Directory domain name.

type: keyword

--

*`user.target.group.id`*::
+
--
Unique identifier for the group on the system/platform.

type: keyword

--

*`user.target.group.name`*::
+
--
Name of the group.

type: keyword

--

*`user.target.hash`*::
+
--
Unique user hash to correlate information for a user in anonymized form.
Useful if `user.id` or `user.name` contain confidential information and cannot be used.

type: keyword

--

*`user.target.id`*::
+
--
Unique identifier of the user.

type: keyword

example: S-1-5-21-202424912787-2692429404-2351956786-1000

--

*`user.target.name`*::
+
--
Short name or login of the user.

type: keyword

example: a.einstein

--

*`user.target.name.text`*::
+
--
type: match_only_text

--

*`user.target.roles`*::
+
--
Array of user roles at the time of the event.

type: keyword

example: ["kibana_admin", "reporting_user"]

--

[float]
=== user_agent

The user_agent fields normally come from a browser request.
They often show up in web service logs coming from the parsed user agent string.


*`user_agent.device.name`*::
+
--
Name of the device.

type: keyword

example: iPhone

--

*`user_agent.name`*::
+
--
Name of the user agent.

type: keyword

example: Safari

--

*`user_agent.original`*::
+
--
Unparsed user_agent string.

type: keyword

example: Mozilla/5.0 (iPhone; CPU iPhone OS 12_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1

--

*`user_agent.original.text`*::
+
--
type: match_only_text

--

*`user_agent.os.family`*::
+
--
OS family (such as redhat, debian, freebsd, windows).

type: keyword

example: debian

--

*`user_agent.os.full`*::
+
--
Operating system name, including the version or code name.

type: keyword

example: Mac OS Mojave

--

*`user_agent.os.full.text`*::
+
--
type: match_only_text

--

*`user_agent.os.kernel`*::
+
--
Operating system kernel version as a raw string.

type: keyword

example: 4.4.0-112-generic

--

*`user_agent.os.name`*::
+
--
Operating system name, without the version.

type: keyword

example: Mac OS X

--

*`user_agent.os.name.text`*::
+
--
type: match_only_text

--

*`user_agent.os.platform`*::
+
--
Operating system platform (such centos, ubuntu, windows).

type: keyword

example: darwin

--

*`user_agent.os.type`*::
+
--
Use the `os.type` field to categorize the operating system into one of the broad commercial families.
One of these following values should be used (lowercase): linux, macos, unix, windows.
If the OS you're dealing with is not in the list, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.

type: keyword

example: macos

--

*`user_agent.os.version`*::
+
--
Operating system version as a raw string.

type: keyword

example: 10.14.1

--

*`user_agent.version`*::
+
--
Version of the user agent.

type: keyword

example: 12.0

--

[float]
=== vlan

The VLAN fields are used to identify 802.1q tag(s) of a packet, as well as ingress and egress VLAN associations of an observer in relation to a specific packet or connection.
Network.vlan fields are used to record a single VLAN tag, or the outer tag in the case of q-in-q encapsulations, for a packet or connection as observed, typically provided by a network sensor (e.g. Zeek, Wireshark) passively reporting on traffic.
Network.inner VLAN fields are used to report inner q-in-q 802.1q tags (multiple 802.1q encapsulations) as observed, typically provided by a network sensor  (e.g. Zeek, Wireshark) passively reporting on traffic. Network.inner VLAN fields should only be used in addition to network.vlan fields to indicate q-in-q tagging.
Observer.ingress and observer.egress VLAN values are used to record observer specific information when observer events contain discrete ingress and egress VLAN information, typically provided by firewalls, routers, or load balancers.


*`vlan.id`*::
+
--
VLAN ID as reported by the observer.

type: keyword

example: 10

--

*`vlan.name`*::
+
--
Optional VLAN name as reported by the observer.

type: keyword

example: outside

--

[float]
=== vulnerability

The vulnerability fields describe information about a vulnerability that is relevant to an event.


*`vulnerability.category`*::
+
--
The type of system or architecture that the vulnerability affects. These may be platform-specific (for example, Debian or SUSE) or general (for example, Database or Firewall). For example (https://qualysguard.qualys.com/qwebhelp/fo_portal/knowledgebase/vulnerability_categories.htm[Qualys vulnerability categories])
This field must be an array.

type: keyword

example: ["Firewall"]

--

*`vulnerability.classification`*::
+
--
The classification of the vulnerability scoring system. For example (https://www.first.org/cvss/)

type: keyword

example: CVSS

--

*`vulnerability.description`*::
+
--
The description of the vulnerability that provides additional context of the vulnerability. For example (https://cve.mitre.org/about/faqs.html#cve_entry_descriptions_created[Common Vulnerabilities and Exposure CVE description])

type: keyword

example: In macOS before 2.12.6, there is a vulnerability in the RPC...

--

*`vulnerability.description.text`*::
+
--
type: match_only_text

--

*`vulnerability.enumeration`*::
+
--
The type of identifier used for this vulnerability. For example (https://cve.mitre.org/about/)

type: keyword

example: CVE

--

*`vulnerability.id`*::
+
--
The identification (ID) is the number portion of a vulnerability entry. It includes a unique identification number for the vulnerability. For example (https://cve.mitre.org/about/faqs.html#what_is_cve_id)[Common Vulnerabilities and Exposure CVE ID]

type: keyword

example: CVE-2019-00001

--

*`vulnerability.reference`*::
+
--
A resource that provides additional information, context, and mitigations for the identified vulnerability.

type: keyword

example: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6111

--

*`vulnerability.report_id`*::
+
--
The report or scan identification number.

type: keyword

example: 20191018.0001

--

*`vulnerability.scanner.vendor`*::
+
--
The name of the vulnerability scanner vendor.

type: keyword

example: Tenable

--

*`vulnerability.score.base`*::
+
--
Scores can range from 0.0 to 10.0, with 10.0 being the most severe.
Base scores cover an assessment for exploitability metrics (attack vector, complexity, privileges, and user interaction), impact metrics (confidentiality, integrity, and availability), and scope. For example (https://www.first.org/cvss/specification-document)

type: float

example: 5.5

--

*`vulnerability.score.environmental`*::
+
--
Scores can range from 0.0 to 10.0, with 10.0 being the most severe.
Environmental scores cover an assessment for any modified Base metrics, confidentiality, integrity, and availability requirements. For example (https://www.first.org/cvss/specification-document)

type: float

example: 5.5

--

*`vulnerability.score.temporal`*::
+
--
Scores can range from 0.0 to 10.0, with 10.0 being the most severe.
Temporal scores cover an assessment for code maturity, remediation level, and confidence. For example (https://www.first.org/cvss/specification-document)

type: float

--

*`vulnerability.score.version`*::
+
--
The National Vulnerability Database (NVD) provides qualitative severity rankings of "Low", "Medium", and "High" for CVSS v2.0 base score ranges in addition to the severity ratings for CVSS v3.0 as they are defined in the CVSS v3.0 specification.
CVSS is owned and managed by FIRST.Org, Inc. (FIRST), a US-based non-profit organization, whose mission is to help computer security incident response teams across the world. For example (https://nvd.nist.gov/vuln-metrics/cvss)

type: keyword

example: 2.0

--

*`vulnerability.severity`*::
+
--
The severity of the vulnerability can help with metrics and internal prioritization regarding remediation. For example (https://nvd.nist.gov/vuln-metrics/cvss)

type: keyword

example: Critical

--

[float]
=== x509

This implements the common core fields for x509 certificates. This information is likely logged with TLS sessions, digital signatures found in executable binaries, S/MIME information in email bodies, or analysis of files on disk.
When the certificate relates to a file, use the fields at `file.x509`. When hashes of the DER-encoded certificate are available, the `hash` data set should be populated as well (e.g. `file.hash.sha256`).
Events that contain certificate information about network connections, should use the x509 fields under the relevant TLS fields: `tls.server.x509` and/or `tls.client.x509`.


*`x509.alternative_names`*::
+
--
List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses.

type: keyword

example: *.elastic.co

--

*`x509.issuer.common_name`*::
+
--
List of common name (CN) of issuing certificate authority.

type: keyword

example: Example SHA2 High Assurance Server CA

--

*`x509.issuer.country`*::
+
--
List of country (C) codes

type: keyword

example: US

--

*`x509.issuer.distinguished_name`*::
+
--
Distinguished name (DN) of issuing certificate authority.

type: keyword

example: C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA

--

*`x509.issuer.locality`*::
+
--
List of locality names (L)

type: keyword

example: Mountain View

--

*`x509.issuer.organization`*::
+
--
List of organizations (O) of issuing certificate authority.

type: keyword

example: Example Inc

--

*`x509.issuer.organizational_unit`*::
+
--
List of organizational units (OU) of issuing certificate authority.

type: keyword

example: www.example.com

--

*`x509.issuer.state_or_province`*::
+
--
List of state or province names (ST, S, or P)

type: keyword

example: California

--

*`x509.not_after`*::
+
--
Time at which the certificate is no longer considered valid.

type: date

example: 2020-07-16 03:15:39+00:00

--

*`x509.not_before`*::
+
--
Time at which the certificate is first considered valid.

type: date

example: 2019-08-16 01:40:25+00:00

--

*`x509.public_key_algorithm`*::
+
--
Algorithm used to generate the public key.

type: keyword

example: RSA

--

*`x509.public_key_curve`*::
+
--
The curve used by the elliptic curve public key algorithm. This is algorithm specific.

type: keyword

example: nistp521

--

*`x509.public_key_exponent`*::
+
--
Exponent used to derive the public key. This is algorithm specific.

type: long

example: 65537

Field is not indexed.

--

*`x509.public_key_size`*::
+
--
The size of the public key space in bits.

type: long

example: 2048

--

*`x509.serial_number`*::
+
--
Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters.

type: keyword

example: 55FBB9C7DEBF09809D12CCAA

--

*`x509.signature_algorithm`*::
+
--
Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353.

type: keyword

example: SHA256-RSA

--

*`x509.subject.common_name`*::
+
--
List of common names (CN) of subject.

type: keyword

example: shared.global.example.net

--

*`x509.subject.country`*::
+
--
List of country (C) code

type: keyword

example: US

--

*`x509.subject.distinguished_name`*::
+
--
Distinguished name (DN) of the certificate subject entity.

type: keyword

example: C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net

--

*`x509.subject.locality`*::
+
--
List of locality names (L)

type: keyword

example: San Francisco

--

*`x509.subject.organization`*::
+
--
List of organizations (O) of subject.

type: keyword

example: Example, Inc.

--

*`x509.subject.organizational_unit`*::
+
--
List of organizational units (OU) of subject.

type: keyword

--

*`x509.subject.state_or_province`*::
+
--
List of state or province names (ST, S, or P)

type: keyword

example: California

--

*`x509.version_number`*::
+
--
Version of x509 format.

type: keyword

example: 3

--

[[exported-fields-elasticsearch]]
== Elasticsearch fields

Elasticsearch module



[float]
=== elasticsearch




*`elasticsearch.cluster.name`*::
+
--
Elasticsearch cluster name.


type: keyword

--

*`elasticsearch.cluster.id`*::
+
--
Elasticsearch cluster id.


type: keyword

--

*`elasticsearch.cluster.state.id`*::
+
--
Elasticsearch state id.


type: keyword

--

*`elasticsearch.node.id`*::
+
--
Node ID


type: keyword

--

*`elasticsearch.node.name`*::
+
--
Node name.


type: keyword

--

[float]
=== ccr

Cross-cluster replication stats




*`elasticsearch.ccr.leader.index`*::
+
--
Name of leader index


type: keyword

--

*`elasticsearch.ccr.leader.max_seq_no`*::
+
--
Maximum sequence number of operation on the leader shard


type: long

--


*`elasticsearch.ccr.follower.index`*::
+
--
Name of follower index


type: keyword

--

*`elasticsearch.ccr.follower.shard.number`*::
+
--
Number of the shard within the index


type: long

--

*`elasticsearch.ccr.follower.operations_written`*::
+
--
Number of operations indexed (replicated) into the follower shard from the leader shard


type: long

--

*`elasticsearch.ccr.follower.time_since_last_read.ms`*::
+
--
Time, in ms, since the follower last fetched from the leader


type: long

--

*`elasticsearch.ccr.follower.global_checkpoint`*::
+
--
Global checkpoint value on follower shard


type: long

--

[float]
=== cluster.stats

Cluster stats



*`elasticsearch.cluster.stats.status`*::
+
--
Cluster status (green, yellow, red).


type: keyword

--

[float]
=== nodes

Nodes statistics.



*`elasticsearch.cluster.stats.nodes.count`*::
+
--
Total number of nodes in cluster.


type: long

--

*`elasticsearch.cluster.stats.nodes.master`*::
+
--
Number of master-eligible nodes in cluster.


type: long

--

*`elasticsearch.cluster.stats.nodes.data`*::
+
--
Number of data nodes in cluster.


type: long

--

[float]
=== indices

Indices statistics.



*`elasticsearch.cluster.stats.indices.count`*::
+
--
Total number of indices in cluster.


type: long

--

[float]
=== shards

Shard statistics.



*`elasticsearch.cluster.stats.indices.shards.count`*::
+
--
Total number of shards in cluster.


type: long

--

*`elasticsearch.cluster.stats.indices.shards.primaries`*::
+
--
Total number of primary shards in cluster.


type: long

--

*`elasticsearch.cluster.stats.indices.fielddata.memory.bytes`*::
+
--
Memory used for fielddata.


type: long

--

[float]
=== enrich

Enrich stats



*`elasticsearch.enrich.queue.size`*::
+
--
Number of search requests in the queue.


type: long

--


*`elasticsearch.enrich.remote_requests.current`*::
+
--
Current number of outstanding remote requests.


type: long

--

*`elasticsearch.enrich.remote_requests.total`*::
+
--
Number of outstanding remote requests executed since node startup.


type: long

--

*`elasticsearch.enrich.executed_searches.total`*::
+
--
Number of search requests that enrich processors have executed since node startup.


type: long

--

[float]
=== index

index



*`elasticsearch.index.name`*::
+
--
Index name.


type: keyword

--


*`elasticsearch.index.total.docs.count`*::
+
--
Total number of documents in the index.


type: long

--

*`elasticsearch.index.total.docs.deleted`*::
+
--
Total number of deleted documents in the index.


type: long

--

*`elasticsearch.index.total.store.size.bytes`*::
+
--
Total size of the index in bytes.


type: long

format: bytes

--

*`elasticsearch.index.total.segments.count`*::
+
--
Total number of index segments.


type: long

--

*`elasticsearch.index.total.segments.memory.bytes`*::
+
--
Total number of memory used by the segments in bytes.


type: long

format: bytes

--

[float]
=== index.recovery

index



*`elasticsearch.index.recovery.id`*::
+
--
Shard recovery id.


type: long

--

*`elasticsearch.index.recovery.type`*::
+
--
Shard recovery type.


type: keyword

--

*`elasticsearch.index.recovery.primary`*::
+
--
True if primary shard.


type: boolean

--

*`elasticsearch.index.recovery.stage`*::
+
--
Recovery stage.


type: keyword

--

*`elasticsearch.index.recovery.target.id`*::
+
--
Target node id.


type: keyword

--

*`elasticsearch.index.recovery.target.host`*::
+
--
Target node host address (could be IP address or hostname).


type: keyword

--

*`elasticsearch.index.recovery.target.name`*::
+
--
Target node name.


type: keyword

--

*`elasticsearch.index.recovery.source.id`*::
+
--
Source node id.


type: keyword

--

*`elasticsearch.index.recovery.source.host`*::
+
--
Source node host address (could be IP address or hostname).


type: keyword

--

*`elasticsearch.index.recovery.source.name`*::
+
--
Source node name.


type: keyword

--

[float]
=== index.summary

index




*`elasticsearch.index.summary.primaries.docs.count`*::
+
--
Total number of documents in the index.


type: long

--

*`elasticsearch.index.summary.primaries.docs.deleted`*::
+
--
Total number of deleted documents in the index.


type: long

--

*`elasticsearch.index.summary.primaries.store.size.bytes`*::
+
--
Total size of the index in bytes.


type: long

format: bytes

--

*`elasticsearch.index.summary.primaries.segments.count`*::
+
--
Total number of index segments.


type: long

--

*`elasticsearch.index.summary.primaries.segments.memory.bytes`*::
+
--
Total number of memory used by the segments in bytes.


type: long

format: bytes

--


*`elasticsearch.index.summary.total.docs.count`*::
+
--
Total number of documents in the index.


type: long

--

*`elasticsearch.index.summary.total.docs.deleted`*::
+
--
Total number of deleted documents in the index.


type: long

--

*`elasticsearch.index.summary.total.store.size.bytes`*::
+
--
Total size of the index in bytes.


type: long

format: bytes

--

*`elasticsearch.index.summary.total.segments.count`*::
+
--
Total number of index segments.


type: long

--

*`elasticsearch.index.summary.total.segments.memory.bytes`*::
+
--
Total number of memory used by the segments in bytes.


type: long

format: bytes

--

[float]
=== ml.job

ml



*`elasticsearch.ml.job.id`*::
+
--
Unique ml job id.


type: keyword

--

*`elasticsearch.ml.job.state`*::
+
--
Job state.


type: keyword

--

*`elasticsearch.ml.job.data_counts.processed_record_count`*::
+
--
Processed data events.


type: long

--

*`elasticsearch.ml.job.data_counts.invalid_date_count`*::
+
--
The number of records with either a missing date field or a date that could not be parsed.


type: long

--

[float]
=== node

node



*`elasticsearch.node.version`*::
+
--
Node version.


type: keyword

--

[float]
=== jvm

JVM Info.



*`elasticsearch.node.jvm.version`*::
+
--
JVM version.


type: keyword

--

*`elasticsearch.node.jvm.memory.heap.init.bytes`*::
+
--
Heap init used by the JVM in bytes.


type: long

format: bytes

--

*`elasticsearch.node.jvm.memory.heap.max.bytes`*::
+
--
Heap max used by the JVM in bytes.


type: long

format: bytes

--

*`elasticsearch.node.jvm.memory.nonheap.init.bytes`*::
+
--
Non-Heap init used by the JVM in bytes.


type: long

format: bytes

--

*`elasticsearch.node.jvm.memory.nonheap.max.bytes`*::
+
--
Non-Heap max used by the JVM in bytes.


type: long

format: bytes

--

*`elasticsearch.node.process.mlockall`*::
+
--
If process locked in memory.


type: boolean

--

[float]
=== node.stats

node_stats



[float]
=== indices

Node indices stats



*`elasticsearch.node.stats.indices.docs.count`*::
+
--
Total number of existing documents.


type: long

--

*`elasticsearch.node.stats.indices.docs.deleted`*::
+
--
Total number of deleted documents.


type: long

--

*`elasticsearch.node.stats.indices.segments.count`*::
+
--
Total number of segments.


type: long

--

*`elasticsearch.node.stats.indices.segments.memory.bytes`*::
+
--
Total size of segments in bytes.


type: long

format: bytes

--

*`elasticsearch.node.stats.indices.store.size.bytes`*::
+
--
Total size of the store in bytes.


type: long

--

[float]
=== jvm.mem.pools

JVM memory pool stats



[float]
=== old

Old memory pool stats.



*`elasticsearch.node.stats.jvm.mem.pools.old.max.bytes`*::
+
--
Max bytes.

type: long

format: bytes

--

*`elasticsearch.node.stats.jvm.mem.pools.old.peak.bytes`*::
+
--
Peak bytes.

type: long

format: bytes

--

*`elasticsearch.node.stats.jvm.mem.pools.old.peak_max.bytes`*::
+
--
Peak max bytes.

type: long

format: bytes

--

*`elasticsearch.node.stats.jvm.mem.pools.old.used.bytes`*::
+
--
Used bytes.

type: long

format: bytes

--

[float]
=== young

Young memory pool stats.



*`elasticsearch.node.stats.jvm.mem.pools.young.max.bytes`*::
+
--
Max bytes.

type: long

format: bytes

--

*`elasticsearch.node.stats.jvm.mem.pools.young.peak.bytes`*::
+
--
Peak bytes.

type: long

format: bytes

--

*`elasticsearch.node.stats.jvm.mem.pools.young.peak_max.bytes`*::
+
--
Peak max bytes.

type: long

format: bytes

--

*`elasticsearch.node.stats.jvm.mem.pools.young.used.bytes`*::
+
--
Used bytes.

type: long

format: bytes

--

[float]
=== survivor

Survivor memory pool stats.



*`elasticsearch.node.stats.jvm.mem.pools.survivor.max.bytes`*::
+
--
Max bytes.

type: long

format: bytes

--

*`elasticsearch.node.stats.jvm.mem.pools.survivor.peak.bytes`*::
+
--
Peak bytes.

type: long

format: bytes

--

*`elasticsearch.node.stats.jvm.mem.pools.survivor.peak_max.bytes`*::
+
--
Peak max bytes.

type: long

format: bytes

--

*`elasticsearch.node.stats.jvm.mem.pools.survivor.used.bytes`*::
+
--
Used bytes.

type: long

format: bytes

--

[float]
=== jvm.gc.collectors

GC collector stats.



[float]
=== old.collection

Old collection gc.



*`elasticsearch.node.stats.jvm.gc.collectors.old.collection.count`*::
+
--


type: long

--

*`elasticsearch.node.stats.jvm.gc.collectors.old.collection.ms`*::
+
--


type: long

--

[float]
=== young.collection

Young collection gc.



*`elasticsearch.node.stats.jvm.gc.collectors.young.collection.count`*::
+
--


type: long

--

*`elasticsearch.node.stats.jvm.gc.collectors.young.collection.ms`*::
+
--


type: long

--

[float]
=== fs.summary

File system summary



*`elasticsearch.node.stats.fs.summary.total.bytes`*::
+
--


type: long

format: bytes

--

*`elasticsearch.node.stats.fs.summary.free.bytes`*::
+
--


type: long

format: bytes

--

*`elasticsearch.node.stats.fs.summary.available.bytes`*::
+
--


type: long

format: bytes

--

[float]
=== cluster.pending_task

`cluster.pending_task` contains a pending task description.



*`elasticsearch.cluster.pending_task.insert_order`*::
+
--
Insert order


type: long

--

*`elasticsearch.cluster.pending_task.priority`*::
+
--
Priority


type: long

--

*`elasticsearch.cluster.pending_task.source`*::
+
--
Source. For example: put-mapping


type: keyword

--

*`elasticsearch.cluster.pending_task.time_in_queue.ms`*::
+
--
Time in queue


type: long

--

[float]
=== shard

shard fields



*`elasticsearch.shard.primary`*::
+
--
True if this is the primary shard.


type: boolean

--

*`elasticsearch.shard.number`*::
+
--
The number of this shard.


type: long

--

*`elasticsearch.shard.state`*::
+
--
The state of this shard.


type: keyword

--

*`elasticsearch.shard.relocating_node.name`*::
+
--
The node the shard was relocated from.


type: keyword

--

[[exported-fields-enterprisesearch]]
== Enterprise Search fields

Enterprise Search module



[float]
=== enterprisesearch

`enterprisesearch` contains metrics and health information for Enterprise Search



*`enterprisesearch.cluster_uuid`*::
+
--
Cluster UUID for the Elasticsearch cluster used as the data store for Enterprise Search.

type: keyword

--

[float]
=== health

Enterprise Search health


*`enterprisesearch.health.name`*::
+
--
Host name for the Enterprise Search node

type: keyword

--

[float]
=== version

Enterprise Search version information


*`enterprisesearch.health.version.number`*::
+
--
Enterprise Search version number using the semantic versioning format

type: keyword

--

*`enterprisesearch.health.version.build_hash`*::
+
--
A unique build hash for the Enterprise Search package

type: keyword

--

[float]
=== process

Enterprise Search process information


*`enterprisesearch.health.process.pid`*::
+
--
Process ID for the Enterprise Search instance

type: long

--

*`enterprisesearch.health.process.uptime.sec`*::
+
--
Process uptime for the Enterprise Search instance

type: long

--

[float]
=== filebeat

Health information for the embedded Filebeat instance


*`enterprisesearch.health.process.filebeat.pid`*::
+
--
Process ID for the embedded Filebeat instance

type: long

--

*`enterprisesearch.health.process.filebeat.restart_count`*::
+
--
Number of times embedded Filebeat instance had to be restarted due to some issues

type: long

--

*`enterprisesearch.health.process.filebeat.time_since_last_restart.sec`*::
+
--
Time since the last embedded Filebeat instance restart (-1 if never restarted)

type: long

--

[float]
=== jvm

JVM health


*`enterprisesearch.health.jvm.version`*::
+
--
JVM version used to run Enterprise Search

type: keyword

--

[float]
=== gc

Java garbage collection metrics


*`enterprisesearch.health.jvm.gc.collection_count`*::
+
--
Total number of Java garbage collector invocations since the start of the process

type: long

--

*`enterprisesearch.health.jvm.gc.collection_time.ms`*::
+
--
Total time spent running Java garbage collector since the start of the process

type: long

--

[float]
=== memory_usage

Memory usage


*`enterprisesearch.health.jvm.memory_usage.heap_init.bytes`*::
+
--
Heap init used by the JVM in bytes.

type: long

format: bytes

--

*`enterprisesearch.health.jvm.memory_usage.heap_used.bytes`*::
+
--
Heap used by the JVM in bytes.

type: long

format: bytes

--

*`enterprisesearch.health.jvm.memory_usage.heap_committed.bytes`*::
+
--
Committed heap to the JVM in bytes.

type: long

format: bytes

--

*`enterprisesearch.health.jvm.memory_usage.heap_max.bytes`*::
+
--
Max heap used by the JVM in bytes

type: long

format: bytes

--

*`enterprisesearch.health.jvm.memory_usage.non_heap_init.bytes`*::
+
--
Non-Heap initial memory used by the JVM in bytes.

type: long

format: bytes

--

*`enterprisesearch.health.jvm.memory_usage.non_heap_committed.bytes`*::
+
--
Non-Heap committed memory used by the JVM in bytes.

type: long

format: bytes

--

*`enterprisesearch.health.jvm.memory_usage.object_pending_finalization_count`*::
+
--
Displays the approximate number of objects for which finalization is pending.


type: long

--

[float]
=== threads

Threads information


*`enterprisesearch.health.jvm.threads.current`*::
+
--
Current number of live threads.

type: long

--

*`enterprisesearch.health.jvm.threads.daemon`*::
+
--
Current number of live daemon threads.

type: long

--

*`enterprisesearch.health.jvm.threads.max`*::
+
--
Peak live thread count since the JVM started or the peak was reset.

type: long

--

*`enterprisesearch.health.jvm.threads.total_started`*::
+
--
Total number of threads created and/or started since the JVM started.

type: long

--

[float]
=== crawler

Crawler health


[float]
=== workers

Crawler workers


*`enterprisesearch.health.crawler.workers.pool_size`*::
+
--
Workers pool size.

type: long

--

*`enterprisesearch.health.crawler.workers.active`*::
+
--
Number of active workers.

type: long

--

*`enterprisesearch.health.crawler.workers.available`*::
+
--
Number of available workers.

type: long

--

[float]
=== stats

Enterprise Search stats.


[float]
=== connectors

Workplace Search connectors subsystem stats.


[float]
=== job_store

Workplace Search connectors job store stats.


*`enterprisesearch.stats.connectors.job_store.waiting`*::
+
--
Number of connectors jobs waiting to be processed.

type: long

--

*`enterprisesearch.stats.connectors.job_store.working`*::
+
--
Number of connectors jobs currently being processed.

type: long

--

[float]
=== job_types

Breakdown of connectors jobs by types.


*`enterprisesearch.stats.connectors.job_store.job_types.delete`*::
+
--
Number of delete jobs in the jobs store.

type: long

--

*`enterprisesearch.stats.connectors.job_store.job_types.full`*::
+
--
Number of full sync jobs in the jobs store.

type: long

--

*`enterprisesearch.stats.connectors.job_store.job_types.incremental`*::
+
--
Number of incremental sync jobs in the jobs store.

type: long

--

*`enterprisesearch.stats.connectors.job_store.job_types.permissions`*::
+
--
Number of permissions sync jobs in the jobs store.

type: long

--

[float]
=== pool

Workplace Search worker pools stats.


[float]
=== extract_worker_pool

Status information for the extrator workers pool.


*`enterprisesearch.stats.connectors.pool.extract_worker_pool.size`*::
+
--
Worker pool size.

type: long

--

*`enterprisesearch.stats.connectors.pool.extract_worker_pool.busy`*::
+
--
Number of busy workers.

type: long

--

*`enterprisesearch.stats.connectors.pool.extract_worker_pool.queue_depth`*::
+
--
Number of items waiting to be processed.

type: long

--

*`enterprisesearch.stats.connectors.pool.extract_worker_pool.idle`*::
+
--
Number of idle workers.

type: long

--

*`enterprisesearch.stats.connectors.pool.extract_worker_pool.total_completed`*::
+
--
Number of jobs completed since the start.

type: long

--

*`enterprisesearch.stats.connectors.pool.extract_worker_pool.total_scheduled`*::
+
--
Number of jobs scheduled since the start.

type: long

--

[float]
=== subextract_worker_pool

Status information for the sub-extrator workers pool.


*`enterprisesearch.stats.connectors.pool.subextract_worker_pool.size`*::
+
--
Worker pool size.

type: long

--

*`enterprisesearch.stats.connectors.pool.subextract_worker_pool.busy`*::
+
--
Number of busy workers.

type: long

--

*`enterprisesearch.stats.connectors.pool.subextract_worker_pool.queue_depth`*::
+
--
Number of items waiting to be processed.

type: long

--

*`enterprisesearch.stats.connectors.pool.subextract_worker_pool.idle`*::
+
--
Number of idle workers.

type: long

--

*`enterprisesearch.stats.connectors.pool.subextract_worker_pool.total_completed`*::
+
--
Number of jobs completed since the start.

type: long

--

*`enterprisesearch.stats.connectors.pool.subextract_worker_pool.total_scheduled`*::
+
--
Number of jobs scheduled since the start.

type: long

--

[float]
=== publish_worker_pool

Status information for the publish workers pool.


*`enterprisesearch.stats.connectors.pool.publish_worker_pool.size`*::
+
--
Worker pool size.

type: long

--

*`enterprisesearch.stats.connectors.pool.publish_worker_pool.busy`*::
+
--
Number of busy workers.

type: long

--

*`enterprisesearch.stats.connectors.pool.publish_worker_pool.queue_depth`*::
+
--
Number of items waiting to be processed.

type: long

--

*`enterprisesearch.stats.connectors.pool.publish_worker_pool.idle`*::
+
--
Number of idle workers.

type: long

--

*`enterprisesearch.stats.connectors.pool.publish_worker_pool.total_completed`*::
+
--
Number of jobs completed since the start.

type: long

--

*`enterprisesearch.stats.connectors.pool.publish_worker_pool.total_scheduled`*::
+
--
Number of jobs scheduled since the start.

type: long

--

[float]
=== http

Incoming HTTP request metrics.


[float]
=== connections

Incoming HTTP connection statistics.


*`enterprisesearch.stats.http.connections.current`*::
+
--
Current number of HTTP connections opened to the Enterprise Search instance.

type: long

--

*`enterprisesearch.stats.http.connections.max`*::
+
--
Maximum number of concurrent HTTP connections open to the Enterprise Search instance since the start.

type: long

--

*`enterprisesearch.stats.http.connections.total`*::
+
--
Total number of HTTP connections opened to the Enterprise Search instance since the start.

type: long

--

[float]
=== network

Network traffic metrics.


*`enterprisesearch.stats.http.network.received.bytes`*::
+
--
Total number of bytes received by the Enterprise Search instance since the start.

type: long

format: bytes

--

*`enterprisesearch.stats.http.network.sent.bytes`*::
+
--
Total number of bytes sent by the Enterprise Search instance since the start.

type: long

format: bytes

--

*`enterprisesearch.stats.http.network.received.bytes_per_sec`*::
+
--
Average number of bytes received by the Enterprise Search instance per second since the start.

type: long

format: bytes

--

*`enterprisesearch.stats.http.network.sent.bytes_per_sec`*::
+
--
Average number of bytes sent by the Enterprise Search instance per second since the start.

type: long

format: bytes

--

[float]
=== request_duration

Aggregate HTTP request duration statistics.


*`enterprisesearch.stats.http.request_duration.max.ms`*::
+
--
Longest HTTP connection duration since the start of the instance.

type: long

--

*`enterprisesearch.stats.http.request_duration.mean.ms`*::
+
--
Average HTTP connection duration since the start of the instance.

type: long

--

*`enterprisesearch.stats.http.request_duration.std_dev.ms`*::
+
--
Standard deviation for HTTP connection duration values since the start of the instance.

type: long

--

[float]
=== responses

Aggregate HTTP response counts broken down by HTTP status type.


*`enterprisesearch.stats.http.responses.1xx`*::
+
--
Total number of HTTP requests finished with a 1xx response code since the start of the instance.

type: long

--

*`enterprisesearch.stats.http.responses.2xx`*::
+
--
Total number of HTTP requests finished with a 2xx response code since the start of the instance.

type: long

--

*`enterprisesearch.stats.http.responses.3xx`*::
+
--
Total number of HTTP requests finished with a 3xx response code since the start of the instance.

type: long

--

*`enterprisesearch.stats.http.responses.4xx`*::
+
--
Total number of HTTP requests finished with a 4xx response code since the start of the instance.

type: long

--

*`enterprisesearch.stats.http.responses.5xx`*::
+
--
Total number of HTTP requests finished with a 5xx response code since the start of the instance.

type: long

--

[float]
=== queues

Aggregate stats on the functioning of the background jobs processing pipeline within Enterprise Search.


*`enterprisesearch.stats.queues.engine_destroyer.count`*::
+
--
Total number of jobs processed via the engine_destroyer queue since the start of the instance.

type: long

--

*`enterprisesearch.stats.queues.mailer.count`*::
+
--
Total number of jobs processed via the mailer queue since the start of the instance.

type: long

--

*`enterprisesearch.stats.queues.process_crawl.count`*::
+
--
Total number of jobs processed via the process_crawl queue since the start of the instance.

type: long

--

*`enterprisesearch.stats.queues.failed.count`*::
+
--
Total number of jobs waiting in the failed queue.

type: long

--

[float]
=== product_usage

Aggregate product usage statistics for the Enterprise Search deployment.


[float]
=== app_search

App Search product usage statistics.


*`enterprisesearch.stats.product_usage.app_search.total_engines`*::
+
--
Current number of App Search engines within the deployment.

type: long

--

[float]
=== workplace_search

Workplace Search product usage statistics.


*`enterprisesearch.stats.product_usage.workplace_search.total_org_sources`*::
+
--
Current number of Workplace Search org-wide content sources within the deployment.

type: long

--

*`enterprisesearch.stats.product_usage.workplace_search.total_private_sources`*::
+
--
Current number of Workplace Search private content sources within the deployment.

type: long

--

[[exported-fields-envoyproxy]]
== Envoyproxy fields

envoyproxy module



[float]
=== envoyproxy




[float]
=== server

Contains envoy proxy server stats




*`envoyproxy.server.cluster_manager.active_clusters`*::
+
--
Number of currently active (warmed) clusters


type: integer

--

*`envoyproxy.server.cluster_manager.cluster_added`*::
+
--
Total clusters added (either via static config or CDS)


type: integer

--

*`envoyproxy.server.cluster_manager.cluster_modified`*::
+
--
Total clusters modified (via CDS)


type: integer

--

*`envoyproxy.server.cluster_manager.cluster_removed`*::
+
--
Total clusters removed (via CDS)


type: integer

--

*`envoyproxy.server.cluster_manager.warming_clusters`*::
+
--
Number of currently warming (not active) clusters


type: integer

--

*`envoyproxy.server.cluster_manager.cluster_updated`*::
+
--
Total cluster updates


type: integer

--

*`envoyproxy.server.cluster_manager.cluster_updated_via_merge`*::
+
--
Total cluster updates applied as merged updates


type: integer

--

*`envoyproxy.server.cluster_manager.update_merge_cancelled`*::
+
--
Total merged updates that got cancelled and delivered early


type: integer

--

*`envoyproxy.server.cluster_manager.update_out_of_merge_window`*::
+
--
Total updates which arrived out of a merge window


type: integer

--


*`envoyproxy.server.filesystem.flushed_by_timer`*::
+
--
Total number of times internal flush buffers are written to a file due to flush timeout


type: integer

--

*`envoyproxy.server.filesystem.reopen_failed`*::
+
--
Total number of times a file was failed to be opened


type: integer

--

*`envoyproxy.server.filesystem.write_buffered`*::
+
--
Total number of times file data is moved to Envoys internal flush buffer


type: integer

--

*`envoyproxy.server.filesystem.write_completed`*::
+
--
Total number of times a file was written


type: integer

--

*`envoyproxy.server.filesystem.write_total_buffered`*::
+
--
Current total size of internal flush buffer in bytes


type: integer

--

*`envoyproxy.server.filesystem.write_failed`*::
+
--
Total number of times an error occurred during a file write operation


type: integer

--


*`envoyproxy.server.runtime.load_error`*::
+
--
Total number of load attempts that resulted in an error in any layer


type: integer

--

*`envoyproxy.server.runtime.load_success`*::
+
--
Total number of load attempts that were successful at all layers


type: integer

--

*`envoyproxy.server.runtime.num_keys`*::
+
--
Number of keys currently loaded


type: integer

--

*`envoyproxy.server.runtime.override_dir_exists`*::
+
--
Total number of loads that did use an override directory


type: integer

--

*`envoyproxy.server.runtime.override_dir_not_exists`*::
+
--
Total number of loads that did not use an override directory


type: integer

--

*`envoyproxy.server.runtime.admin_overrides_active`*::
+
--
1 if any admin overrides are active otherwise 0


type: integer

--

*`envoyproxy.server.runtime.deprecated_feature_use`*::
+
--
Total number of times deprecated features were used.


type: integer

--

*`envoyproxy.server.runtime.num_layers`*::
+
--
Number of layers currently active (without loading errors)


type: integer

--


*`envoyproxy.server.listener_manager.listener_added`*::
+
--
Total listeners added (either via static config or LDS)


type: integer

--

*`envoyproxy.server.listener_manager.listener_create_failure`*::
+
--
Total failed listener object additions to workers


type: integer

--

*`envoyproxy.server.listener_manager.listener_create_success`*::
+
--
Total listener objects successfully added to workers


type: integer

--

*`envoyproxy.server.listener_manager.listener_modified`*::
+
--
Total listeners modified (via LDS)


type: integer

--

*`envoyproxy.server.listener_manager.listener_removed`*::
+
--
Total listeners removed (via LDS)


type: integer

--

*`envoyproxy.server.listener_manager.total_listeners_active`*::
+
--
Number of currently active listeners


type: integer

--

*`envoyproxy.server.listener_manager.total_listeners_draining`*::
+
--
Number of currently draining listeners


type: integer

--

*`envoyproxy.server.listener_manager.total_listeners_warming`*::
+
--
Number of currently warming listeners


type: integer

--

*`envoyproxy.server.listener_manager.listener_stopped`*::
+
--
Total listeners stopped


type: integer

--


*`envoyproxy.server.stats.overflow`*::
+
--
Total number of times Envoy cannot allocate a statistic due to a shortage of shared memory


type: integer

--


*`envoyproxy.server.server.days_until_first_cert_expiring`*::
+
--
Number of days until the next certificate being managed will expire


type: integer

--

*`envoyproxy.server.server.live`*::
+
--
1 if the server is not currently draining, 0 otherwise


type: integer

--

*`envoyproxy.server.server.memory_allocated`*::
+
--
Current amount of allocated memory in bytes


type: integer

--

*`envoyproxy.server.server.memory_heap_size`*::
+
--
Current reserved heap size in bytes


type: integer

--

*`envoyproxy.server.server.parent_connections`*::
+
--
Total connections of the old Envoy process on hot restart


type: integer

--

*`envoyproxy.server.server.total_connections`*::
+
--
Total connections of both new and old Envoy processes


type: integer

--

*`envoyproxy.server.server.uptime`*::
+
--
Current server uptime in seconds


type: integer

--

*`envoyproxy.server.server.version`*::
+
--
Integer represented version number based on SCM revision


type: integer

--

*`envoyproxy.server.server.watchdog_mega_miss`*::
+
--
type: integer

--

*`envoyproxy.server.server.watchdog_miss`*::
+
--
type: integer

--

*`envoyproxy.server.server.hot_restart_epoch`*::
+
--
Current hot restart epoch


type: integer

--

*`envoyproxy.server.server.concurrency`*::
+
--
Number of worker threads


type: integer

--

*`envoyproxy.server.server.debug_assertion_failures`*::
+
--
type: integer

--

*`envoyproxy.server.server.dynamic_unknown_fields`*::
+
--
Number of messages in dynamic configuration with unknown fields


type: integer

--

*`envoyproxy.server.server.state`*::
+
--
Current state of the Server


type: integer

--

*`envoyproxy.server.server.static_unknown_fields`*::
+
--
Number of messages in static configuration with unknown fields


type: integer

--

*`envoyproxy.server.server.stats_recent_lookups`*::
+
--
type: integer

--


*`envoyproxy.server.http2.header_overflow`*::
+
--
Total number of connections reset due to the headers being larger than Envoy::Http::Http2::ConnectionImpl::StreamImpl::MAX_HEADER_SIZE (63k)


type: integer

--

*`envoyproxy.server.http2.headers_cb_no_stream`*::
+
--
Total number of errors where a header callback is called without an associated stream. This tracks an unexpected occurrence due to an as yet undiagnosed bug


type: integer

--

*`envoyproxy.server.http2.rx_messaging_error`*::
+
--
Total number of invalid received frames that violated section 8 of the HTTP/2 spec. This will result in a tx_reset


type: integer

--

*`envoyproxy.server.http2.rx_reset`*::
+
--
Total number of reset stream frames received by Envoy


type: integer

--

*`envoyproxy.server.http2.too_many_header_frames`*::
+
--
Total number of times an HTTP2 connection is reset due to receiving too many headers frames. Envoy currently supports proxying at most one header frame for 100-Continue one non-100 response code header frame and one frame with trailers


type: integer

--

*`envoyproxy.server.http2.trailers`*::
+
--
Total number of trailers seen on requests coming from downstream


type: integer

--

*`envoyproxy.server.http2.tx_reset`*::
+
--
Total number of reset stream frames transmitted by Envoy


type: integer

--

[[exported-fields-etcd]]
== Etcd fields

etcd Module



[float]
=== etcd

`etcd` contains statistics that were read from Etcd



*`etcd.api_version`*::
+
--
Etcd API version for metrics retrieval


type: keyword

--

[float]
=== leader

Contains etcd leader statistics.



[float]
=== followers.counts

The number of failed and successful Raft RPC requests.



*`etcd.leader.followers.counts.followers.counts.success`*::
+
--
successful Raft RPC requests

type: integer

--

*`etcd.leader.followers.counts.followers.counts.fail`*::
+
--
failed Raft RPC requests

type: integer

--

[float]
=== followers.latency

latency to each peer in the cluster



*`etcd.leader.followers.latency.followers.latency.average`*::
+
--
type: scaled_float

--

*`etcd.leader.followers.latency.followers.latency.current`*::
+
--
type: scaled_float

--

*`etcd.leader.followers.latency.followers.latency.maximum`*::
+
--
type: scaled_float

--

*`etcd.leader.followers.latency.followers.latency.minimum`*::
+
--
type: integer

--

*`etcd.leader.followers.latency.follower.latency.standardDeviation`*::
+
--
type: scaled_float

--

*`etcd.leader.leader`*::
+
--
ID of actual leader

type: keyword

--

[float]
=== server

Server metrics from the Etcd V3 /metrics endpoint



*`etcd.server.has_leader`*::
+
--
Whether a leader exists in the cluster


type: byte

--

*`etcd.server.leader_changes.count`*::
+
--
Number of leader changes seen at the cluster


type: long

--

*`etcd.server.proposals_committed.count`*::
+
--
Number of consensus proposals commited


type: long

--

*`etcd.server.proposals_pending.count`*::
+
--
Number of consensus proposals pending


type: long

--

*`etcd.server.proposals_failed.count`*::
+
--
Number of consensus proposals failed


type: long

--

*`etcd.server.grpc_started.count`*::
+
--
Number of sent gRPC requests


type: long

--

*`etcd.server.grpc_handled.count`*::
+
--
Number of received gRPC requests


type: long

--

[float]
=== disk

Disk metrics from the Etcd V3 /metrics endpoint



*`etcd.disk.mvcc_db_total_size.bytes`*::
+
--
Size of stored data at MVCC


type: long

format: bytes

--

*`etcd.disk.wal_fsync_duration.ns.bucket.*`*::
+
--
Latency for writing ahead logs to disk


type: object

--

*`etcd.disk.wal_fsync_duration.ns.count`*::
+
--
Write ahead logs count


type: long

--

*`etcd.disk.wal_fsync_duration.ns.sum`*::
+
--
Write ahead logs latency sum


type: long

--

*`etcd.disk.backend_commit_duration.ns.bucket.*`*::
+
--
Latency for writing backend changes to disk


type: object

--

*`etcd.disk.backend_commit_duration.ns.count`*::
+
--
Backend commits count


type: long

--

*`etcd.disk.backend_commit_duration.ns.sum`*::
+
--
Backend commits latency sum


type: long

--

[float]
=== memory

Memory metrics from the Etcd V3 /metrics endpoint



*`etcd.memory.go_memstats_alloc.bytes`*::
+
--
Memory allocated bytes as of MemStats Go


type: long

format: bytes

--

[float]
=== network

Network metrics from the Etcd V3 /metrics endpoint



*`etcd.network.client_grpc_sent.bytes`*::
+
--
gRPC sent bytes total


type: long

format: bytes

--

*`etcd.network.client_grpc_received.bytes`*::
+
--
gRPC received bytes total


type: long

format: bytes

--

[float]
=== self

Contains etcd self statistics.



*`etcd.self.id`*::
+
--
the unique identifier for the member


type: keyword

--

*`etcd.self.leaderinfo.leader`*::
+
--
id of the current leader member


type: keyword

--

*`etcd.self.leaderinfo.starttime`*::
+
--
the time when this node was started


type: keyword

--

*`etcd.self.leaderinfo.uptime`*::
+
--
amount of time the leader has been leader


type: keyword

--

*`etcd.self.name`*::
+
--
this member's name


type: keyword

--

*`etcd.self.recv.appendrequest.count`*::
+
--
number of append requests this node has processed


type: integer

--

*`etcd.self.recv.bandwidthrate`*::
+
--
number of bytes per second this node is receiving (follower only)


type: scaled_float

--

*`etcd.self.recv.pkgrate`*::
+
--
number of requests per second this node is receiving (follower only)


type: scaled_float

--

*`etcd.self.send.appendrequest.count`*::
+
--
number of requests that this node has sent


type: integer

--

*`etcd.self.send.bandwidthrate`*::
+
--
number of bytes per second this node is sending (leader only). This value is undefined on single member clusters.


type: scaled_float

--

*`etcd.self.send.pkgrate`*::
+
--
number of requests per second this node is sending (leader only). This value is undefined on single member clusters.


type: scaled_float

--

*`etcd.self.starttime`*::
+
--
the time when this node was started


type: keyword

--

*`etcd.self.state`*::
+
--
either leader or follower


type: keyword

--

[float]
=== store

The store statistics include information about the operations that this node has handled.



*`etcd.store.gets.success`*::
+
--
type: integer

--

*`etcd.store.gets.fail`*::
+
--
type: integer

--

*`etcd.store.sets.success`*::
+
--
type: integer

--

*`etcd.store.sets.fail`*::
+
--
type: integer

--

*`etcd.store.delete.success`*::
+
--
type: integer

--

*`etcd.store.delete.fail`*::
+
--
type: integer

--

*`etcd.store.update.success`*::
+
--
type: integer

--

*`etcd.store.update.fail`*::
+
--
type: integer

--

*`etcd.store.create.success`*::
+
--
type: integer

--

*`etcd.store.create.fail`*::
+
--
type: integer

--

*`etcd.store.compareandswap.success`*::
+
--
type: integer

--

*`etcd.store.compareandswap.fail`*::
+
--
type: integer

--

*`etcd.store.compareanddelete.success`*::
+
--
type: integer

--

*`etcd.store.compareanddelete.fail`*::
+
--
type: integer

--

*`etcd.store.expire.count`*::
+
--
type: integer

--

*`etcd.store.watchers`*::
+
--
type: integer

--

[[exported-fields-gcp]]
== Google Cloud Platform fields

GCP module




*`gcp.labels`*::
+
--
GCP monitoring metrics labels


type: object

--

*`gcp.metrics.*.*.*.*`*::
+
--
Metrics that returned from Google Cloud API query.


type: object

--

[float]
=== billing

Google Cloud Billing metrics


*`gcp.billing.cost_type`*::
+
--
Cost types include regular, tax, adjustment, and rounding_error.

type: keyword

--

*`gcp.billing.invoice_month`*::
+
--
Billing report month.

type: keyword

--

*`gcp.billing.project_id`*::
+
--
Project ID of the billing report belongs to.

type: keyword

--

*`gcp.billing.total`*::
+
--
Total billing amount.

type: float

--

[float]
=== compute

Google Cloud Compute metrics


*`gcp.compute.firewall.dropped.bytes`*::
+
--
Incoming bytes dropped by the firewall

type: long

--

*`gcp.compute.firewall.dropped_packets_count.value`*::
+
--
Incoming packets dropped by the firewall

type: long

--

*`gcp.compute.instance.cpu.reserved_cores.value`*::
+
--
Number of cores reserved on the host of the instance

type: double

--

*`gcp.compute.instance.cpu.usage_time.sec`*::
+
--
Usage for all cores in seconds

type: double

--

*`gcp.compute.instance.cpu.usage.pct`*::
+
--
The fraction of the allocated CPU that is currently in use on the instance

type: double

--

*`gcp.compute.instance.disk.read.bytes`*::
+
--
Count of bytes read from disk

type: long

--

*`gcp.compute.instance.disk.read_ops_count.value`*::
+
--
Count of disk read IO operations

type: long

--

*`gcp.compute.instance.disk.write.bytes`*::
+
--
Count of bytes written to disk

type: long

--

*`gcp.compute.instance.disk.write_ops_count.value`*::
+
--
Count of disk write IO operations

type: long

--

*`gcp.compute.instance.memory.balloon.ram_size.value`*::
+
--
The total amount of memory in the VM. This metric is only available for VMs that belong to the e2 family.

type: long

--

*`gcp.compute.instance.memory.balloon.ram_used.value`*::
+
--
Memory currently used in the VM. This metric is only available for VMs that belong to the e2 family.

type: long

--

*`gcp.compute.instance.memory.balloon.swap_in.bytes`*::
+
--
The amount of memory read into the guest from its own swap space. This metric is only available for VMs that belong to the e2 family.

type: long

--

*`gcp.compute.instance.memory.balloon.swap_out.bytes`*::
+
--
The amount of memory written from the guest to its own swap space. This metric is only available for VMs that belong to the e2 family.

type: long

--

*`gcp.compute.instance.network.ingress.bytes`*::
+
--
Count of bytes received from the network

type: long

--

*`gcp.compute.instance.network.ingress.packets.count`*::
+
--
Count of packets received from the network

type: long

--

*`gcp.compute.instance.network.egress.bytes`*::
+
--
Count of bytes sent over the network

type: long

--

*`gcp.compute.instance.network.egress.packets.count`*::
+
--
Count of packets sent over the network

type: long

--

*`gcp.compute.instance.uptime.sec`*::
+
--
Number of seconds the VM has been running.

type: long

--

*`gcp.compute.instance.uptime_total.sec`*::
+
--
Elapsed time since the VM was started, in seconds. Sampled every 60 seconds. After sampling, data is not visible for up to 120 seconds.

type: long

--

[float]
=== gke

`gke` contains the metrics that we scraped from GCP Stackdriver API containing monitoring metrics for GCP GKE


*`gcp.gke.container.cpu.core_usage_time.sec`*::
+
--
Cumulative CPU usage on all cores used by the container in seconds. Sampled every 60 seconds.

type: double

--

*`gcp.gke.container.cpu.limit_cores.value`*::
+
--
CPU cores limit of the container. Sampled every 60 seconds.

type: double

--

*`gcp.gke.container.cpu.limit_utilization.pct`*::
+
--
The fraction of the CPU limit that is currently in use on the instance. This value cannot exceed 1 as usage cannot exceed the limit. Sampled every 60 seconds. After sampling, data is not visible for up to 240 seconds.

type: double

--

*`gcp.gke.container.cpu.request_cores.value`*::
+
--
Number of CPU cores requested by the container. Sampled every 60 seconds. After sampling, data is not visible for up to 120 seconds.

type: double

--

*`gcp.gke.container.cpu.request_utilization.pct`*::
+
--
The fraction of the requested CPU that is currently in use on the instance. This value can be greater than 1 as usage can exceed the request. Sampled every 60 seconds. After sampling, data is not visible for up to 240 seconds.

type: double

--

*`gcp.gke.container.ephemeral_storage.limit.bytes`*::
+
--
Local ephemeral storage limit in bytes. Sampled every 60 seconds.

type: long

--

*`gcp.gke.container.ephemeral_storage.request.bytes`*::
+
--
Local ephemeral storage request in bytes. Sampled every 60 seconds.

type: long

--

*`gcp.gke.container.ephemeral_storage.used.bytes`*::
+
--
Local ephemeral storage usage in bytes. Sampled every 60 seconds.

type: long

--

*`gcp.gke.container.memory.limit.bytes`*::
+
--
Memory limit of the container in bytes. Sampled every 60 seconds.

type: long

--

*`gcp.gke.container.memory.limit_utilization.pct`*::
+
--
The fraction of the memory limit that is currently in use on the instance. This value cannot exceed 1 as usage cannot exceed the limit. Sampled every 60 seconds. After sampling, data is not visible for up to 120 seconds.

type: double

--

*`gcp.gke.container.memory.page_fault.count`*::
+
--
Number of page faults, broken down by type, major and minor.

type: long

--

*`gcp.gke.container.memory.request.bytes`*::
+
--
Memory request of the container in bytes. Sampled every 60 seconds. After sampling, data is not visible for up to 120 seconds.

type: long

--

*`gcp.gke.container.memory.request_utilization.pct`*::
+
--
The fraction of the requested memory that is currently in use on the instance. This value can be greater than 1 as usage can exceed the request. Sampled every 60 seconds. After sampling, data is not visible for up to 240 seconds.

type: double

--

*`gcp.gke.container.memory.used.bytes`*::
+
--
Memory usage in bytes. Sampled every 60 seconds.

type: long

--

*`gcp.gke.container.restart.count`*::
+
--
Number of times the container has restarted. Sampled every 60 seconds. After sampling, data is not visible for up to 120 seconds.

type: long

--

*`gcp.gke.container.uptime.sec`*::
+
--
Time in seconds that the container has been running. Sampled every 60 seconds.

type: double

--

*`gcp.gke.node.cpu.allocatable_cores.value`*::
+
--
Number of allocatable CPU cores on the node. Sampled every 60 seconds.

type: double

--

*`gcp.gke.node.cpu.allocatable_utilization.pct`*::
+
--
The fraction of the allocatable CPU that is currently in use on the instance. Sampled every 60 seconds. After sampling, data is not visible for up to 240 seconds.

type: double

--

*`gcp.gke.node.cpu.core_usage_time.sec`*::
+
--
Cumulative CPU usage on all cores used on the node in seconds. Sampled every 60 seconds.

type: double

--

*`gcp.gke.node.cpu.total_cores.value`*::
+
--
Total number of CPU cores on the node. Sampled every 60 seconds.

type: double

--

*`gcp.gke.node.ephemeral_storage.allocatable.bytes`*::
+
--
Local ephemeral storage bytes allocatable on the node. Sampled every 60 seconds.

type: long

--

*`gcp.gke.node.ephemeral_storage.inodes_free.value`*::
+
--
Free number of inodes on local ephemeral storage. Sampled every 60 seconds.

type: long

--

*`gcp.gke.node.ephemeral_storage.inodes_total.value`*::
+
--
Total number of inodes on local ephemeral storage. Sampled every 60 seconds.

type: long

--

*`gcp.gke.node.ephemeral_storage.total.bytes`*::
+
--
Total ephemeral storage bytes on the node. Sampled every 60 seconds.

type: long

--

*`gcp.gke.node.ephemeral_storage.used.bytes`*::
+
--
Local ephemeral storage bytes used by the node. Sampled every 60 seconds.

type: long

--

*`gcp.gke.node.memory.allocatable.bytes`*::
+
--
Cumulative memory bytes used by the node. Sampled every 60 seconds.

type: long

--

*`gcp.gke.node.memory.allocatable_utilization.pct`*::
+
--
The fraction of the allocatable memory that is currently in use on the instance. This value cannot exceed 1 as usage cannot exceed allocatable memory bytes. Sampled every 60 seconds. After sampling, data is not visible for up to 120 seconds.

type: double

--

*`gcp.gke.node.memory.total.bytes`*::
+
--
Number of bytes of memory allocatable on the node. Sampled every 60 seconds.

type: long

--

*`gcp.gke.node.memory.used.bytes`*::
+
--
Cumulative memory bytes used by the node. Sampled every 60 seconds.

type: long

--

*`gcp.gke.node.network.received_bytes.count`*::
+
--
Cumulative number of bytes received by the node over the network. Sampled every 60 seconds.

type: long

--

*`gcp.gke.node.network.sent_bytes.count`*::
+
--
Cumulative number of bytes transmitted by the node over the network. Sampled every 60 seconds.

type: long

--

*`gcp.gke.node.pid_limit.value`*::
+
--
The max PID of OS on the node. Sampled every 60 seconds.

type: long

--

*`gcp.gke.node.pid_used.value`*::
+
--
The number of running process in the OS on the node. Sampled every 60 seconds.

type: long

--

*`gcp.gke.node_daemon.cpu.core_usage_time.sec`*::
+
--
Cumulative CPU usage on all cores used by the node level system daemon in seconds. Sampled every 60 seconds.

type: double

--

*`gcp.gke.node_daemon.memory.used.bytes`*::
+
--
Memory usage by the system daemon in bytes. Sampled every 60 seconds.

type: long

--

*`gcp.gke.pod.network.received.bytes`*::
+
--
Cumulative number of bytes received by the pod over the network. Sampled every 60 seconds.

type: long

--

*`gcp.gke.pod.network.sent.bytes`*::
+
--
Cumulative number of bytes transmitted by the pod over the network. Sampled every 60 seconds.

type: long

--

*`gcp.gke.pod.volume.total.bytes`*::
+
--
Total number of disk bytes available to the pod. Sampled every 60 seconds. After sampling, data is not visible for up to 120 seconds.

type: long

--

*`gcp.gke.pod.volume.used.bytes`*::
+
--
Number of disk bytes used by the pod. Sampled every 60 seconds.

type: long

--

*`gcp.gke.pod.volume.utilization.pct`*::
+
--
The fraction of the volume that is currently being used by the instance. This value cannot be greater than 1 as usage cannot exceed the total available volume space. Sampled every 60 seconds. After sampling, data is not visible for up to 120 seconds.

type: double

--

[float]
=== loadbalancing

Google Cloud Load Balancing metrics


*`gcp.loadbalancing.https.backend_request.bytes`*::
+
--
The number of bytes sent as requests from HTTP/S load balancer to backends.

type: long

--

*`gcp.loadbalancing.https.backend_request.count`*::
+
--
The number of requests served by backends of HTTP/S load balancer.

type: long

--

*`gcp.loadbalancing.https.backend_response.bytes`*::
+
--
The number of bytes sent as responses from backends (or cache) to external HTTP(S) load balancer.

type: long

--

*`gcp.loadbalancing.https.request.bytes`*::
+
--
The number of bytes sent as requests from clients to HTTP/S load balancer.

type: long

--

*`gcp.loadbalancing.https.request.count`*::
+
--
The number of requests served by HTTP/S load balancer.

type: long

--

*`gcp.loadbalancing.https.response.bytes`*::
+
--
The number of bytes sent as responses from HTTP/S load balancer to clients.

type: long

--

*`gcp.loadbalancing.l3.external.egress.bytes`*::
+
--
The number of bytes sent from external TCP/UDP network load balancer backend to client of the flow. For TCP flows it's counting bytes on application stream only.

type: long

--

*`gcp.loadbalancing.l3.external.egress_packets.count`*::
+
--
The number of packets sent from external TCP/UDP network load balancer backend to client of the flow.

type: long

--

*`gcp.loadbalancing.l3.external.ingress.bytes`*::
+
--
The number of bytes sent from client to external TCP/UDP network load balancer backend. For TCP flows it's counting bytes on application stream only.

type: long

--

*`gcp.loadbalancing.l3.external.ingress_packets.count`*::
+
--
The number of packets sent from client to external TCP/UDP network load balancer backend.

type: long

--

*`gcp.loadbalancing.l3.internal.egress.bytes`*::
+
--
The number of bytes sent from ILB backend to client (for TCP flows it's counting bytes on application stream only).

type: long

--

*`gcp.loadbalancing.l3.internal.egress_packets.count`*::
+
--
The number of packets sent from ILB backend to client of the flow.

type: long

--

*`gcp.loadbalancing.l3.internal.ingress.bytes`*::
+
--
The number of bytes sent from client to ILB backend (for TCP flows it's counting bytes on application stream only).

type: long

--

*`gcp.loadbalancing.l3.internal.ingress_packets.count`*::
+
--
The number of packets sent from client to ILB backend.

type: long

--

*`gcp.loadbalancing.tcp_ssl_proxy.closed_connections.value`*::
+
--
Number of connections that were terminated over TCP/SSL proxy.

type: long

--

*`gcp.loadbalancing.tcp_ssl_proxy.egress.bytes`*::
+
--
Number of bytes sent from VM to client using proxy.

type: long

--

*`gcp.loadbalancing.tcp_ssl_proxy.ingress.bytes`*::
+
--
Number of bytes sent from client to VM using proxy.

type: long

--

*`gcp.loadbalancing.tcp_ssl_proxy.new_connections.value`*::
+
--
Number of connections that were created over TCP/SSL proxy.

type: long

--

*`gcp.loadbalancing.tcp_ssl_proxy.open_connections.value`*::
+
--
Current number of outstanding connections through the TCP/SSL proxy.

type: long

--

[float]
=== pubsub

Google Cloud PubSub metrics


*`gcp.pubsub.snapshot.backlog.bytes`*::
+
--
Total byte size of the messages retained in a snapshot.

type: long

--

*`gcp.pubsub.snapshot.backlog_bytes_by_region.bytes`*::
+
--
Total byte size of the messages retained in a snapshot, broken down by Cloud region.

type: long

--

*`gcp.pubsub.snapshot.config_updates.count`*::
+
--
Cumulative count of configuration changes, grouped by operation type and result.

type: long

--

*`gcp.pubsub.snapshot.num_messages.value`*::
+
--
Number of messages retained in a snapshot.

type: long

--

*`gcp.pubsub.snapshot.num_messages_by_region.value`*::
+
--
Number of messages retained in a snapshot, broken down by Cloud region.

type: long

--

*`gcp.pubsub.snapshot.oldest_message_age.sec`*::
+
--
Age (in seconds) of the oldest message retained in a snapshot.

type: long

--

*`gcp.pubsub.snapshot.oldest_message_age_by_region.sec`*::
+
--
Age (in seconds) of the oldest message retained in a snapshot, broken down by Cloud region.

type: long

--

*`gcp.pubsub.subscription.ack_message.count`*::
+
--
Cumulative count of messages acknowledged by Acknowledge requests, grouped by delivery type.

type: long

--

*`gcp.pubsub.subscription.backlog.bytes`*::
+
--
Total byte size of the unacknowledged messages (a.k.a. backlog messages) in a subscription.

type: long

--

*`gcp.pubsub.subscription.byte_cost.bytes`*::
+
--
Cumulative cost of operations, measured in bytes. This is used to measure quota utilization.

type: long

--

*`gcp.pubsub.subscription.config_updates.count`*::
+
--
Cumulative count of configuration changes for each subscription, grouped by operation type and result.

type: long

--

*`gcp.pubsub.subscription.dead_letter_message.count`*::
+
--
Cumulative count of messages published to dead letter topic, grouped by result.

type: long

--

*`gcp.pubsub.subscription.mod_ack_deadline_message.count`*::
+
--
Cumulative count of messages whose deadline was updated by ModifyAckDeadline requests, grouped by delivery type.

type: long

--

*`gcp.pubsub.subscription.mod_ack_deadline_message_operation.count`*::
+
--
Cumulative count of ModifyAckDeadline message operations, grouped by result.

type: long

--

*`gcp.pubsub.subscription.mod_ack_deadline_request.count`*::
+
--
Cumulative count of ModifyAckDeadline requests, grouped by result.

type: long

--

*`gcp.pubsub.subscription.num_outstanding_messages.value`*::
+
--
Number of messages delivered to a subscription's push endpoint, but not yet acknowledged.

type: long

--

*`gcp.pubsub.subscription.num_undelivered_messages.value`*::
+
--
Number of unacknowledged messages (a.k.a. backlog messages) in a subscription.

type: long

--

*`gcp.pubsub.subscription.oldest_retained_acked_message_age.sec`*::
+
--
Age (in seconds) of the oldest acknowledged message retained in a subscription.

type: long

--

*`gcp.pubsub.subscription.oldest_retained_acked_message_age_by_region.value`*::
+
--
Age (in seconds) of the oldest acknowledged message retained in a subscription, broken down by Cloud region.

type: long

--

*`gcp.pubsub.subscription.oldest_unacked_message_age.sec`*::
+
--
Age (in seconds) of the oldest unacknowledged message (a.k.a. backlog message) in a subscription.

type: long

--

*`gcp.pubsub.subscription.oldest_unacked_message_age_by_region.value`*::
+
--
Age (in seconds) of the oldest unacknowledged message in a subscription, broken down by Cloud region.

type: long

--

*`gcp.pubsub.subscription.pull_ack_message_operation.count`*::
+
--
Cumulative count of acknowledge message operations, grouped by result. For a definition of message operations, see Cloud Pub/Sub metric subscription/mod_ack_deadline_message_operation_count.

type: long

--

*`gcp.pubsub.subscription.pull_ack_request.count`*::
+
--
Cumulative count of acknowledge requests, grouped by result.

type: long

--

*`gcp.pubsub.subscription.pull_message_operation.count`*::
+
--
Cumulative count of pull message operations, grouped by result. For a definition of message operations, see Cloud Pub/Sub metric subscription/mod_ack_deadline_message_operation_count.

type: long

--

*`gcp.pubsub.subscription.pull_request.count`*::
+
--
Cumulative count of pull requests, grouped by result.

type: long

--

*`gcp.pubsub.subscription.push_request.count`*::
+
--
Cumulative count of push attempts, grouped by result. Unlike pulls, the push server implementation does not batch user messages. So each request only contains one user message. The push server retries on errors, so a given user message can appear multiple times.

type: long

--

*`gcp.pubsub.subscription.push_request_latencies.value`*::
+
--
Distribution of push request latencies (in microseconds), grouped by result.

type: long

--

*`gcp.pubsub.subscription.retained_acked.bytes`*::
+
--
Total byte size of the acknowledged messages retained in a subscription.

type: long

--

*`gcp.pubsub.subscription.retained_acked_bytes_by_region.bytes`*::
+
--
Total byte size of the acknowledged messages retained in a subscription, broken down by Cloud region.

type: long

--

*`gcp.pubsub.subscription.seek_request.count`*::
+
--
Cumulative count of seek attempts, grouped by result.

type: long

--

*`gcp.pubsub.subscription.sent_message.count`*::
+
--
Cumulative count of messages sent by Cloud Pub/Sub to subscriber clients, grouped by delivery type.

type: long

--

*`gcp.pubsub.subscription.streaming_pull_ack_message_operation.count`*::
+
--
Cumulative count of StreamingPull acknowledge message operations, grouped by result. For a definition of message operations, see Cloud Pub/Sub metric subscription/mod_ack_deadline_message_operation_count.

type: long

--

*`gcp.pubsub.subscription.streaming_pull_ack_request.count`*::
+
--
Cumulative count of streaming pull requests with non-empty acknowledge ids, grouped by result.

type: long

--

*`gcp.pubsub.subscription.streaming_pull_message_operation.count`*::
+
--
Cumulative count of streaming pull message operations, grouped by result. For a definition of message operations, see Cloud Pub/Sub metric <code>subscription/mod_ack_deadline_message_operation_count

type: long

--

*`gcp.pubsub.subscription.streaming_pull_mod_ack_deadline_message_operation.count`*::
+
--
Cumulative count of StreamingPull ModifyAckDeadline operations, grouped by result.

type: long

--

*`gcp.pubsub.subscription.streaming_pull_mod_ack_deadline_request.count`*::
+
--
Cumulative count of streaming pull requests with non-empty ModifyAckDeadline fields, grouped by result.

type: long

--

*`gcp.pubsub.subscription.streaming_pull_response.count`*::
+
--
Cumulative count of streaming pull responses, grouped by result.

type: long

--

*`gcp.pubsub.subscription.unacked_bytes_by_region.bytes`*::
+
--
Total byte size of the unacknowledged messages in a subscription, broken down by Cloud region.

type: long

--

*`gcp.pubsub.topic.byte_cost.bytes`*::
+
--
Cost of operations, measured in bytes. This is used to measure utilization for quotas.

type: long

--

*`gcp.pubsub.topic.config_updates.count`*::
+
--
Cumulative count of configuration changes, grouped by operation type and result.

type: long

--

*`gcp.pubsub.topic.message_sizes.bytes`*::
+
--
Distribution of publish message sizes (in bytes)

type: long

--

*`gcp.pubsub.topic.oldest_retained_acked_message_age_by_region.value`*::
+
--
Age (in seconds) of the oldest acknowledged message retained in a topic, broken down by Cloud region.

type: long

--

*`gcp.pubsub.topic.oldest_unacked_message_age_by_region.value`*::
+
--
Age (in seconds) of the oldest unacknowledged message in a topic, broken down by Cloud region.

type: long

--

*`gcp.pubsub.topic.retained_acked_bytes_by_region.bytes`*::
+
--
Total byte size of the acknowledged messages retained in a topic, broken down by Cloud region.

type: long

--

*`gcp.pubsub.topic.send_message_operation.count`*::
+
--
Cumulative count of publish message operations, grouped by result. For a definition of message operations, see Cloud Pub/Sub metric subscription/mod_ack_deadline_message_operation_count.

type: long

--

*`gcp.pubsub.topic.send_request.count`*::
+
--
Cumulative count of publish requests, grouped by result.

type: long

--

*`gcp.pubsub.topic.streaming_pull_response.count`*::
+
--
Cumulative count of streaming pull responses, grouped by result.

type: long

--

*`gcp.pubsub.topic.unacked_bytes_by_region.bytes`*::
+
--
Total byte size of the unacknowledged messages in a topic, broken down by Cloud region.

type: long

--

[float]
=== storage

Google Cloud Storage metrics


*`gcp.storage.api.request.count`*::
+
--
Delta count of API calls, grouped by the API method name and response code.

type: long

--

*`gcp.storage.authz.acl_based_object_access.count`*::
+
--
Delta count of requests that result in an object being granted access solely due to object ACLs.

type: long

--

*`gcp.storage.authz.acl_operations.count`*::
+
--
Usage of ACL operations broken down by type.

type: long

--

*`gcp.storage.authz.object_specific_acl_mutation.count`*::
+
--
Delta count of changes made to object specific ACLs.

type: long

--

*`gcp.storage.network.received.bytes`*::
+
--
Delta count of bytes received over the network, grouped by the API method name and response code.

type: long

--

*`gcp.storage.network.sent.bytes`*::
+
--
Delta count of bytes sent over the network, grouped by the API method name and response code.

type: long

--

*`gcp.storage.storage.object.count`*::
+
--
Total number of objects per bucket, grouped by storage class. This value is measured once per day, and the value is repeated at each sampling interval throughout the day.

type: long

--

*`gcp.storage.storage.total_byte_seconds.bytes`*::
+
--
Delta count of bytes received over the network, grouped by the API method name and response code.

type: long

--

*`gcp.storage.storage.total.bytes`*::
+
--
Total size of all objects in the bucket, grouped by storage class. This value is measured once per day, and the value is repeated at each sampling interval throughout the day.

type: long

--

[[exported-fields-golang]]
== Golang fields

Golang module



[float]
=== golang




[float]
=== expvar

expvar



*`golang.expvar.cmdline`*::
+
--
The cmdline of this Go program start with.


type: keyword

--

[float]
=== heap

The Go program heap information exposed by expvar.



*`golang.heap.cmdline`*::
+
--
The cmdline of this Go program start with.


type: keyword

--

[float]
=== gc

Garbage collector summary.



[float]
=== total_pause

Total GC pause duration over lifetime of process.



*`golang.heap.gc.total_pause.ns`*::
+
--
Duration in Ns.


type: long

--

*`golang.heap.gc.total_count`*::
+
--
Total number of GC was happened.


type: long

--

*`golang.heap.gc.next_gc_limit`*::
+
--
Next collection will happen when HeapAlloc > this amount.


type: long

format: bytes

--

*`golang.heap.gc.cpu_fraction`*::
+
--
Fraction of CPU time used by GC.


type: float

--

[float]
=== pause

Last GC pause durations during the monitoring period.



*`golang.heap.gc.pause.count`*::
+
--
Count of GC pause duration during this collect period.


type: long

--

[float]
=== sum

Total GC pause duration during this collect period.



*`golang.heap.gc.pause.sum.ns`*::
+
--
Duration in Ns.


type: long

--

[float]
=== max

Max GC pause duration during this collect period.



*`golang.heap.gc.pause.max.ns`*::
+
--
Duration in Ns.


type: long

--

[float]
=== avg

Average GC pause duration during this collect period.



*`golang.heap.gc.pause.avg.ns`*::
+
--
Duration in Ns.


type: long

--

[float]
=== system

Heap summary,which bytes was obtained from system.



*`golang.heap.system.total`*::
+
--
Total bytes obtained from system (sum of XxxSys below).


type: long

format: bytes

--

*`golang.heap.system.obtained`*::
+
--
Via HeapSys, bytes obtained from system. heap_sys = heap_idle + heap_inuse.


type: long

format: bytes

--

*`golang.heap.system.stack`*::
+
--
Bytes used by stack allocator, and these bytes was obtained from system.


type: long

format: bytes

--

*`golang.heap.system.released`*::
+
--
Bytes released to the OS.


type: long

format: bytes

--

[float]
=== allocations

Heap allocations summary.



*`golang.heap.allocations.mallocs`*::
+
--
Number of mallocs.


type: long

--

*`golang.heap.allocations.frees`*::
+
--
Number of frees.


type: long

--

*`golang.heap.allocations.objects`*::
+
--
Total number of allocated objects.


type: long

--

*`golang.heap.allocations.total`*::
+
--
Bytes allocated (even if freed) throughout the lifetime.


type: long

format: bytes

--

*`golang.heap.allocations.allocated`*::
+
--
Bytes allocated and not yet freed (same as Alloc above).


type: long

format: bytes

--

*`golang.heap.allocations.idle`*::
+
--
Bytes in idle spans.


type: long

format: bytes

--

*`golang.heap.allocations.active`*::
+
--
Bytes in non-idle span.


type: long

format: bytes

--

[[exported-fields-graphite]]
== Graphite fields

graphite Module



[float]
=== graphite




[float]
=== server

server



*`graphite.server.example`*::
+
--
Example field


type: keyword

--

[[exported-fields-haproxy]]
== HAProxy fields

HAProxy Module



[float]
=== haproxy

HAProxy metrics.



[float]
=== info

General information about HAProxy processes.



*`haproxy.info.processes`*::
+
--
Number of processes.


type: long

--

*`haproxy.info.process_num`*::
+
--
Process number.


type: long

--

*`haproxy.info.threads`*::
+
--
Number of threads.


type: long

--

*`haproxy.info.pid`*::
+
--
Process ID.


type: alias

alias to: process.pid

--

*`haproxy.info.run_queue`*::
+
--


type: long

--

*`haproxy.info.stopping`*::
+
--
Number of stopping jobs.


type: long

--

*`haproxy.info.jobs`*::
+
--
Number of all jobs.


type: long

--

*`haproxy.info.unstoppable_jobs`*::
+
--
Number of unstoppable jobs.


type: long

--

*`haproxy.info.listeners`*::
+
--
Number of listeners.


type: long

--

*`haproxy.info.dropped_logs`*::
+
--
Number of dropped logs.


type: long

--

*`haproxy.info.busy_polling`*::
+
--
Number of busy polling.


type: long

--

*`haproxy.info.failed_resolutions`*::
+
--
Number of failed resolutions.


type: long

--

*`haproxy.info.tasks`*::
+
--


type: long

--

*`haproxy.info.uptime.sec`*::
+
--
Current uptime in seconds.


type: long

--

*`haproxy.info.memory.max.bytes`*::
+
--
Maximum amount of memory usage in bytes (the 'Memmax_MB' value converted to bytes).


type: long

format: bytes

--



*`haproxy.info.bytes.out.total`*::
+
--
Number of bytes sent out.


type: long

--

*`haproxy.info.bytes.out.rate`*::
+
--
Average bytes output rate.


type: long

--


*`haproxy.info.peers.active`*::
+
--
Number of active peers.


type: long

--

*`haproxy.info.peers.connected`*::
+
--
Number of connected peers.


type: long

--


*`haproxy.info.pool.allocated`*::
+
--
Size of the allocated pool.


type: long

--

*`haproxy.info.pool.used`*::
+
--
Number of members used from the allocated pool.


type: long

--

*`haproxy.info.pool.failed`*::
+
--
Number of failed connections to pool members.


type: long

--

*`haproxy.info.ulimit_n`*::
+
--
Maximum number of open files for the process.


type: long

--

[float]
=== compress




[float]
=== bps




*`haproxy.info.compress.bps.in`*::
+
--


type: long

--

*`haproxy.info.compress.bps.out`*::
+
--


type: long

--

*`haproxy.info.compress.bps.rate_limit`*::
+
--


type: long

--

[float]
=== connection




[float]
=== rate




*`haproxy.info.connection.rate.value`*::
+
--


type: long

--

*`haproxy.info.connection.rate.limit`*::
+
--


type: long

--

*`haproxy.info.connection.rate.max`*::
+
--


type: long

--

*`haproxy.info.connection.current`*::
+
--
Current connections.


type: long

--

*`haproxy.info.connection.total`*::
+
--
Total connections.


type: long

--

*`haproxy.info.connection.ssl.current`*::
+
--
Current SSL connections.


type: long

--

*`haproxy.info.connection.ssl.total`*::
+
--
Total SSL connections.


type: long

--

*`haproxy.info.connection.ssl.max`*::
+
--
Maximum SSL connections.


type: long

--

*`haproxy.info.connection.max`*::
+
--
Maximum connections.


type: long

--

*`haproxy.info.connection.hard_max`*::
+
--


type: long

--

*`haproxy.info.requests.total`*::
+
--


type: long

--

*`haproxy.info.sockets.max`*::
+
--


type: long

--

*`haproxy.info.requests.max`*::
+
--


type: long

--

[float]
=== pipes




*`haproxy.info.pipes.used`*::
+
--


type: integer

--

*`haproxy.info.pipes.free`*::
+
--


type: integer

--

*`haproxy.info.pipes.max`*::
+
--


type: integer

--

[float]
=== session

None


*`haproxy.info.session.rate.value`*::
+
--


type: integer

--

*`haproxy.info.session.rate.limit`*::
+
--


type: integer

--

*`haproxy.info.session.rate.max`*::
+
--


type: integer

--

[float]
=== ssl

None


*`haproxy.info.ssl.rate.value`*::
+
--
None

type: integer

--

*`haproxy.info.ssl.rate.limit`*::
+
--
None

type: integer

--

*`haproxy.info.ssl.rate.max`*::
+
--
None

type: integer

--

[float]
=== frontend

None


*`haproxy.info.ssl.frontend.key_rate.value`*::
+
--
None

type: integer

--

*`haproxy.info.ssl.frontend.key_rate.max`*::
+
--
None

type: integer

--

*`haproxy.info.ssl.frontend.session_reuse.pct`*::
+
--
None

type: scaled_float

format: percent

--

[float]
=== backend

None


*`haproxy.info.ssl.backend.key_rate.value`*::
+
--
None

type: integer

--

*`haproxy.info.ssl.backend.key_rate.max`*::
+
--
MaxConnRate

type: integer

--

*`haproxy.info.ssl.cached_lookups`*::
+
--
None

type: long

--

*`haproxy.info.ssl.cache_misses`*::
+
--
None

type: long

--

[float]
=== zlib_mem_usage




*`haproxy.info.zlib_mem_usage.value`*::
+
--


type: integer

--

*`haproxy.info.zlib_mem_usage.max`*::
+
--


type: integer

--

*`haproxy.info.idle.pct`*::
+
--


type: scaled_float

format: percent

--

[float]
=== stat

Stats collected from HAProxy processes.



*`haproxy.stat.status`*::
+
--
Status (UP, DOWN, NOLB, MAINT, or MAINT(via)...).


type: keyword

--

*`haproxy.stat.weight`*::
+
--
Total weight (for backends), or server weight (for servers).


type: long

--

*`haproxy.stat.downtime`*::
+
--
Total downtime (in seconds). For backends, this value is the downtime for the whole backend, not the sum of the downtime for the servers.


type: long

--

*`haproxy.stat.component_type`*::
+
--
Component type (0=frontend, 1=backend, 2=server, or 3=socket/listener).


type: integer

--

*`haproxy.stat.process_id`*::
+
--
Process ID (0 for first instance, 1 for second, and so on).


type: alias

alias to: process.pid

--

*`haproxy.stat.service_name`*::
+
--
Service name (FRONTEND for frontend, BACKEND for backend, or any name for server/listener).


type: keyword

--

*`haproxy.stat.in.bytes`*::
+
--
Bytes in.


type: long

format: bytes

--

*`haproxy.stat.out.bytes`*::
+
--
Bytes out.


type: long

format: bytes

--

*`haproxy.stat.last_change`*::
+
--
Number of seconds since the last UP->DOWN or DOWN->UP transition.


type: integer

--

*`haproxy.stat.throttle.pct`*::
+
--
Current throttle percentage for the server when slowstart is active, or no value if slowstart is inactive.


type: scaled_float

format: percent

--

*`haproxy.stat.selected.total`*::
+
--
Total number of times a server was selected, either for new sessions, or when re-dispatching. For servers, this field reports the the number of times the server was selected.


type: long

--

*`haproxy.stat.tracked.id`*::
+
--
ID of the proxy/server if tracking is enabled.


type: long

--

*`haproxy.stat.cookie`*::
+
--
Cookie value of the server or the name of the cookie of the backend.


type: keyword

--

*`haproxy.stat.load_balancing_algorithm`*::
+
--
Load balancing algorithm.


type: keyword

--


*`haproxy.stat.connection.total`*::
+
--
Cumulative number of connections.


type: long

--

*`haproxy.stat.connection.retried`*::
+
--
Number of times a connection to a server was retried.


type: long

--

*`haproxy.stat.connection.time.avg`*::
+
--
Average connect time in ms over the last 1024 requests.


type: long

--

*`haproxy.stat.connection.rate`*::
+
--
Number of connections over the last second.


type: long

--

*`haproxy.stat.connection.rate_max`*::
+
--
Highest value of connection.rate.


type: long

--

*`haproxy.stat.connection.attempt.total`*::
+
--
Number of connection establishment attempts.


type: long

--

*`haproxy.stat.connection.reuse.total`*::
+
--
Number of connection reuses.


type: long

--


*`haproxy.stat.connection.idle.total`*::
+
--
Number of idle connections available for reuse.


type: long

--

*`haproxy.stat.connection.idle.limit`*::
+
--
Limit on idle connections available for reuse.


type: long

--


*`haproxy.stat.connection.cache.lookup.total`*::
+
--
Number of cache lookups.


type: long

--

*`haproxy.stat.connection.cache.hits`*::
+
--
Number of cache hits.


type: long

--


*`haproxy.stat.request.denied`*::
+
--
Requests denied because of security concerns.

  * For TCP this is because of a matched tcp-request content rule.
  * For HTTP this is because of a matched http-request or tarpit rule.


type: long

--

*`haproxy.stat.request.denied_by_connection_rules`*::
+
--
Requests denied because of TCP request connection rules.


type: long

--

*`haproxy.stat.request.denied_by_session_rules`*::
+
--
Requests denied because of TCP request session rules.


type: long

--

*`haproxy.stat.request.queued.current`*::
+
--
Current queued requests. For backends, this field reports the number of requests queued without a server assigned.


type: long

--

*`haproxy.stat.request.queued.max`*::
+
--
Maximum value of queued.current.


type: long

--

*`haproxy.stat.request.errors`*::
+
--
Request errors. Some of the possible causes are:

  * early termination from the client, before the request has been sent
  * read error from the client
  * client timeout
  * client closed connection
  * various bad requests from the client.
  * request was tarpitted.


type: long

--

*`haproxy.stat.request.redispatched`*::
+
--
Number of times a request was redispatched to another server. For servers, this field reports the number of times the server was switched away from.


type: long

--

*`haproxy.stat.request.connection.errors`*::
+
--
Number of requests that encountered an error trying to connect to a server. For backends, this field reports the sum of the stat for all backend servers, plus any connection errors not associated with a particular server (such as the backend having no active servers).


type: long

--

[float]
=== rate




*`haproxy.stat.request.rate.value`*::
+
--
Number of HTTP requests per second over the last elapsed second.


type: long

--

*`haproxy.stat.request.rate.max`*::
+
--
Maximum number of HTTP requests per second.


type: long

--

*`haproxy.stat.request.total`*::
+
--
Total number of HTTP requests received.


type: long

--

*`haproxy.stat.request.intercepted`*::
+
--
Number of intercepted requests.


type: long

--


*`haproxy.stat.response.errors`*::
+
--
Number of response errors. This value includes the number of data transfers aborted by the server (haproxy.stat.server.aborted). Some other errors are:
* write errors on the client socket (won't be counted for the server stat) * failure applying filters to the response


type: long

--

*`haproxy.stat.response.time.avg`*::
+
--
Average response time in ms over the last 1024 requests (0 for TCP).


type: long

--

*`haproxy.stat.response.denied`*::
+
--
Responses denied because of security concerns. For HTTP this is because of a matched http-request rule, or "option checkcache".


type: integer

--

[float]
=== http




*`haproxy.stat.response.http.1xx`*::
+
--
HTTP responses with 1xx code.


type: long

--

*`haproxy.stat.response.http.2xx`*::
+
--
HTTP responses with 2xx code.


type: long

--

*`haproxy.stat.response.http.3xx`*::
+
--
HTTP responses with 3xx code.


type: long

--

*`haproxy.stat.response.http.4xx`*::
+
--
HTTP responses with 4xx code.


type: long

--

*`haproxy.stat.response.http.5xx`*::
+
--
HTTP responses with 5xx code.


type: long

--

*`haproxy.stat.response.http.other`*::
+
--
HTTP responses with other codes (protocol error).


type: long

--




*`haproxy.stat.header.rewrite.failed.total`*::
+
--
Number of failed header rewrite warnings.


type: long

--


*`haproxy.stat.session.current`*::
+
--
Number of current sessions.


type: long

--

*`haproxy.stat.session.max`*::
+
--
Maximum number of sessions.


type: long

--

*`haproxy.stat.session.limit`*::
+
--
Configured session limit.


type: long

--

*`haproxy.stat.session.total`*::
+
--
Number of all sessions.


type: long

--


*`haproxy.stat.session.rate.value`*::
+
--
Number of sessions per second over the last elapsed second.


type: integer

--

*`haproxy.stat.session.rate.limit`*::
+
--
Configured limit on new sessions per second.


type: integer

--

*`haproxy.stat.session.rate.max`*::
+
--
Maximum number of new sessions per second.


type: integer

--

[float]
=== check




*`haproxy.stat.check.status`*::
+
--
Status of the last health check. One of:

  UNK     -> unknown
  INI     -> initializing
  SOCKERR -> socket error
  L4OK    -> check passed on layer 4, no upper layers testing enabled
  L4TOUT  -> layer 1-4 timeout
  L4CON   -> layer 1-4 connection problem, for example
            "Connection refused" (tcp rst) or "No route to host" (icmp)
  L6OK    -> check passed on layer 6
  L6TOUT  -> layer 6 (SSL) timeout
  L6RSP   -> layer 6 invalid response - protocol error
  L7OK    -> check passed on layer 7
  L7OKC   -> check conditionally passed on layer 7, for example 404 with
            disable-on-404
  L7TOUT  -> layer 7 (HTTP/SMTP) timeout
  L7RSP   -> layer 7 invalid response - protocol error
  L7STS   -> layer 7 response error, for example HTTP 5xx


type: keyword

--

*`haproxy.stat.check.code`*::
+
--
Layer 5-7 code, if available.


type: long

--

*`haproxy.stat.check.duration`*::
+
--
Time in ms that it took to finish the last health check.


type: long

--

*`haproxy.stat.check.health.last`*::
+
--
The result of the last health check.


type: keyword

--

*`haproxy.stat.check.health.fail`*::
+
--
Number of failed checks.


type: long

--

*`haproxy.stat.check.agent.last`*::
+
--


type: integer

--

*`haproxy.stat.check.failed`*::
+
--
Number of checks that failed while the server was up.


type: long

--

*`haproxy.stat.check.down`*::
+
--
Number of UP->DOWN transitions. For backends, this value is the number of transitions to the whole backend being down, rather than the sum of the transitions for each server.


type: long

--

*`haproxy.stat.client.aborted`*::
+
--
Number of data transfers aborted by the client.


type: integer

--

[float]
=== server




*`haproxy.stat.server.id`*::
+
--
Server ID (unique inside a proxy).


type: integer

--

*`haproxy.stat.server.aborted`*::
+
--
Number of data transfers aborted by the server. This value is included in haproxy.stat.response.errors.


type: integer

--

*`haproxy.stat.server.active`*::
+
--
Number of backend servers that are active, meaning that they are healthy and can receive requests from the load balancer.


type: integer

--

*`haproxy.stat.server.backup`*::
+
--
Number of backend servers that are backup servers.


type: integer

--

[float]
=== compressor




*`haproxy.stat.compressor.in.bytes`*::
+
--
Number of HTTP response bytes fed to the compressor.


type: long

format: bytes

--

*`haproxy.stat.compressor.out.bytes`*::
+
--
Number of HTTP response bytes emitted by the compressor.


type: integer

format: bytes

--

*`haproxy.stat.compressor.bypassed.bytes`*::
+
--
Number of bytes that bypassed the HTTP compressor (CPU/BW limit).


type: long

format: bytes

--

*`haproxy.stat.compressor.response.bytes`*::
+
--
Number of HTTP responses that were compressed.


type: long

format: bytes

--

[float]
=== proxy




*`haproxy.stat.proxy.id`*::
+
--
Unique proxy ID.


type: integer

--

*`haproxy.stat.proxy.name`*::
+
--
Proxy name.


type: keyword

--

*`haproxy.stat.proxy.mode`*::
+
--
Proxy mode (tcp, http, health, unknown).


type: keyword

--

[float]
=== queue




*`haproxy.stat.queue.limit`*::
+
--
Configured queue limit (maxqueue) for the server, or nothing if the value of maxqueue is 0 (meaning no limit).


type: integer

--

*`haproxy.stat.queue.time.avg`*::
+
--
The average queue time in ms over the last 1024 requests.


type: integer

--

[float]
=== agent




*`haproxy.stat.agent.status`*::
+
--
Status of the last health check. One of:

  UNK     -> unknown
  INI     -> initializing
  SOCKERR -> socket error
  L4OK    -> check passed on layer 4, no upper layers enabled
  L4TOUT  -> layer 1-4 timeout
  L4CON   -> layer 1-4 connection problem, for example
            "Connection refused" (tcp rst) or "No route to host" (icmp)
  L7OK    -> agent reported "up"
  L7STS   -> agent reported "fail", "stop" or "down"


type: keyword

--

*`haproxy.stat.agent.description`*::
+
--
Human readable version of agent.status.


type: keyword

--

*`haproxy.stat.agent.code`*::
+
--
Value reported by agent.


type: integer

--

*`haproxy.stat.agent.rise`*::
+
--
Rise value of agent.


type: integer

--

*`haproxy.stat.agent.fall`*::
+
--
Fall value of agent.


type: integer

--

*`haproxy.stat.agent.health`*::
+
--
Health parameter of agent. Between 0 and `agent.rise`+`agent.fall`-1.


type: integer

--

*`haproxy.stat.agent.duration`*::
+
--
Duration of the last check in ms.


type: integer

--


*`haproxy.stat.agent.check.rise`*::
+
--
Rise value of server.


type: integer

--

*`haproxy.stat.agent.check.fall`*::
+
--
Fall value of server.


type: integer

--

*`haproxy.stat.agent.check.health`*::
+
--
Health parameter of server. Between 0 and `agent.check.rise`+`agent.check.fall`-1.


type: integer

--

*`haproxy.stat.agent.check.description`*::
+
--
Human readable version of check.


type: keyword

--


*`haproxy.stat.source.address`*::
+
--
Address of the source.


type: text

--

[[exported-fields-host-processor]]
== Host fields

Info collected for the host machine.




*`host.containerized`*::
+
--
If the host is a container.


type: boolean

--

*`host.os.build`*::
+
--
OS build information.


type: keyword

example: 18D109

--

*`host.os.codename`*::
+
--
OS codename, if any.


type: keyword

example: stretch

--

[[exported-fields-http]]
== HTTP fields

HTTP module



[float]
=== http




[float]
=== request

HTTP request information



*`http.request.headers`*::
+
--
The HTTP headers sent


type: object

--

[float]
=== response

HTTP response information



*`http.response.headers`*::
+
--
The HTTP headers received


type: object

--

*`http.response.code`*::
+
--
The HTTP status code


type: keyword

example: 404

--

*`http.response.phrase`*::
+
--
The HTTP status phrase


type: keyword

example: Not found

--

[float]
=== json

json metricset


[float]
=== server

server


[[exported-fields-ibmmq]]
== IBM MQ fields

IBM MQ module




[[exported-fields-iis]]
== IIS fields

iis module



[float]
=== iis




[float]
=== application_pool

Application pool process stats.



*`iis.application_pool.name`*::
+
--
application pool name


type: keyword

--

[float]
=== process

Worker process overview.



*`iis.application_pool.process.handle_count`*::
+
--
The number of handles.


type: long

--

*`iis.application_pool.process.io_read_operations_per_sec`*::
+
--
IO read operations per sec.


type: float

--

*`iis.application_pool.process.io_write_operations_per_sec`*::
+
--
IO write operations per sec.


type: float

--

*`iis.application_pool.process.virtual_bytes`*::
+
--
Memory virtual bytes.


type: float

--

*`iis.application_pool.process.cpu_usage_perc`*::
+
--
The CPU usage percentage.


type: float

--

*`iis.application_pool.process.thread_count`*::
+
--
The number of threats.


type: long

--

*`iis.application_pool.process.working_set`*::
+
--
Memory working set.


type: float

--

*`iis.application_pool.process.private_bytes`*::
+
--
Memory private bytes.


type: float

--

*`iis.application_pool.process.page_faults_per_sec`*::
+
--
Memory page faults.


type: float

--

[float]
=== net_clr

Common Language Runtime overview.



*`iis.application_pool.net_clr.finallys_per_sec`*::
+
--
The number of finallys per sec.


type: float

--

*`iis.application_pool.net_clr.throw_to_catch_depth_per_sec`*::
+
--
Throw to catch depth count per sec.


type: float

--

*`iis.application_pool.net_clr.total_exceptions_thrown`*::
+
--
Total number of exceptions thrown.


type: long

--

*`iis.application_pool.net_clr.filters_per_sec`*::
+
--
Number of filters per sec.


type: float

--

[float]
=== webserver

Webserver related metrics.



[float]
=== process

The process related stats.



*`iis.webserver.process.cpu_usage_perc`*::
+
--
The CPU usage percentage.


type: float

--

*`iis.webserver.process.handle_count`*::
+
--
The number of handles.


type: float

--

*`iis.webserver.process.virtual_bytes`*::
+
--
Memory virtual bytes.


type: float

--

*`iis.webserver.process.thread_count`*::
+
--
The number of threads.


type: long

--

*`iis.webserver.process.working_set`*::
+
--
Memory working set.


type: float

--

*`iis.webserver.process.private_bytes`*::
+
--
Memory private bytes.


type: float

--

*`iis.webserver.process.worker_process_count`*::
+
--
Number of worker processes running.


type: float

--

*`iis.webserver.process.page_faults_per_sec`*::
+
--
Memory page faults.


type: float

--

*`iis.webserver.process.io_read_operations_per_sec`*::
+
--
IO read operations per sec.


type: float

--

*`iis.webserver.process.io_write_operations_per_sec`*::
+
--
IO write operations per sec.


type: float

--

[float]
=== asp_net

Common Language Runtime overview.



*`iis.webserver.asp_net.application_restarts`*::
+
--
Number of applications restarts.


type: float

--

*`iis.webserver.asp_net.request_wait_time`*::
+
--
Request wait time.


type: long

--

[float]
=== asp_net_application

ASP.NET application overview.



*`iis.webserver.asp_net_application.errors_total_per_sec`*::
+
--
Total number of errors per sec.


type: float

--

*`iis.webserver.asp_net_application.pipeline_instance_count`*::
+
--
The pipeline instance count.


type: float

--

*`iis.webserver.asp_net_application.requests_per_sec`*::
+
--
Number of requests per sec.


type: float

--

*`iis.webserver.asp_net_application.requests_executing`*::
+
--
Number of requests executing.


type: float

--

*`iis.webserver.asp_net_application.requests_in_application_queue`*::
+
--
Number of requests in the application queue.


type: float

--

[float]
=== cache

The cache overview.



*`iis.webserver.cache.current_file_cache_memory_usage`*::
+
--
The current file cache memory usage size.


type: float

--

*`iis.webserver.cache.current_files_cached`*::
+
--
The number of current files cached.


type: float

--

*`iis.webserver.cache.current_uris_cached`*::
+
--
The number of current uris cached.


type: float

--

*`iis.webserver.cache.file_cache_hits`*::
+
--
The number of file cache hits.


type: float

--

*`iis.webserver.cache.file_cache_misses`*::
+
--
The number of file cache misses.


type: float

--

*`iis.webserver.cache.maximum_file_cache_memory_usage`*::
+
--
The max file cache size.


type: float

--

*`iis.webserver.cache.output_cache_current_items`*::
+
--
The number of output cache current items.


type: float

--

*`iis.webserver.cache.output_cache_current_memory_usage`*::
+
--
The output cache memory usage size.


type: float

--

*`iis.webserver.cache.output_cache_total_hits`*::
+
--
The output cache total hits count.


type: float

--

*`iis.webserver.cache.output_cache_total_misses`*::
+
--
The output cache total misses count.


type: float

--

*`iis.webserver.cache.total_files_cached`*::
+
--
the total number of files cached.


type: float

--

*`iis.webserver.cache.total_uris_cached`*::
+
--
The total number of URIs cached.


type: float

--

*`iis.webserver.cache.uri_cache_hits`*::
+
--
The number of URIs cached hits.


type: float

--

*`iis.webserver.cache.uri_cache_misses`*::
+
--
The number of URIs cache misses.


type: float

--

[float]
=== network

The network related stats.



*`iis.webserver.network.anonymous_users_per_sec`*::
+
--
The number of anonymous users per sec.


type: float

--

*`iis.webserver.network.bytes_received_per_sec`*::
+
--
The size of bytes received per sec.


type: float

--

*`iis.webserver.network.bytes_sent_per_sec`*::
+
--
The size of bytes sent per sec.


type: float

--

*`iis.webserver.network.current_anonymous_users`*::
+
--
The number of current anonymous users.


type: float

--

*`iis.webserver.network.current_connections`*::
+
--
The number of current connections.


type: float

--

*`iis.webserver.network.current_non_anonymous_users`*::
+
--
The number of current non anonymous users.


type: float

--

*`iis.webserver.network.delete_requests_per_sec`*::
+
--
Number of DELETE requests per sec.


type: float

--

*`iis.webserver.network.get_requests_per_sec`*::
+
--
Number of GET requests per sec.


type: float

--

*`iis.webserver.network.maximum_connections`*::
+
--
Number of maximum connections.


type: float

--

*`iis.webserver.network.post_requests_per_sec`*::
+
--
Number of POST requests per sec.


type: float

--

*`iis.webserver.network.service_uptime`*::
+
--
Service uptime.


type: float

--

*`iis.webserver.network.total_anonymous_users`*::
+
--
Total number of anonymous users.


type: float

--

*`iis.webserver.network.total_bytes_received`*::
+
--
Total size of bytes received.


type: float

--

*`iis.webserver.network.total_bytes_sent`*::
+
--
Total size of bytes sent.


type: float

--

*`iis.webserver.network.total_connection_attempts`*::
+
--
The total number of connection attempts.


type: float

--

*`iis.webserver.network.total_delete_requests`*::
+
--
The total number of DELETE requests.


type: float

--

*`iis.webserver.network.total_get_requests`*::
+
--
The total number of GET requests.


type: float

--

*`iis.webserver.network.total_non_anonymous_users`*::
+
--
The total number of non anonymous users.


type: float

--

*`iis.webserver.network.total_post_requests`*::
+
--
The total number of POST requests.


type: float

--

[float]
=== website

Website related metrics.



*`iis.website.name`*::
+
--
website name


type: keyword

--

[float]
=== network

The network overview.



*`iis.website.network.bytes_received_per_sec`*::
+
--
The bytes received per sec size.


type: float

--

*`iis.website.network.bytes_sent_per_sec`*::
+
--
The bytes sent per sec size.


type: float

--

*`iis.website.network.current_connections`*::
+
--
The number of current connections.


type: float

--

*`iis.website.network.delete_requests_per_sec`*::
+
--
The number of DELETE requests per sec.


type: float

--

*`iis.website.network.get_requests_per_sec`*::
+
--
The number of GET requests per sec.


type: float

--

*`iis.website.network.maximum_connections`*::
+
--
The number of maximum connections.


type: float

--

*`iis.website.network.post_requests_per_sec`*::
+
--
The number of POST requests per sec.


type: float

--

*`iis.website.network.put_requests_per_sec`*::
+
--
The number of PUT requests per sec.


type: float

--

*`iis.website.network.service_uptime`*::
+
--
The service uptime.


type: float

--

*`iis.website.network.total_bytes_received`*::
+
--
The total number of bytes received.


type: float

--

*`iis.website.network.total_bytes_sent`*::
+
--
The  total number of bytes sent.


type: float

--

*`iis.website.network.total_connection_attempts`*::
+
--
The total number of connection attempts.


type: float

--

*`iis.website.network.total_delete_requests`*::
+
--
The total number of DELETE requests.


type: float

--

*`iis.website.network.total_get_requests`*::
+
--
The total number of GET requests.


type: float

--

*`iis.website.network.total_post_requests`*::
+
--
The total number of POST requests.


type: float

--

*`iis.website.network.total_put_requests`*::
+
--
The total number of PUT requests.


type: float

--

[[exported-fields-istio]]
== Istio fields

istio Module



[float]
=== istio

`istio` contains statistics that were read from Istio



[float]
=== citadel

Contains statistics related to the Istio Citadel service



*`istio.citadel.grpc.method`*::
+
--
The grpc method


type: keyword

--

*`istio.citadel.grpc.service`*::
+
--
The grpc service


type: keyword

--

*`istio.citadel.grpc.type`*::
+
--
The type of the respective grpc service


type: keyword

--

*`istio.citadel.secret_controller_svc_acc_created_cert.count`*::
+
--
The number of certificates created due to service account creation.


type: long

--

*`istio.citadel.server_root_cert_expiry_seconds`*::
+
--
The unix timestamp, in seconds, when Citadel root cert will expire. We set it to negative in case of internal error.


type: float

--

*`istio.citadel.grpc.server.handled`*::
+
--
Total number of RPCs completed on the server, regardless of success or failure.


type: long

--

*`istio.citadel.grpc.server.msg.received`*::
+
--
Total number of RPC stream messages received on the server.


type: long

--

*`istio.citadel.grpc.server.msg.sent`*::
+
--
Total number of gRPC stream messages sent by the server.


type: long

--

*`istio.citadel.grpc.server.started`*::
+
--
Total number of RPCs started on the server.


type: long

--

*`istio.citadel.grpc.server.handling.latency.ms.bucket.*`*::
+
--
The response latency (milliseconds) of gRPC that had been application-level handled by the server.


type: object

--

*`istio.citadel.grpc.server.handling.latency.ms.sum`*::
+
--
The response latency of gRPC, sum of latencies in milliseconds


type: long

format: duration

--

*`istio.citadel.grpc.server.handling.latency.ms.count`*::
+
--
The response latency of gRPC, number of metrics


type: long

--

[float]
=== galley

Contains statistics related to the Istio galley service



*`istio.galley.name`*::
+
--
The name of the resource the metric is related to


type: keyword

--

*`istio.galley.namespace`*::
+
--
The Kubernetes namespace of the resource


type: keyword

--

*`istio.galley.version`*::
+
--
The version of the object


type: keyword

--

*`istio.galley.collection`*::
+
--
The collection of the instance


type: keyword

--

*`istio.galley.istio.authentication.meshpolicies`*::
+
--
The number of valid istio/authentication/meshpolicies known to galley at a point in time


type: long

--

*`istio.galley.istio.authentication.policies`*::
+
--
The number of valid istio/authentication/policies known to galley at a point in time


type: long

--

*`istio.galley.istio.mesh.MeshConfig`*::
+
--
The number of valid istio/mesh/MeshConfig known to galley at a point in time


type: long

--

*`istio.galley.istio.networking.destinationrules`*::
+
--
The number of valid istio/networking/destinationrules known to galley at a point in time


type: long

--

*`istio.galley.istio.networking.envoyfilters`*::
+
--
The number of valid istio/networking/envoyfilters known to galley at a point in time


type: long

--

*`istio.galley.istio.networking.gateways`*::
+
--
The number of valid istio/networking/gateways known to galley at a point in time


type: long

--

*`istio.galley.istio.networking.sidecars`*::
+
--
The number of valid istio/networking/sidecars known to galley at a point in time


type: long

--

*`istio.galley.istio.networking.virtualservices`*::
+
--
The number of valid istio/networking/virtualservices known to galley at a point in time


type: long

--

*`istio.galley.istio.policy.attributemanifests`*::
+
--
The number of valid istio/policy/attributemanifests known to galley at a point in time


type: long

--

*`istio.galley.istio.policy.handlers`*::
+
--
The number of valid istio/policy/handlers known to galley at a point in time


type: long

--

*`istio.galley.istio.policy.instances`*::
+
--
The number of valid istio/policy/instances known to galley at a point in time


type: long

--

*`istio.galley.istio.policy.rules`*::
+
--
The number of valid istio/policy/rules known to galley at a point in time


type: long

--

*`istio.galley.runtime.processor.event_span.duration.ms.bucket.*`*::
+
--
The duration between each incoming event as histogram buckets in milliseconds


type: object

--

*`istio.galley.runtime.processor.event_span.duration.ms.sum`*::
+
--
The duration between each incoming event, sum of durations in milliseconds


type: long

format: duration

--

*`istio.galley.runtime.processor.event_span.duration.ms.count`*::
+
--
The duration between each incoming event, number of metrics


type: long

--

*`istio.galley.runtime.processor.snapshot_events.bucket.*`*::
+
--
The number of events that have been processed as histogram buckets


type: object

--

*`istio.galley.runtime.processor.snapshot_events.sum`*::
+
--
The number of events that have been processed, sum of events


type: long

--

*`istio.galley.runtime.processor.snapshot_events.count`*::
+
--
The duration between each incoming event, number of metrics


type: long

--

*`istio.galley.runtime.processor.snapshot_lifetime.duration.ms.bucket.*`*::
+
--
The duration of each snapshot as histogram buckets in milliseconds


type: object

--

*`istio.galley.runtime.processor.snapshot_lifetime.duration.ms.sum`*::
+
--
The duration of each snapshot, sum of durations in milliseconds


type: long

format: duration

--

*`istio.galley.runtime.processor.snapshot_lifetime.duration.ms.count`*::
+
--
The duration of each snapshot, number of metrics


type: long

--

*`istio.galley.runtime.state_type_instances`*::
+
--
The number of type instances per type URL


type: long

--

*`istio.galley.runtime.strategy.on_change`*::
+
--
The number of times the strategy's onChange has been called


type: long

--

*`istio.galley.runtime.strategy.timer_quiesce_reached`*::
+
--
The number of times a quiesce has been reached


type: long

--

*`istio.galley.source_kube_event_success_total`*::
+
--
The number of times a kubernetes source successfully handled an event


type: long

--

*`istio.galley.validation.cert_key.updates`*::
+
--
Galley validation webhook certificate updates


type: long

--

*`istio.galley.validation.config.load`*::
+
--
k8s webhook configuration (re)loads


type: long

--

*`istio.galley.validation.config.updates`*::
+
--
k8s webhook configuration updates


type: long

--

[float]
=== mesh

Contains statistics related to the Istio mesh service



*`istio.mesh.instance`*::
+
--
The prometheus instance


type: text

--

*`istio.mesh.job`*::
+
--
The prometheus job


type: keyword

--

*`istio.mesh.requests`*::
+
--
Total requests handled by an Istio proxy


type: long

--

*`istio.mesh.request.duration.ms.bucket.*`*::
+
--
Request duration histogram buckets in milliseconds


type: object

--

*`istio.mesh.request.duration.ms.sum`*::
+
--
Requests duration, sum of durations in milliseconds


type: long

format: duration

--

*`istio.mesh.request.duration.ms.count`*::
+
--
Requests duration, number of requests


type: long

--

*`istio.mesh.request.size.bytes.bucket.*`*::
+
--
Request Size histogram buckets


type: object

--

*`istio.mesh.request.size.bytes.sum`*::
+
--
Request Size histogram sum


type: long

--

*`istio.mesh.request.size.bytes.count`*::
+
--
Request Size histogram count


type: long

--

*`istio.mesh.response.size.bytes.bucket.*`*::
+
--
Request Size histogram buckets


type: object

--

*`istio.mesh.response.size.bytes.sum`*::
+
--
Request Size histogram sum


type: long

--

*`istio.mesh.response.size.bytes.count`*::
+
--
Request Size histogram count


type: long

--

*`istio.mesh.reporter`*::
+
--
Reporter identifies the reporter of the request. It is set to destination if report is from a server Istio proxy and source if report is from a client Istio proxy.


type: keyword

--

*`istio.mesh.source.workload.name`*::
+
--
This identifies the name of source workload which controls the source.


type: keyword

--

*`istio.mesh.source.workload.namespace`*::
+
--
This identifies the namespace of the source workload.


type: keyword

--

*`istio.mesh.source.principal`*::
+
--
This identifies the peer principal of the traffic source. It is set when peer authentication is used.


type: keyword

--

*`istio.mesh.source.app`*::
+
--
This identifies the source app based on app label of the source workload.


type: keyword

--

*`istio.mesh.source.version`*::
+
--
This identifies the version of the source workload.


type: keyword

--

*`istio.mesh.destination.workload.name`*::
+
--
This identifies the name of destination workload.


type: keyword

--

*`istio.mesh.destination.workload.namespace`*::
+
--
This identifies the namespace of the destination workload.


type: keyword

--

*`istio.mesh.destination.principal`*::
+
--
This identifies the peer principal of the traffic destination. It is set when peer authentication is used.


type: keyword

--

*`istio.mesh.destination.app`*::
+
--
This identifies the destination app based on app label of the destination workload..


type: keyword

--

*`istio.mesh.destination.version`*::
+
--
This identifies the version of the destination workload.


type: keyword

--

*`istio.mesh.destination.service.host`*::
+
--
This identifies destination service host responsible for an incoming request.


type: keyword

--

*`istio.mesh.destination.service.name`*::
+
--
This identifies the destination service name.


type: keyword

--

*`istio.mesh.destination.service.namespace`*::
+
--
This identifies the namespace of destination service.


type: keyword

--

*`istio.mesh.request.protocol`*::
+
--
This identifies the protocol of the request. It is set to API protocol if provided, otherwise request or connection protocol.


type: keyword

--

*`istio.mesh.response.code`*::
+
--
This identifies the response code of the request. This label is present only on HTTP metrics.


type: long

--

*`istio.mesh.connection.security.policy`*::
+
--
This identifies the service authentication policy of the request. It is set to mutual_tls when Istio is used to make communication secure and report is from destination. It is set to unknown when report is from source since security policy cannot be properly populated.


type: keyword

--

[float]
=== mixer

Contains statistics related to the Istio mixer service



*`istio.mixer.istio.mcp.request.acks`*::
+
--
The number of request acks received by the source.


type: long

--

*`istio.mixer.config.adapter.info.errors.config`*::
+
--
The number of errors encountered during processing of the adapter info configuration.


type: long

--

*`istio.mixer.config.adapter.info.configs`*::
+
--
The number of known adapters in the current config.


type: long

--

*`istio.mixer.config.attributes`*::
+
--
The number of known attributes in the current config.


type: long

--

*`istio.mixer.config.handler.configs`*::
+
--
The number of known handlers in the current config.


type: long

--

*`istio.mixer.config.handler.errors.validation`*::
+
--
The number of errors encountered because handler validation returned error.


type: long

--

*`istio.mixer.config.instance.errors.config`*::
+
--
The number of errors encountered during processing of the instance configuration.


type: long

--

*`istio.mixer.config.instance.configs`*::
+
--
The number of known instances in the current config.


type: long

--

*`istio.mixer.config.rule.errors.config`*::
+
--
The number of errors encountered during processing of the rule configuration.


type: long

--

*`istio.mixer.config.rule.errors.match`*::
+
--
The number of rule conditions that was not parseable.


type: long

--

*`istio.mixer.config.rule.configs`*::
+
--
The number of known rules in the current config.


type: long

--

*`istio.mixer.config.template.errors.config`*::
+
--
The number of errors encountered during processing of the template configuration.


type: long

--

*`istio.mixer.config.template.configs`*::
+
--
The number of known templates in the current config.


type: long

--

*`istio.mixer.config.unsatisfied.action_handler`*::
+
--
The number of actions that failed due to handlers being unavailable.


type: long

--

*`istio.mixer.dispatcher_destinations_per_variety_total`*::
+
--
The number of Mixer adapter destinations by template variety type.


type: long

--

*`istio.mixer.handler.handlers.closed`*::
+
--
The number of handlers that were closed during config transition.


type: long

--

*`istio.mixer.handler.daemons`*::
+
--
The current number of active daemon routines in a given adapter environment.


type: long

--

*`istio.mixer.handler.failures.build`*::
+
--
The number of handlers that failed creation during config transition.


type: long

--

*`istio.mixer.handler.failures.close`*::
+
--
The number of errors encountered while closing handlers during config transition.


type: long

--

*`istio.mixer.handler.handlers.new`*::
+
--
The number of handlers that were newly created during config transition.


type: long

--

*`istio.mixer.handler.handlers.reused`*::
+
--
The number of handlers that were re-used during config transition.


type: long

--

*`istio.mixer.handler.name`*::
+
--
The name of the daemon  handler


type: keyword

--

*`istio.mixer.variety`*::
+
--
The name of the variety


type: keyword

--

[float]
=== pilot

Contains statistics related to the Istio pilot service



*`istio.pilot.xds.count`*::
+
--
Count of concurrent xDS client connections for Pilot.


type: long

--

*`istio.pilot.xds.pushes`*::
+
--
Count of xDS messages sent, as well as errors building or sending xDS messages for lds, rds, cds and eds.


type: long

--

*`istio.pilot.xds.push.time.ms.bucket.*`*::
+
--
Total time Pilot takes to push lds, rds, cds and eds, histogram buckets in milliseconds.


type: object

--

*`istio.pilot.xds.push.time.ms.sum`*::
+
--
Total time Pilot takes to push lds, rds, cds and eds, histogram sum of times in milliseconds.


type: long

--

*`istio.pilot.xds.push.time.ms.count`*::
+
--
Total time Pilot takes to push lds, rds, cds and eds, histogram count of times.


type: long

--

*`istio.pilot.xds.eds.instances`*::
+
--
Instances for each cluster, as of last push. Zero instances is an error.


type: long

--

*`istio.pilot.xds.push.context.errors`*::
+
--
Number of errors (timeouts) initiating push context.


type: long

--

*`istio.pilot.xds.internal.errors`*::
+
--
Total number of internal XDS errors in pilot.


type: long

--

*`istio.pilot.conflict.listener.inbound`*::
+
--
Number of conflicting inbound listeners.


type: long

--

*`istio.pilot.conflict.listener.outbound.http.over.current.tcp`*::
+
--
Number of conflicting wildcard http listeners with current wildcard tcp listener.


type: long

--

*`istio.pilot.conflict.listener.outbound.http.over.https`*::
+
--
Number of conflicting HTTP listeners with well known HTTPS ports.


type: long

--

*`istio.pilot.conflict.listener.outbound.tcp.over.current.http`*::
+
--
Number of conflicting wildcard tcp listeners with current wildcard http listener.


type: long

--

*`istio.pilot.conflict.listener.outbound.tcp.over.current.tcp`*::
+
--
Number of conflicting tcp listeners with current tcp listener.


type: long

--

*`istio.pilot.proxy.conv.ms.bucket.*`*::
+
--
Time needed by Pilot to push Envoy configurations, histogram buckets in milliseconds.


type: object

--

*`istio.pilot.proxy.conv.ms.sum`*::
+
--
Time needed by Pilot to push Envoy configurations, histogram sum of times in milliseconds.


type: long

--

*`istio.pilot.proxy.conv.ms.count`*::
+
--
Time needed by Pilot to push Envoy configurations, histogram count of times.


type: long

--

*`istio.pilot.services`*::
+
--
Total services known to pilot.


type: integer

--

*`istio.pilot.virt.services`*::
+
--
Total virtual services known to pilot.


type: long

--

*`istio.pilot.no.ip`*::
+
--
Pods not found in the endpoint table, possibly invalid.


type: long

--

*`istio.pilot.cluster`*::
+
--
The instance FQDN.


type: text

--

*`istio.pilot.type`*::
+
--
The Envoy proxy configuration type.


type: text

--

[[exported-fields-jolokia]]
== Jolokia fields

Jolokia module



[float]
=== jolokia

jolokia contains metrics exposed via jolokia agent



[[exported-fields-jolokia-autodiscover]]
== Jolokia Discovery autodiscover provider fields

Metadata from Jolokia Discovery added by the jolokia provider.



*`jolokia.agent.version`*::
+
--
Version number of jolokia agent.


type: keyword

--

*`jolokia.agent.id`*::
+
--
Each agent has a unique id which can be either provided during startup of the agent in form of a configuration parameter or being autodetected. If autodected, the id has several parts: The IP, the process id, hashcode of the agent and its type.


type: keyword

--

*`jolokia.server.product`*::
+
--
The container product if detected.


type: keyword

--

*`jolokia.server.version`*::
+
--
The container's version (if detected).


type: keyword

--

*`jolokia.server.vendor`*::
+
--
The vendor of the container the agent is running in.


type: keyword

--

*`jolokia.url`*::
+
--
The URL how this agent can be contacted.


type: keyword

--

*`jolokia.secured`*::
+
--
Whether the agent was configured for authentication or not.


type: boolean

--

[[exported-fields-kafka]]
== Kafka fields

Kafka module



[float]
=== kafka




[float]
=== broker

Broker Consumer Group Information have been read from (Broker handling the consumer group).



*`kafka.broker.id`*::
+
--
Broker id


type: long

--

*`kafka.broker.address`*::
+
--
Broker advertised address


type: keyword

--

*`kafka.topic.name`*::
+
--
Topic name


type: keyword

--

*`kafka.topic.error.code`*::
+
--
Topic error code.


type: long

--

*`kafka.partition.id`*::
+
--
Partition id.


type: long

--

*`kafka.partition.topic_id`*::
+
--
Unique id of the partition in the topic.

type: keyword

--

*`kafka.partition.topic_broker_id`*::
+
--
Unique id of the partition in the topic and the broker.

type: keyword

--

[float]
=== broker

Broker metrics from Kafka Broker JMX


*`kafka.broker.mbean`*::
+
--
Mbean that this event is related to

type: keyword

--

*`kafka.broker.request.channel.queue.size`*::
+
--
The size of the request queue

type: long

--

*`kafka.broker.request.produce.failed_per_second`*::
+
--
The rate of failed produce requests per second

type: float

--

*`kafka.broker.request.fetch.failed_per_second`*::
+
--
The rate of client fetch request failures per second

type: float

--

*`kafka.broker.request.produce.failed`*::
+
--
The number of failed produce requests

type: float

--

*`kafka.broker.request.fetch.failed`*::
+
--
The number of client fetch request failures

type: float

--

*`kafka.broker.replication.leader_elections`*::
+
--
The leader election rate

type: float

--

*`kafka.broker.replication.unclean_leader_elections`*::
+
--
The unclean leader election rate

type: float

--

*`kafka.broker.session.zookeeper.disconnect`*::
+
--
The ZooKeeper closed sessions per second

type: float

--

*`kafka.broker.session.zookeeper.expire`*::
+
--
The ZooKeeper expired sessions per second

type: float

--

*`kafka.broker.session.zookeeper.readonly`*::
+
--
The ZooKeeper readonly sessions per second

type: float

--

*`kafka.broker.session.zookeeper.sync`*::
+
--
The ZooKeeper client connections per second

type: float

--

*`kafka.broker.log.flush_rate`*::
+
--
The log flush rate

type: float

--

*`kafka.broker.topic.net.in.bytes_per_sec`*::
+
--
The incoming byte rate per topic

type: float

--

*`kafka.broker.topic.net.out.bytes_per_sec`*::
+
--
The outgoing byte rate per topic

type: float

--

*`kafka.broker.topic.net.rejected.bytes_per_sec`*::
+
--
The rejected byte rate per topic

type: float

--

*`kafka.broker.topic.messages_in`*::
+
--
The incoming message rate per topic

type: float

--

*`kafka.broker.net.in.bytes_per_sec`*::
+
--
The incoming byte rate

type: float

--

*`kafka.broker.net.out.bytes_per_sec`*::
+
--
The outgoing byte rate

type: float

--

*`kafka.broker.net.rejected.bytes_per_sec`*::
+
--
The rejected byte rate

type: float

--

*`kafka.broker.messages_in`*::
+
--
The incoming message rate

type: float

--

[float]
=== consumer

Consumer metrics from Kafka Consumer JMX


*`kafka.consumer.mbean`*::
+
--
Mbean that this event is related to

type: keyword

--

*`kafka.consumer.fetch_rate`*::
+
--
The minimum rate at which the consumer sends fetch requests to a broker

type: float

--

*`kafka.consumer.bytes_consumed`*::
+
--
The average number of bytes consumed for a specific topic per second

type: float

--

*`kafka.consumer.records_consumed`*::
+
--
The average number of records consumed per second for a specific topic

type: float

--

*`kafka.consumer.in.bytes_per_sec`*::
+
--
The rate of bytes coming in to the consumer

type: float

--

*`kafka.consumer.max_lag`*::
+
--
The maximum consumer lag

type: float

--

*`kafka.consumer.zookeeper_commits`*::
+
--
The rate of offset commits to ZooKeeper

type: float

--

*`kafka.consumer.kafka_commits`*::
+
--
The rate of offset commits to Kafka

type: float

--

*`kafka.consumer.messages_in`*::
+
--
The rate of consumer message consumption

type: float

--

[float]
=== consumergroup

consumergroup



[float]
=== broker

Broker Consumer Group Information have been read from (Broker handling the consumer group).



*`kafka.consumergroup.broker.id`*::
+
--
Broker id


type: long

--

*`kafka.consumergroup.broker.address`*::
+
--
Broker address


type: keyword

--

*`kafka.consumergroup.id`*::
+
--
Consumer Group ID

type: keyword

--

*`kafka.consumergroup.topic`*::
+
--

deprecated:[6.5]

Topic name

type: keyword

--

*`kafka.consumergroup.partition`*::
+
--

deprecated:[6.5]

Partition ID

type: long

--

*`kafka.consumergroup.offset`*::
+
--
consumer offset into partition being read

type: long

--

*`kafka.consumergroup.meta`*::
+
--
custom consumer meta data string

type: keyword

--

*`kafka.consumergroup.consumer_lag`*::
+
--
consumer lag for partition/topic calculated as the difference between the partition offset and consumer offset

type: long

--

*`kafka.consumergroup.error.code`*::
+
--
kafka consumer/partition error code.


type: long

--

[float]
=== client

Assigned client reading events from partition



*`kafka.consumergroup.client.id`*::
+
--
Client ID (kafka setting client.id)

type: keyword

--

*`kafka.consumergroup.client.host`*::
+
--
Client host

type: keyword

--

*`kafka.consumergroup.client.member_id`*::
+
--
internal consumer group member ID

type: keyword

--

[float]
=== partition

partition



[float]
=== offset

Available offsets of the given partition.



*`kafka.partition.offset.newest`*::
+
--
Newest offset of the partition.


type: long

--

*`kafka.partition.offset.oldest`*::
+
--
Oldest offset of the partition.


type: long

--

[float]
=== partition

Partition data.



*`kafka.partition.partition.id`*::
+
--

deprecated:[6.5]

Partition id.


type: long

--

*`kafka.partition.partition.leader`*::
+
--
Leader id (broker).


type: long

--

*`kafka.partition.partition.replica`*::
+
--
Replica id (broker).


type: long

--

*`kafka.partition.partition.insync_replica`*::
+
--
Indicates if replica is included in the in-sync replicate set (ISR).


type: boolean

--

*`kafka.partition.partition.is_leader`*::
+
--
Indicates if replica is the leader


type: boolean

--

*`kafka.partition.partition.error.code`*::
+
--
Error code from fetching partition.


type: long

--

*`kafka.partition.topic.error.code`*::
+
--

deprecated:[6.5]

topic error code.


type: long

--

*`kafka.partition.topic.name`*::
+
--

deprecated:[6.5]

Topic name


type: keyword

--

*`kafka.partition.broker.id`*::
+
--

deprecated:[6.5]

Broker id


type: long

--

*`kafka.partition.broker.address`*::
+
--

deprecated:[6.5]

Broker address


type: keyword

--

[float]
=== producer

Producer metrics from Kafka Producer JMX


*`kafka.producer.mbean`*::
+
--
Mbean that this event is related to

type: keyword

--

*`kafka.producer.available_buffer_bytes`*::
+
--
The total amount of buffer memory

type: float

--

*`kafka.producer.batch_size_avg`*::
+
--
The average number of bytes sent

type: float

--

*`kafka.producer.batch_size_max`*::
+
--
The maximum number of bytes sent

type: long

--

*`kafka.producer.record_send_rate`*::
+
--
The average number of records sent per second

type: float

--

*`kafka.producer.record_retry_rate`*::
+
--
The average number of retried record sends per second

type: float

--

*`kafka.producer.record_error_rate`*::
+
--
The average number of retried record sends per second

type: float

--

*`kafka.producer.records_per_request`*::
+
--
The average number of records sent per second

type: float

--

*`kafka.producer.record_size_avg`*::
+
--
The average record size

type: float

--

*`kafka.producer.record_size_max`*::
+
--
The maximum record size

type: long

--

*`kafka.producer.request_rate`*::
+
--
The number of producer requests per second

type: float

--

*`kafka.producer.response_rate`*::
+
--
The number of producer responses per second

type: float

--

*`kafka.producer.io_wait`*::
+
--
The producer I/O wait time

type: float

--

*`kafka.producer.out.bytes_per_sec`*::
+
--
The rate of bytes going out for the producer

type: float

--

*`kafka.producer.message_rate`*::
+
--
The producer message rate

type: float

--

[[exported-fields-kibana]]
== Kibana fields

Kibana module



[float]
=== kibana




[float]
=== stats

Kibana stats and run-time metrics.



*`kibana.stats.uuid`*::
+
--
Kibana instance UUID


type: alias

alias to: service.id

--

*`kibana.stats.name`*::
+
--
Kibana instance name


type: keyword

--

*`kibana.stats.index`*::
+
--
Name of Kibana's internal index


type: keyword

--

*`kibana.stats.host.name`*::
+
--
Kibana instance hostname


type: keyword

--

*`kibana.stats.transport_address`*::
+
--
Kibana server's hostname and port


type: alias

alias to: service.address

--

*`kibana.stats.version`*::
+
--
Kibana version


type: alias

alias to: service.version

--

*`kibana.stats.snapshot`*::
+
--
Whether the Kibana build is a snapshot build


type: boolean

--

*`kibana.stats.status`*::
+
--
Kibana instance's health status


type: keyword

--

*`kibana.stats.concurrent_connections`*::
+
--
Number of client connections made to the server. Note that browsers can send multiple simultaneous connections to request multiple server assets at once, and they can re-use established connections.


type: long

--

[float]
=== process

Process metrics



*`kibana.stats.process.event_loop_delay.ms`*::
+
--
Event loop delay in milliseconds


type: scaled_float

--

[float]
=== memory.heap

Process heap metrics



*`kibana.stats.process.memory.heap.total.bytes`*::
+
--
Total heap allocated to process in bytes


type: long

format: bytes

--

*`kibana.stats.process.memory.heap.used.bytes`*::
+
--
Heap used by process in bytes


type: long

format: bytes

--

*`kibana.stats.process.memory.heap.size_limit.bytes`*::
+
--
Max. old space size allocated to Node.js process, in bytes


type: long

format: bytes

--

*`kibana.stats.process.memory.heap.uptime.ms`*::
+
--
Uptime of process in milliseconds


type: long

--

[float]
=== request

Request count metrics



*`kibana.stats.request.disconnects`*::
+
--
Number of requests that were disconnected


type: long

--

*`kibana.stats.request.total`*::
+
--
Total number of requests


type: long

--

[float]
=== response_time

Response times metrics



*`kibana.stats.response_time.avg.ms`*::
+
--
Average response time in milliseconds


type: long

--

*`kibana.stats.response_time.max.ms`*::
+
--
Maximum response time in milliseconds


type: long

--

[float]
=== status

Status fields



*`kibana.status.name`*::
+
--
Kibana instance name.


type: keyword

--

*`kibana.status.uuid`*::
+
--
Kibana instance uuid.


type: alias

alias to: service.id

--

*`kibana.status.version.number`*::
+
--
Kibana version number.


type: alias

alias to: service.version

--

*`kibana.status.status.overall.state`*::
+
--
Kibana overall state.


type: keyword

--

[float]
=== metrics

Metrics fields



*`kibana.status.metrics.concurrent_connections`*::
+
--
Current concurrent connections.


type: long

--

[float]
=== requests

Request statistics.



*`kibana.status.metrics.requests.disconnects`*::
+
--
Total number of disconnected connections.


type: long

--

*`kibana.status.metrics.requests.total`*::
+
--
Total number of connections.


type: long

--

[[exported-fields-kubernetes-processor]]
== Kubernetes fields

Kubernetes metadata added by the kubernetes processor




*`kubernetes.pod.name`*::
+
--
Kubernetes pod name


type: keyword

--

*`kubernetes.pod.uid`*::
+
--
Kubernetes Pod UID


type: keyword

--

*`kubernetes.pod.ip`*::
+
--
Kubernetes Pod IP


type: ip

--

*`kubernetes.namespace`*::
+
--
Kubernetes namespace


type: keyword

--

*`kubernetes.node.name`*::
+
--
Kubernetes node name


type: keyword

--

*`kubernetes.node.hostname`*::
+
--
Kubernetes hostname as reported by the node’s kernel


type: keyword

--

*`kubernetes.labels.*`*::
+
--
Kubernetes labels map


type: object

--

*`kubernetes.annotations.*`*::
+
--
Kubernetes annotations map


type: object

--

*`kubernetes.selectors.*`*::
+
--
Kubernetes selectors map


type: object

--

*`kubernetes.replicaset.name`*::
+
--
Kubernetes replicaset name


type: keyword

--

*`kubernetes.deployment.name`*::
+
--
Kubernetes deployment name


type: keyword

--

*`kubernetes.statefulset.name`*::
+
--
Kubernetes statefulset name


type: keyword

--

*`kubernetes.container.name`*::
+
--
Kubernetes container name (different than the name from the runtime)


type: keyword

--

*`kubernetes.container.image`*::
+
--
Kubernetes container image


type: alias

alias to: container.image.name

--

[[exported-fields-kubernetes]]
== Kubernetes fields

Kubernetes metrics



[float]
=== kubernetes

Information and statistics of pods managed by kubernetes.



[float]
=== apiserver

Kubernetes API server metrics



*`kubernetes.apiserver.request.client`*::
+
--
Client executing requests


type: keyword

--

*`kubernetes.apiserver.request.resource`*::
+
--
Requested resource


type: keyword

--

*`kubernetes.apiserver.request.subresource`*::
+
--
Requested subresource


type: keyword

--

*`kubernetes.apiserver.request.scope`*::
+
--
Request scope (cluster, namespace, resource)


type: keyword

--

*`kubernetes.apiserver.request.verb`*::
+
--
HTTP verb


type: keyword

--

*`kubernetes.apiserver.request.code`*::
+
--
HTTP code


type: keyword

--

*`kubernetes.apiserver.request.content_type`*::
+
--
Request HTTP content type


type: keyword

--

*`kubernetes.apiserver.request.dry_run`*::
+
--
Wether the request uses dry run


type: keyword

--

*`kubernetes.apiserver.request.kind`*::
+
--
Kind of request


type: keyword

--

*`kubernetes.apiserver.request.component`*::
+
--
Component handling the request


type: keyword

--

*`kubernetes.apiserver.request.group`*::
+
--
API group for the resource


type: keyword

--

*`kubernetes.apiserver.request.version`*::
+
--
version for the group


type: keyword

--

*`kubernetes.apiserver.request.handler`*::
+
--
Request handler


type: keyword

--

*`kubernetes.apiserver.request.method`*::
+
--
HTTP method


type: keyword

--

*`kubernetes.apiserver.request.host`*::
+
--
Request host


type: keyword

--


*`kubernetes.apiserver.process.cpu.sec`*::
+
--
CPU seconds

type: double

--

*`kubernetes.apiserver.process.memory.resident.bytes`*::
+
--
Bytes in resident memory

type: long

format: bytes

--

*`kubernetes.apiserver.process.memory.virtual.bytes`*::
+
--
Bytes in virtual memory

type: long

format: bytes

--

*`kubernetes.apiserver.process.fds.open.count`*::
+
--
Number of open file descriptors

type: long

--

*`kubernetes.apiserver.process.started.sec`*::
+
--
Seconds since the process started

type: double

--


*`kubernetes.apiserver.http.request.duration.us.percentile.*`*::
+
--
Request duration microseconds percentiles

type: object

--

*`kubernetes.apiserver.http.request.duration.us.sum`*::
+
--
Request duration microseconds cumulative sum

type: double

--

*`kubernetes.apiserver.http.request.duration.us.count`*::
+
--
Request count for duration

type: long

--

*`kubernetes.apiserver.http.request.size.bytes.percentile.*`*::
+
--
Request size percentiles

type: object

--

*`kubernetes.apiserver.http.request.size.bytes.sum`*::
+
--
Request size cumulative sum

type: long

format: bytes

--

*`kubernetes.apiserver.http.request.size.bytes.count`*::
+
--
Request count for size

type: long

--

*`kubernetes.apiserver.http.response.size.bytes.percentile.*`*::
+
--
Response size percentiles

type: object

--

*`kubernetes.apiserver.http.response.size.bytes.sum`*::
+
--
Response size cumulative sum

type: long

format: bytes

--

*`kubernetes.apiserver.http.response.size.bytes.count`*::
+
--
Response count

type: long

--

*`kubernetes.apiserver.http.request.count`*::
+
--
Request count for response

type: long

--

*`kubernetes.apiserver.client.request.count`*::
+
--
Number of requests as client

type: long

--


*`kubernetes.apiserver.request.count`*::
+
--
Number of requests

type: long

--

*`kubernetes.apiserver.request.latency.sum`*::
+
--
Requests latency, sum of latencies in microseconds

type: long

--

*`kubernetes.apiserver.request.latency.count`*::
+
--
Request latency, number of requests

type: long

--

*`kubernetes.apiserver.request.latency.bucket.*`*::
+
--
Request latency histogram buckets

type: object

--

*`kubernetes.apiserver.request.duration.us.sum`*::
+
--
Request duration, sum in microseconds

type: long

--

*`kubernetes.apiserver.request.duration.us.count`*::
+
--
Request duration, number of operations

type: long

--

*`kubernetes.apiserver.request.duration.us.bucket.*`*::
+
--
Request duration, histogram buckets

type: object

--

*`kubernetes.apiserver.request.current.count`*::
+
--
Inflight requests

type: long

--

*`kubernetes.apiserver.request.longrunning.count`*::
+
--
Number of requests active long running requests

type: long

--

*`kubernetes.apiserver.etcd.object.count`*::
+
--
Number of kubernetes objects at etcd

type: long

--

*`kubernetes.apiserver.audit.event.count`*::
+
--
Number of audit events

type: long

--

*`kubernetes.apiserver.audit.rejected.count`*::
+
--
Number of audit rejected events

type: long

--

[float]
=== container

kubernetes container metrics



*`kubernetes.container.start_time`*::
+
--
Start time


type: date

--

[float]
=== cpu

CPU usage metrics





*`kubernetes.container.cpu.usage.core.ns`*::
+
--
Container CPU Core usage nanoseconds


type: double

--

*`kubernetes.container.cpu.usage.nanocores`*::
+
--
CPU used nanocores


type: double

--

*`kubernetes.container.cpu.usage.node.pct`*::
+
--
CPU usage as a percentage of the total node allocatable CPU


type: scaled_float

format: percent

--

*`kubernetes.container.cpu.usage.limit.pct`*::
+
--
CPU usage as a percentage of the defined limit for the container (or total node allocatable CPU if unlimited)


type: scaled_float

format: percent

--

[float]
=== logs

Logs info




*`kubernetes.container.logs.available.bytes`*::
+
--
Logs available capacity in bytes


type: double

format: bytes

--


*`kubernetes.container.logs.capacity.bytes`*::
+
--
Logs total capacity in bytes


type: double

format: bytes

--


*`kubernetes.container.logs.used.bytes`*::
+
--
Logs used capacity in bytes


type: double

format: bytes

--


*`kubernetes.container.logs.inodes.count`*::
+
--
Total available inodes


type: double

--

*`kubernetes.container.logs.inodes.free`*::
+
--
Total free inodes


type: double

--

*`kubernetes.container.logs.inodes.used`*::
+
--
Total used inodes


type: double

--



*`kubernetes.container.memory.available.bytes`*::
+
--
Total available memory


type: double

format: bytes

--


*`kubernetes.container.memory.usage.bytes`*::
+
--
Total memory usage


type: double

format: bytes

--

*`kubernetes.container.memory.usage.node.pct`*::
+
--
Memory usage as a percentage of the total node allocatable memory


type: scaled_float

format: percent

--

*`kubernetes.container.memory.usage.limit.pct`*::
+
--
Memory usage as a percentage of the defined limit for the container (or total node allocatable memory if unlimited)


type: scaled_float

format: percent

--


*`kubernetes.container.memory.rss.bytes`*::
+
--
RSS memory usage


type: double

format: bytes

--


*`kubernetes.container.memory.workingset.bytes`*::
+
--
Working set memory usage


type: double

format: bytes

--

*`kubernetes.container.memory.pagefaults`*::
+
--
Number of page faults


type: double

--

*`kubernetes.container.memory.majorpagefaults`*::
+
--
Number of major page faults


type: double

--



*`kubernetes.container.rootfs.capacity.bytes`*::
+
--
Root filesystem total capacity in bytes


type: double

format: bytes

--


*`kubernetes.container.rootfs.available.bytes`*::
+
--
Root filesystem total available in bytes


type: double

format: bytes

--


*`kubernetes.container.rootfs.used.bytes`*::
+
--
Root filesystem total used in bytes


type: double

format: bytes

--


*`kubernetes.container.rootfs.inodes.used`*::
+
--
Used inodes


type: double

--

[float]
=== controllermanager

Controller manager metrics



*`kubernetes.controllermanager.handler`*::
+
--
Request handler


type: keyword

--

*`kubernetes.controllermanager.code`*::
+
--
HTTP code


type: keyword

--

*`kubernetes.controllermanager.method`*::
+
--
HTTP method


type: keyword

--

*`kubernetes.controllermanager.host`*::
+
--
Request host


type: keyword

--

*`kubernetes.controllermanager.name`*::
+
--
Name for the resource


type: keyword

--

*`kubernetes.controllermanager.zone`*::
+
--
Infrastructure zone


type: keyword

--


*`kubernetes.controllermanager.process.cpu.sec`*::
+
--
CPU seconds

type: double

--

*`kubernetes.controllermanager.process.memory.resident.bytes`*::
+
--
Bytes in resident memory

type: long

format: bytes

--

*`kubernetes.controllermanager.process.memory.virtual.bytes`*::
+
--
Bytes in virtual memory

type: long

format: bytes

--

*`kubernetes.controllermanager.process.fds.open.count`*::
+
--
Number of open file descriptors

type: long

--

*`kubernetes.controllermanager.process.started.sec`*::
+
--
Seconds since the process started

type: double

--


*`kubernetes.controllermanager.http.request.duration.us.percentile.*`*::
+
--
Request duration microseconds percentiles

type: object

--

*`kubernetes.controllermanager.http.request.duration.us.sum`*::
+
--
Request duration microseconds cumulative sum

type: double

--

*`kubernetes.controllermanager.http.request.duration.us.count`*::
+
--
Request count for duration

type: long

--

*`kubernetes.controllermanager.http.request.size.bytes.percentile.*`*::
+
--
Request size percentiles

type: object

--

*`kubernetes.controllermanager.http.request.size.bytes.sum`*::
+
--
Request size cumulative sum

type: long

format: bytes

--

*`kubernetes.controllermanager.http.request.size.bytes.count`*::
+
--
Request count for size

type: long

--

*`kubernetes.controllermanager.http.response.size.bytes.percentile.*`*::
+
--
Response size percentiles

type: object

--

*`kubernetes.controllermanager.http.response.size.bytes.sum`*::
+
--
Response size cumulative sum

type: long

format: bytes

--

*`kubernetes.controllermanager.http.response.size.bytes.count`*::
+
--
Response count

type: long

--

*`kubernetes.controllermanager.http.request.count`*::
+
--
Request count for response

type: long

--

*`kubernetes.controllermanager.client.request.count`*::
+
--
Number of requests as client


type: long

--


*`kubernetes.controllermanager.workqueue.longestrunning.sec`*::
+
--
Longest running processors

type: double

--

*`kubernetes.controllermanager.workqueue.unfinished.sec`*::
+
--
Unfinished processors

type: double

--

*`kubernetes.controllermanager.workqueue.adds.count`*::
+
--
Workqueue add count

type: long

--

*`kubernetes.controllermanager.workqueue.depth.count`*::
+
--
Workqueue depth count

type: long

--

*`kubernetes.controllermanager.workqueue.retries.count`*::
+
--
Workqueue number of retries

type: long

--


*`kubernetes.controllermanager.node.collector.eviction.count`*::
+
--
Number of node evictions

type: long

--

*`kubernetes.controllermanager.node.collector.unhealthy.count`*::
+
--
Number of unhealthy nodes

type: long

--

*`kubernetes.controllermanager.node.collector.count`*::
+
--
Number of nodes

type: long

--

*`kubernetes.controllermanager.node.collector.health.pct`*::
+
--
Percentage of healthy nodes

type: long

--

*`kubernetes.controllermanager.leader.is_master`*::
+
--
Whether the node is master


type: boolean

--

[float]
=== event

The Kubernetes events metricset collects events that are generated by objects running inside of Kubernetes



*`kubernetes.event.count`*::
+
--
Count field records the number of times the particular event has occurred


type: long

--


*`kubernetes.event.timestamp.first_occurrence`*::
+
--
Timestamp of first occurrence of event


type: date

--

*`kubernetes.event.timestamp.last_occurrence`*::
+
--
Timestamp of last occurrence of event


type: date

--

*`kubernetes.event.message`*::
+
--
Message recorded for the given event


type: text

--

*`kubernetes.event.reason`*::
+
--
Reason recorded for the given event


type: keyword

--

*`kubernetes.event.type`*::
+
--
Type of the given event


type: keyword

--

[float]
=== source

The component reporting this event



*`kubernetes.event.source.component`*::
+
--
Component from which the event is generated


type: keyword

--

*`kubernetes.event.source.host`*::
+
--
Node name on which the event is generated


type: keyword

--

[float]
=== metadata

Metadata associated with the given event




*`kubernetes.event.metadata.timestamp.created`*::
+
--
Timestamp of creation of the given event


type: date

--

*`kubernetes.event.metadata.generate_name`*::
+
--
Generate name of the event


type: keyword

--

*`kubernetes.event.metadata.name`*::
+
--
Name of the event


type: keyword

--

*`kubernetes.event.metadata.namespace`*::
+
--
Namespace in which event was generated


type: keyword

--

*`kubernetes.event.metadata.resource_version`*::
+
--
Version of the event resource


type: keyword

--

*`kubernetes.event.metadata.uid`*::
+
--
Unique identifier to the event object


type: keyword

--

*`kubernetes.event.metadata.self_link`*::
+
--
URL representing the event


type: keyword

--

[float]
=== involved_object

Metadata associated with the given involved object



*`kubernetes.event.involved_object.api_version`*::
+
--
API version of the object


type: keyword

--

*`kubernetes.event.involved_object.kind`*::
+
--
API kind of the object


type: keyword

--

*`kubernetes.event.involved_object.name`*::
+
--
name of the object


type: keyword

--

*`kubernetes.event.involved_object.resource_version`*::
+
--
resource version of the object


type: keyword

--

*`kubernetes.event.involved_object.uid`*::
+
--
UUID version of the object


type: keyword

--

[float]
=== node

kubernetes node metrics



*`kubernetes.node.start_time`*::
+
--
Start time


type: date

--

[float]
=== cpu

CPU usage metrics





*`kubernetes.node.cpu.usage.core.ns`*::
+
--
Node CPU Core usage nanoseconds


type: double

--

*`kubernetes.node.cpu.usage.nanocores`*::
+
--
CPU used nanocores


type: double

--



*`kubernetes.node.memory.available.bytes`*::
+
--
Total available memory


type: double

format: bytes

--


*`kubernetes.node.memory.usage.bytes`*::
+
--
Total memory usage


type: double

format: bytes

--


*`kubernetes.node.memory.rss.bytes`*::
+
--
RSS memory usage


type: double

format: bytes

--


*`kubernetes.node.memory.workingset.bytes`*::
+
--
Working set memory usage


type: double

format: bytes

--

*`kubernetes.node.memory.pagefaults`*::
+
--
Number of page faults


type: double

--

*`kubernetes.node.memory.majorpagefaults`*::
+
--
Number of major page faults


type: double

--



*`kubernetes.node.network.rx.bytes`*::
+
--
Received bytes on the default interface. If default interface is not defined, will be reported not correct value `0`


type: double

format: bytes

--

*`kubernetes.node.network.rx.errors`*::
+
--
Rx errors on the default interface. If default interface is not defined, will be reported not correct value `0`


type: double

--


*`kubernetes.node.network.tx.bytes`*::
+
--
Transmitted bytes on the default interface. If default interface is not defined, will be reported not correct value `0`


type: double

format: bytes

--

*`kubernetes.node.network.tx.errors`*::
+
--
Tx errors on the default interface. If default interface is not defined, will be reported not correct value `0`


type: double

--



*`kubernetes.node.fs.capacity.bytes`*::
+
--
Filesystem total capacity in bytes


type: double

format: bytes

--


*`kubernetes.node.fs.available.bytes`*::
+
--
Filesystem total available in bytes


type: double

format: bytes

--


*`kubernetes.node.fs.used.bytes`*::
+
--
Filesystem total used in bytes


type: double

format: bytes

--


*`kubernetes.node.fs.inodes.used`*::
+
--
Number of used inodes


type: double

--

*`kubernetes.node.fs.inodes.count`*::
+
--
Number of inodes


type: double

--

*`kubernetes.node.fs.inodes.free`*::
+
--
Number of free inodes


type: double

--




*`kubernetes.node.runtime.imagefs.capacity.bytes`*::
+
--
Image filesystem total capacity in bytes


type: double

format: bytes

--


*`kubernetes.node.runtime.imagefs.available.bytes`*::
+
--
Image filesystem total available in bytes


type: double

format: bytes

--


*`kubernetes.node.runtime.imagefs.used.bytes`*::
+
--
Image filesystem total used in bytes


type: double

format: bytes

--

[float]
=== pod

kubernetes pod metrics



*`kubernetes.pod.start_time`*::
+
--
Start time


type: date

--



*`kubernetes.pod.network.rx.bytes`*::
+
--
Received bytes


type: double

format: bytes

--

*`kubernetes.pod.network.rx.errors`*::
+
--
Rx errors


type: double

--


*`kubernetes.pod.network.tx.bytes`*::
+
--
Transmitted bytes


type: double

format: bytes

--

*`kubernetes.pod.network.tx.errors`*::
+
--
Tx errors


type: double

--

[float]
=== cpu

CPU usage metrics




*`kubernetes.pod.cpu.usage.nanocores`*::
+
--
CPU used nanocores


type: double

--

*`kubernetes.pod.cpu.usage.node.pct`*::
+
--
CPU usage as a percentage of the total node CPU


type: scaled_float

format: percent

--

*`kubernetes.pod.cpu.usage.limit.pct`*::
+
--
CPU usage as a percentage of the defined limit for the pod containers (or total node CPU if one or more containers of the pod are unlimited)


type: scaled_float

format: percent

--



*`kubernetes.pod.memory.usage.bytes`*::
+
--
Total memory usage


type: double

format: bytes

--

*`kubernetes.pod.memory.usage.node.pct`*::
+
--
Memory usage as a percentage of the total node allocatable memory


type: scaled_float

format: percent

--

*`kubernetes.pod.memory.usage.limit.pct`*::
+
--
Memory usage as a percentage of the defined limit for the pod containers (or total node allocatable memory if unlimited)


type: scaled_float

format: percent

--


*`kubernetes.pod.memory.available.bytes`*::
+
--
Total memory available


type: double

format: bytes

--


*`kubernetes.pod.memory.working_set.bytes`*::
+
--
Total working set memory


type: double

format: bytes

--


*`kubernetes.pod.memory.rss.bytes`*::
+
--
Total resident set size memory


type: double

format: bytes

--

*`kubernetes.pod.memory.page_faults`*::
+
--
Total page faults


type: double

--

*`kubernetes.pod.memory.major_page_faults`*::
+
--
Total major page faults


type: double

--

[float]
=== proxy

Kubernetes proxy server metrics



*`kubernetes.proxy.handler`*::
+
--
Request handler


type: keyword

--

*`kubernetes.proxy.code`*::
+
--
HTTP code


type: keyword

--

*`kubernetes.proxy.method`*::
+
--
HTTP method


type: keyword

--

*`kubernetes.proxy.host`*::
+
--
Request host


type: keyword

--


*`kubernetes.proxy.process.cpu.sec`*::
+
--
CPU seconds

type: double

--

*`kubernetes.proxy.process.memory.resident.bytes`*::
+
--
Bytes in resident memory

type: long

format: bytes

--

*`kubernetes.proxy.process.memory.virtual.bytes`*::
+
--
Bytes in virtual memory

type: long

format: bytes

--

*`kubernetes.proxy.process.fds.open.count`*::
+
--
Number of open file descriptors

type: long

--

*`kubernetes.proxy.process.started.sec`*::
+
--
Seconds since the process started

type: double

--


*`kubernetes.proxy.http.request.duration.us.percentile.*`*::
+
--
Request duration microseconds percentiles

type: object

--

*`kubernetes.proxy.http.request.duration.us.sum`*::
+
--
Request duration microseconds cumulative sum

type: double

--

*`kubernetes.proxy.http.request.duration.us.count`*::
+
--
Request count for duration

type: long

--

*`kubernetes.proxy.http.request.size.bytes.percentile.*`*::
+
--
Request size percentiles

type: object

--

*`kubernetes.proxy.http.request.size.bytes.sum`*::
+
--
Request size cumulative sum

type: long

format: bytes

--

*`kubernetes.proxy.http.request.size.bytes.count`*::
+
--
Request count for size

type: long

--

*`kubernetes.proxy.http.response.size.bytes.percentile.*`*::
+
--
Response size percentiles

type: object

--

*`kubernetes.proxy.http.response.size.bytes.sum`*::
+
--
Response size cumulative sum

type: long

format: bytes

--

*`kubernetes.proxy.http.response.size.bytes.count`*::
+
--
Response count

type: long

--

*`kubernetes.proxy.http.request.count`*::
+
--
Request count

type: long

--

*`kubernetes.proxy.client.request.count`*::
+
--
Number of requests as client


type: long

--

[float]
=== sync

kubeproxy proxy sync metrics



*`kubernetes.proxy.sync.rules.duration.us.sum`*::
+
--
SyncProxyRules duration, sum of durations in microseconds

type: long

--

*`kubernetes.proxy.sync.rules.duration.us.count`*::
+
--
SyncProxyRules duration, number of operations

type: long

--

*`kubernetes.proxy.sync.rules.duration.us.bucket.*`*::
+
--
SyncProxyRules duration, histogram buckets

type: object

--

*`kubernetes.proxy.sync.networkprogramming.duration.us.sum`*::
+
--
Network programming duration, sum in microseconds

type: long

--

*`kubernetes.proxy.sync.networkprogramming.duration.us.count`*::
+
--
Network programming duration, number of operations

type: long

--

*`kubernetes.proxy.sync.networkprogramming.duration.us.bucket.*`*::
+
--
Network programming duration, histogram buckets

type: object

--

[float]
=== scheduler

Kubernetes scheduler metrics



*`kubernetes.scheduler.handler`*::
+
--
Request handler


type: keyword

--

*`kubernetes.scheduler.code`*::
+
--
HTTP code


type: keyword

--

*`kubernetes.scheduler.method`*::
+
--
HTTP method


type: keyword

--

*`kubernetes.scheduler.host`*::
+
--
Request host


type: keyword

--

*`kubernetes.scheduler.name`*::
+
--
Name for the resource


type: keyword

--

*`kubernetes.scheduler.result`*::
+
--
Schedule attempt result


type: keyword

--

*`kubernetes.scheduler.operation`*::
+
--
Scheduling operation


type: keyword

--


*`kubernetes.scheduler.process.cpu.sec`*::
+
--
CPU seconds

type: double

--

*`kubernetes.scheduler.process.memory.resident.bytes`*::
+
--
Bytes in resident memory

type: long

format: bytes

--

*`kubernetes.scheduler.process.memory.virtual.bytes`*::
+
--
Bytes in virtual memory

type: long

format: bytes

--

*`kubernetes.scheduler.process.fds.open.count`*::
+
--
Number of open file descriptors

type: long

--

*`kubernetes.scheduler.process.started.sec`*::
+
--
Seconds since the process started

type: double

--


*`kubernetes.scheduler.http.request.duration.us.percentile.*`*::
+
--
Request duration microseconds percentiles

type: object

--

*`kubernetes.scheduler.http.request.duration.us.sum`*::
+
--
Request duration microseconds cumulative sum

type: double

--

*`kubernetes.scheduler.http.request.duration.us.count`*::
+
--
Request count for duration

type: long

--

*`kubernetes.scheduler.http.request.size.bytes.percentile.*`*::
+
--
Request size percentiles

type: object

--

*`kubernetes.scheduler.http.request.size.bytes.sum`*::
+
--
Request size cumulative sum

type: long

format: bytes

--

*`kubernetes.scheduler.http.request.size.bytes.count`*::
+
--
Request count for size

type: long

--

*`kubernetes.scheduler.http.response.size.bytes.percentile.*`*::
+
--
Response size percentiles

type: object

--

*`kubernetes.scheduler.http.response.size.bytes.sum`*::
+
--
Response size cumulative sum

type: long

format: bytes

--

*`kubernetes.scheduler.http.response.size.bytes.count`*::
+
--
Response count

type: long

--

*`kubernetes.scheduler.http.request.count`*::
+
--
Request count

type: long

--

*`kubernetes.scheduler.client.request.count`*::
+
--
Number of requests as client


type: long

--

*`kubernetes.scheduler.leader.is_master`*::
+
--
Whether the node is master


type: boolean

--


*`kubernetes.scheduler.scheduling.e2e.duration.us.bucket.*`*::
+
--
End to end scheduling duration microseconds

type: object

--

*`kubernetes.scheduler.scheduling.e2e.duration.us.sum`*::
+
--
End to end scheduling duration microseconds sum

type: long

--

*`kubernetes.scheduler.scheduling.e2e.duration.us.count`*::
+
--
End to end scheduling count

type: long

--

*`kubernetes.scheduler.scheduling.pod.preemption.victims.bucket.*`*::
+
--
Pod preemption victims

type: long

--

*`kubernetes.scheduler.scheduling.pod.preemption.victims.sum`*::
+
--
Pod preemption victims sum

type: long

--

*`kubernetes.scheduler.scheduling.pod.preemption.victims.count`*::
+
--
Pod preemption victims count

type: long

--

*`kubernetes.scheduler.scheduling.pod.attempts.count`*::
+
--
Pod attempts count

type: long

--

*`kubernetes.scheduler.scheduling.duration.seconds.percentile.*`*::
+
--
Scheduling duration percentiles

type: object

--

*`kubernetes.scheduler.scheduling.duration.seconds.sum`*::
+
--
Scheduling duration cumulative sum

type: double

--

*`kubernetes.scheduler.scheduling.duration.seconds.count`*::
+
--
Scheduling count

type: long

--

[float]
=== container

kubernetes container metrics



*`kubernetes.container.id`*::
+
--
Container id

type: keyword

--


*`kubernetes.container.status.phase`*::
+
--
Container phase (running, waiting, terminated)


type: keyword

--

*`kubernetes.container.status.ready`*::
+
--
Container ready status


type: boolean

--

*`kubernetes.container.status.restarts`*::
+
--
Container restarts count


type: integer

--

*`kubernetes.container.status.reason`*::
+
--
Waiting (ContainerCreating, CrashLoopBackoff, ErrImagePull, ImagePullBackoff) or termination (Completed, ContainerCannotRun, Error, OOMKilled) reason.


type: keyword

--


*`kubernetes.container.cpu.limit.cores`*::
+
--
Container CPU cores limit


type: float

--

*`kubernetes.container.cpu.request.cores`*::
+
--
Container CPU requested cores


type: float

--

*`kubernetes.container.cpu.limit.nanocores`*::
+
--

deprecated:[6.4]

Container CPU nanocores limit


type: long

--

*`kubernetes.container.cpu.request.nanocores`*::
+
--

deprecated:[6.4]

Container CPU requested nanocores


type: long

--


*`kubernetes.container.memory.limit.bytes`*::
+
--
Container memory limit in bytes


type: long

format: bytes

--

*`kubernetes.container.memory.request.bytes`*::
+
--
Container requested memory in bytes


type: long

format: bytes

--

[float]
=== cronjob

kubernetes cronjob metrics



*`kubernetes.cronjob.name`*::
+
--
Cronjob name

type: keyword

--

*`kubernetes.cronjob.schedule`*::
+
--
Cronjob schedule

type: keyword

--

*`kubernetes.cronjob.concurrency`*::
+
--
Concurrency policy

type: keyword

--

*`kubernetes.cronjob.active.count`*::
+
--
Number of active pods for the cronjob

type: long

--

*`kubernetes.cronjob.is_suspended`*::
+
--
Whether the cronjob is suspended

type: boolean

--

*`kubernetes.cronjob.created.sec`*::
+
--
Epoch seconds since the cronjob was created

type: double

--

*`kubernetes.cronjob.last_schedule.sec`*::
+
--
Epoch seconds for last cronjob run

type: double

--

*`kubernetes.cronjob.next_schedule.sec`*::
+
--
Epoch seconds for next cronjob run

type: double

--

*`kubernetes.cronjob.deadline.sec`*::
+
--
Deadline seconds after schedule for considering failed

type: long

--

[float]
=== daemonset

Kubernetes DaemonSet metrics



*`kubernetes.daemonset.name`*::
+
--
type: keyword

--

[float]
=== replicas

Kubernetes DaemonSet replica metrics



*`kubernetes.daemonset.replicas.available`*::
+
--
The number of available replicas per DaemonSet


type: long

--

*`kubernetes.daemonset.replicas.desired`*::
+
--
The desired number of replicas per DaemonSet


type: long

--

*`kubernetes.daemonset.replicas.ready`*::
+
--
The number of ready replicas per DaemonSet


type: long

--

*`kubernetes.daemonset.replicas.unavailable`*::
+
--
The number of unavailable replicas per DaemonSet


type: long

--

[float]
=== deployment

kubernetes deployment metrics



*`kubernetes.deployment.paused`*::
+
--
Kubernetes deployment paused status


type: boolean

--

[float]
=== replicas

Kubernetes deployment replicas info



*`kubernetes.deployment.replicas.desired`*::
+
--
Deployment number of desired replicas (spec)


type: integer

--

*`kubernetes.deployment.replicas.available`*::
+
--
Deployment available replicas


type: integer

--

*`kubernetes.deployment.replicas.unavailable`*::
+
--
Deployment unavailable replicas


type: integer

--

*`kubernetes.deployment.replicas.updated`*::
+
--
Deployment updated replicas


type: integer

--

[float]
=== job

Kubernetes job metrics



*`kubernetes.job.name`*::
+
--
The name of the job resource


type: keyword

--

[float]
=== pods

Pod metrics for the job



*`kubernetes.job.pods.active`*::
+
--
Number of active pods


type: long

--

*`kubernetes.job.pods.failed`*::
+
--
Number of failed pods


type: long

--

*`kubernetes.job.pods.succeeded`*::
+
--
Number of successful pods


type: long

--

[float]
=== time

Kubernetes job timestamps



*`kubernetes.job.time.created`*::
+
--
The time at which the job was created


type: date

--

*`kubernetes.job.time.completed`*::
+
--
The time at which the job completed


type: date

--

[float]
=== completions

Kubernetes job completion settings



*`kubernetes.job.completions.desired`*::
+
--
The configured completion count for the job (Spec)


type: long

--

[float]
=== parallelism

Kubernetes job parallelism settings



*`kubernetes.job.parallelism.desired`*::
+
--
The configured parallelism of the job (Spec)


type: long

--

[float]
=== owner

Kubernetes job owner information



*`kubernetes.job.owner.name`*::
+
--
The name of the resource that owns this job


type: keyword

--

*`kubernetes.job.owner.kind`*::
+
--
The kind of resource that owns this job (eg. "CronJob")


type: keyword

--

*`kubernetes.job.owner.is_controller`*::
+
--
Owner is controller ("true", "false", or "<none>")


type: keyword

--

[float]
=== status

Kubernetes job status information



*`kubernetes.job.status.complete`*::
+
--
Whether the job completed ("true", "false", or "unknown")


type: keyword

--

*`kubernetes.job.status.failed`*::
+
--
Whether the job failed ("true", "false", or "unknown")


type: keyword

--

[float]
=== node

kubernetes node metrics




*`kubernetes.node.status.ready`*::
+
--
Node ready status (true, false or unknown)


type: keyword

--

*`kubernetes.node.status.unschedulable`*::
+
--
Node unschedulable status


type: boolean

--

*`kubernetes.node.status.memory_pressure`*::
+
--
Node MemoryPressure status (true, false or unknown)


type: keyword

--

*`kubernetes.node.status.disk_pressure`*::
+
--
Node DiskPressure status (true, false or unknown)


type: keyword

--

*`kubernetes.node.status.out_of_disk`*::
+
--
Node OutOfDisk status (true, false or unknown)


type: keyword

--

*`kubernetes.node.status.pid_pressure`*::
+
--
Node PIDPressure status (true, false or unknown)


type: keyword

--


*`kubernetes.node.cpu.allocatable.cores`*::
+
--
Node CPU allocatable cores


type: float

--

*`kubernetes.node.cpu.capacity.cores`*::
+
--
Node CPU capacity cores


type: long

--


*`kubernetes.node.memory.allocatable.bytes`*::
+
--
Node allocatable memory in bytes


type: long

format: bytes

--

*`kubernetes.node.memory.capacity.bytes`*::
+
--
Node memory capacity in bytes


type: long

format: bytes

--


*`kubernetes.node.pod.allocatable.total`*::
+
--
Node allocatable pods


type: long

--

*`kubernetes.node.pod.capacity.total`*::
+
--
Node pod capacity


type: long

--

[float]
=== persistentvolume

kubernetes persistent volume metrics from kube-state-metrics



*`kubernetes.persistentvolume.name`*::
+
--
Volume name.

type: keyword

--

*`kubernetes.persistentvolume.capacity.bytes`*::
+
--
Volume capacity

type: long

--

*`kubernetes.persistentvolume.phase`*::
+
--
Volume phase according to kubernetes

type: keyword

--

*`kubernetes.persistentvolume.storage_class`*::
+
--
Storage class for the volume

type: keyword

--

[float]
=== persistentvolumeclaim

kubernetes persistent volume clame metrics from kube-state-metrics



*`kubernetes.persistentvolumeclaim.name`*::
+
--
PVC name.

type: keyword

--

*`kubernetes.persistentvolumeclaim.volume_name`*::
+
--
Binded volume name.

type: keyword

--

*`kubernetes.persistentvolumeclaim.request_storage.bytes`*::
+
--
Requested capacity.

type: long

--

*`kubernetes.persistentvolumeclaim.phase`*::
+
--
PVC phase.

type: keyword

--

*`kubernetes.persistentvolumeclaim.access_mode`*::
+
--
Access mode.

type: keyword

--

*`kubernetes.persistentvolumeclaim.storage_class`*::
+
--
Storage class for the PVC.

type: keyword

--

[float]
=== pod

kubernetes pod metrics



*`kubernetes.pod.host_ip`*::
+
--
Kubernetes pod host IP


type: ip

--

[float]
=== status

Kubernetes pod status metrics



*`kubernetes.pod.status.phase`*::
+
--
Kubernetes pod phase (Running, Pending...)


type: keyword

--

*`kubernetes.pod.status.ready`*::
+
--
Kubernetes pod ready status (true, false or unknown)


type: keyword

--

*`kubernetes.pod.status.scheduled`*::
+
--
Kubernetes pod scheduled status (true, false, unknown)


type: keyword

--

[float]
=== replicaset

kubernetes replica set metrics



[float]
=== replicas

Kubernetes replica set paused status



*`kubernetes.replicaset.replicas.available`*::
+
--
The number of replicas per ReplicaSet


type: long

--

*`kubernetes.replicaset.replicas.desired`*::
+
--
The number of replicas per ReplicaSet


type: long

--

*`kubernetes.replicaset.replicas.ready`*::
+
--
The number of ready replicas per ReplicaSet


type: long

--

*`kubernetes.replicaset.replicas.observed`*::
+
--
The generation observed by the ReplicaSet controller


type: long

--

*`kubernetes.replicaset.replicas.labeled`*::
+
--
The number of fully labeled replicas per ReplicaSet


type: long

--

[float]
=== resourcequota

kubernetes resourcequota metrics



*`kubernetes.resourcequota.created.sec`*::
+
--
Epoch seconds since the ResourceQuota was created

type: double

--

*`kubernetes.resourcequota.quota`*::
+
--
Quota informed (hard or used) for the resource

type: double

--

*`kubernetes.resourcequota.name`*::
+
--
ResourceQuota name

type: keyword

--

*`kubernetes.resourcequota.type`*::
+
--
Quota information type, `hard` or `used`

type: keyword

--

*`kubernetes.resourcequota.resource`*::
+
--
Resource name the quota applies to

type: keyword

--

[float]
=== service

kubernetes service metrics



*`kubernetes.service.name`*::
+
--
Service name.

type: keyword

--

*`kubernetes.service.cluster_ip`*::
+
--
Internal IP for the service.

type: keyword

--

*`kubernetes.service.external_name`*::
+
--
Service external DNS name

type: keyword

--

*`kubernetes.service.external_ip`*::
+
--
Service external IP

type: keyword

--

*`kubernetes.service.load_balancer_ip`*::
+
--
Load Balancer service IP

type: keyword

--

*`kubernetes.service.type`*::
+
--
Service type

type: keyword

--

*`kubernetes.service.ingress_ip`*::
+
--
Ingress IP

type: keyword

--

*`kubernetes.service.ingress_hostname`*::
+
--
Ingress Hostname

type: keyword

--

*`kubernetes.service.created`*::
+
--
Service creation date

type: date

--

[float]
=== statefulset

kubernetes stateful set metrics



*`kubernetes.statefulset.created`*::
+
--
The creation timestamp (epoch) for StatefulSet


type: long

--

[float]
=== replicas

Kubernetes stateful set replicas status



*`kubernetes.statefulset.replicas.observed`*::
+
--
The number of observed replicas per StatefulSet


type: long

--

*`kubernetes.statefulset.replicas.desired`*::
+
--
The number of desired replicas per StatefulSet


type: long

--

*`kubernetes.statefulset.replicas.ready`*::
+
--
The number of ready replicas per StatefulSet


type: long

--

[float]
=== generation

Kubernetes stateful set generation information



*`kubernetes.statefulset.generation.observed`*::
+
--
The observed generation per StatefulSet


type: long

--

*`kubernetes.statefulset.generation.desired`*::
+
--
The desired generation per StatefulSet


type: long

--

[float]
=== storageclass

kubernetes storage class metrics



*`kubernetes.storageclass.name`*::
+
--
Storage class name.

type: keyword

--

*`kubernetes.storageclass.provisioner`*::
+
--
Volume provisioner for the storage class.

type: keyword

--

*`kubernetes.storageclass.reclaim_policy`*::
+
--
Reclaim policy for dynamically created volumes

type: keyword

--

*`kubernetes.storageclass.volume_binding_mode`*::
+
--
Mode for default provisioning and binding

type: keyword

--

*`kubernetes.storageclass.created`*::
+
--
Storage class creation date

type: date

--

[float]
=== system

kubernetes system containers metrics



*`kubernetes.system.container`*::
+
--
Container name


type: keyword

--

*`kubernetes.system.start_time`*::
+
--
Start time


type: date

--

[float]
=== cpu

CPU usage metrics





*`kubernetes.system.cpu.usage.core.ns`*::
+
--
CPU Core usage nanoseconds


type: double

--

*`kubernetes.system.cpu.usage.nanocores`*::
+
--
CPU used nanocores


type: double

--



*`kubernetes.system.memory.usage.bytes`*::
+
--
Total memory usage


type: double

format: bytes

--


*`kubernetes.system.memory.rss.bytes`*::
+
--
RSS memory usage


type: double

format: bytes

--


*`kubernetes.system.memory.workingset.bytes`*::
+
--
Working set memory usage


type: double

format: bytes

--

*`kubernetes.system.memory.pagefaults`*::
+
--
Number of page faults


type: double

--

*`kubernetes.system.memory.majorpagefaults`*::
+
--
Number of major page faults


type: double

--

[float]
=== volume

kubernetes volume metrics



*`kubernetes.volume.name`*::
+
--
Volume name


type: keyword

--



*`kubernetes.volume.fs.capacity.bytes`*::
+
--
Filesystem total capacity in bytes


type: double

format: bytes

--


*`kubernetes.volume.fs.available.bytes`*::
+
--
Filesystem total available in bytes


type: double

format: bytes

--


*`kubernetes.volume.fs.used.bytes`*::
+
--
Filesystem total used in bytes


type: double

format: bytes

--

*`kubernetes.volume.fs.used.pct`*::
+
--
Percentage of used storage


type: scaled_float

format: percent

--


*`kubernetes.volume.fs.inodes.used`*::
+
--
Used inodes


type: double

--

*`kubernetes.volume.fs.inodes.free`*::
+
--
Free inodes


type: double

--

*`kubernetes.volume.fs.inodes.count`*::
+
--
Total inodes


type: double

--

[[exported-fields-kvm]]
== KVM fields

kvm module



*`kvm.id`*::
+
--
Domain id


type: long

--

*`kvm.name`*::
+
--
Domain name


type: keyword

--

[float]
=== kvm




[float]
=== dommemstat

dommemstat



[float]
=== stat

Memory stat



*`kvm.dommemstat.stat.name`*::
+
--
Memory stat name


type: keyword

--

*`kvm.dommemstat.stat.value`*::
+
--
Memory stat value


type: long

--

*`kvm.dommemstat.id`*::
+
--
Domain id


type: long

--

*`kvm.dommemstat.name`*::
+
--
Domain name


type: keyword

--

[float]
=== status

status



*`kvm.status.state`*::
+
--
Domain state


type: keyword

--

[[exported-fields-linux]]
== Linux fields

linux module



[float]
=== linux

linux system metrics



[float]
=== conntrack

conntrack



[float]
=== summary

summary of nf_conntrack statistics, summed across CPU cores



*`linux.conntrack.summary.drop`*::
+
--
packets dropped due to conntrack failiure


type: long

--

*`linux.conntrack.summary.early_drop`*::
+
--
conntrack entries dropped to make room for new ones


type: long

--

*`linux.conntrack.summary.entries`*::
+
--
entries in the conntrack table


type: long

--

*`linux.conntrack.summary.found`*::
+
--
successfully searched entries


type: long

--

*`linux.conntrack.summary.ignore`*::
+
--
packets seen already connected to a conntrack entry


type: long

--

*`linux.conntrack.summary.insert_failed`*::
+
--
Number of entries where list insert insert failed 


type: long

--

*`linux.conntrack.summary.invalid`*::
+
--
packets seen that cannot be tracked


type: long

--

*`linux.conntrack.summary.search_restart`*::
+
--
table lookups which had to be restarted due to table resizes


type: long

--

[float]
=== iostat

iostat



*`linux.iostat.read.request.merges_per_sec`*::
+
--
The number of read requests merged per second that were queued to the device.


type: float

--

*`linux.iostat.write.request.merges_per_sec`*::
+
--
The number of write requests merged per second that were queued to the device.


type: float

--

*`linux.iostat.read.request.per_sec`*::
+
--
The number of read requests that were issued to the device per second


type: float

--

*`linux.iostat.write.request.per_sec`*::
+
--
The number of write requests that were issued to the device per second


type: float

--

*`linux.iostat.read.per_sec.bytes`*::
+
--
The number of Bytes read from the device per second.


type: float

format: bytes

--

*`linux.iostat.read.await`*::
+
--
The average time spent for read requests issued to the device to be served.


type: float

--

*`linux.iostat.write.per_sec.bytes`*::
+
--
The number of Bytes write from the device per second.


type: float

format: bytes

--

*`linux.iostat.write.await`*::
+
--
The average time spent for write requests issued to the device to be served.


type: float

--

*`linux.iostat.request.avg_size`*::
+
--
The average size (in bytes) of the requests that were issued to the device.


type: float

--

*`linux.iostat.queue.avg_size`*::
+
--
The average queue length of the requests that were issued to the device.


type: float

--

*`linux.iostat.await`*::
+
--
The average time spent for requests issued to the device to be served.


type: float

--

*`linux.iostat.service_time`*::
+
--
The average service time (in milliseconds) for I/O requests that were issued to the device.


type: float

--

*`linux.iostat.busy`*::
+
--
Percentage of CPU time during which I/O requests were issued to the device (bandwidth utilization for the device). Device saturation occurs when this value is close to 100%.


type: float

--

[float]
=== ksm

ksm



[float]
=== stats

KSM statistics



*`linux.ksm.stats.pages_shared`*::
+
--
Shared pages in use.


type: long

--

*`linux.ksm.stats.pages_sharing`*::
+
--
Sites sharing pages.


type: long

--

*`linux.ksm.stats.pages_unshared`*::
+
--
Unique pages.


type: long

--

*`linux.ksm.stats.full_scans`*::
+
--
Number of times mergable pages have been scanned.


type: long

--

*`linux.ksm.stats.stable_node_chains`*::
+
--
Pages that have reached max_page_sharing.


type: long

--

*`linux.ksm.stats.stable_node_dups`*::
+
--
Number of duplicated KSM pages.


type: long

--

[float]
=== memory

Linux memory data



[float]
=== page_stats

memory page statistics


*`linux.memory.page_stats.pgscan_kswapd.pages`*::
+
--
pages scanned by kswapd

type: long

format: number

--

*`linux.memory.page_stats.pgscan_direct.pages`*::
+
--
pages scanned directly

type: long

format: number

--

*`linux.memory.page_stats.pgfree.pages`*::
+
--
pages freed by the system

type: long

format: number

--

*`linux.memory.page_stats.pgsteal_kswapd.pages`*::
+
--
number of pages reclaimed by kswapd

type: long

format: number

--

*`linux.memory.page_stats.pgsteal_direct.pages`*::
+
--
number of pages reclaimed directly

type: long

format: number

--

*`linux.memory.page_stats.direct_efficiency.pct`*::
+
--
direct reclaim efficiency percentage. A lower percentage indicates the system is struggling to reclaim memory.

type: scaled_float

format: percent

--

*`linux.memory.page_stats.kswapd_efficiency.pct`*::
+
--
kswapd reclaim efficiency percentage. A lower percentage indicates the system is struggling to reclaim memory.

type: scaled_float

format: percent

--

[float]
=== hugepages

This group contains statistics related to huge pages usage on the system.


*`linux.memory.hugepages.total`*::
+
--
Number of huge pages in the pool.


type: long

format: number

--

*`linux.memory.hugepages.used.bytes`*::
+
--
Memory used in allocated huge pages.


type: long

format: bytes

--

*`linux.memory.hugepages.used.pct`*::
+
--
Percentage of huge pages used.


type: long

format: percent

--

*`linux.memory.hugepages.free`*::
+
--
Number of available huge pages in the pool.


type: long

format: number

--

*`linux.memory.hugepages.reserved`*::
+
--
Number of reserved but not allocated huge pages in the pool.


type: long

format: number

--

*`linux.memory.hugepages.surplus`*::
+
--
Number of overcommited huge pages.


type: long

format: number

--

*`linux.memory.hugepages.default_size`*::
+
--
Default size for huge pages.


type: long

format: bytes

--

[float]
=== pageinfo

pageinfo



[float]
=== buddy_info

Data from /proc/buddyinfo grouping used pages by order



[float]
=== DMA

DMA page Data



*`linux.pageinfo.buddy_info.DMA.0`*::
+
--
free chunks of 2^0*PAGE_SIZE


type: long

--

*`linux.pageinfo.buddy_info.DMA.1`*::
+
--
free chunks of 2^1*PAGE_SIZE


type: long

--

*`linux.pageinfo.buddy_info.DMA.2`*::
+
--
free chunks of 2^2*PAGE_SIZE


type: long

--

*`linux.pageinfo.buddy_info.DMA.3`*::
+
--
free chunks of 2^3*PAGE_SIZE


type: long

--

*`linux.pageinfo.buddy_info.DMA.4`*::
+
--
free chunks of 2^4*PAGE_SIZE


type: long

--

*`linux.pageinfo.buddy_info.DMA.5`*::
+
--
free chunks of 2^5*PAGE_SIZE


type: long

--

*`linux.pageinfo.buddy_info.DMA.6`*::
+
--
free chunks of 2^6*PAGE_SIZE


type: long

--

*`linux.pageinfo.buddy_info.DMA.7`*::
+
--
free chunks of 2^7*PAGE_SIZE


type: long

--

*`linux.pageinfo.buddy_info.DMA.8`*::
+
--
free chunks of 2^8*PAGE_SIZE


type: long

--

*`linux.pageinfo.buddy_info.DMA.9`*::
+
--
free chunks of 2^9*PAGE_SIZE


type: long

--

*`linux.pageinfo.buddy_info.DMA.10`*::
+
--
free chunks of 2^10*PAGE_SIZE


type: long

--

*`linux.pageinfo.nodes.*`*::
+
--
Raw allocation info from /proc/pagetypeinfo


type: object

--

[float]
=== pressure

Linux pressure stall information metrics for cpu, memory, and io


*`linux.pressure.cpu.some.10.pct`*::
+
--
The average share of time in which at least some tasks were stalled on CPU over a ten second window.


type: float

format: percent

--

*`linux.pressure.cpu.some.60.pct`*::
+
--
The average share of time in which at least some tasks were stalled on CPU over a sixty second window.


type: float

format: percent

--

*`linux.pressure.cpu.some.300.pct`*::
+
--
The average share of time in which at least some tasks were stalled on CPU over a three hundred second window.


type: float

format: percent

--

*`linux.pressure.cpu.some.total.time.us`*::
+
--
The total absolute stall time (in microseconds) in which at least some tasks were stalled on CPU.


type: long

--

*`linux.pressure.memory.some.10.pct`*::
+
--
The average share of time in which at least some tasks were stalled on Memory over a ten second window.


type: float

format: percent

--

*`linux.pressure.memory.some.60.pct`*::
+
--
The average share of time in which at least some tasks were stalled on Memory over a sixty second window.


type: float

format: percent

--

*`linux.pressure.memory.some.300.pct`*::
+
--
The average share of time in which at least some tasks were stalled on Memory over a three hundred second window.


type: float

format: percent

--

*`linux.pressure.memory.some.total.time.us`*::
+
--
The total absolute stall time (in microseconds) in which at least some tasks were stalled on memory.


type: long

--

*`linux.pressure.memory.full.10.pct`*::
+
--
The average share of time in which in which all non-idle tasks were stalled on memory simultaneously over a ten second window.


type: float

format: percent

--

*`linux.pressure.memory.full.60.pct`*::
+
--
The average share of time in which in which all non-idle tasks were stalled on memory simultaneously over a sixty second window.


type: float

format: percent

--

*`linux.pressure.memory.full.300.pct`*::
+
--
The average share of time in which in which all non-idle tasks were stalled on memory simultaneously over a three hundred second window.


type: float

format: percent

--

*`linux.pressure.memory.full.total.time.us`*::
+
--
The total absolute stall time (in microseconds) in which in which all non-idle tasks were stalled on memory.


type: long

--

*`linux.pressure.io.some.10.pct`*::
+
--
The average share of time in which at least some tasks were stalled on io over a ten second window.


type: float

format: percent

--

*`linux.pressure.io.some.60.pct`*::
+
--
The average share of time in which at least some tasks were stalled on io over a sixty second window.


type: float

format: percent

--

*`linux.pressure.io.some.300.pct`*::
+
--
The average share of time in which at least some tasks were stalled on io over a three hundred second window.


type: float

format: percent

--

*`linux.pressure.io.some.total.time.us`*::
+
--
The total absolute stall time (in microseconds) in which at least some tasks were stalled on io.


type: long

--

*`linux.pressure.io.full.10.pct`*::
+
--
The average share of time in which in which all non-idle tasks were stalled on io simultaneously over a ten second window.


type: float

format: percent

--

*`linux.pressure.io.full.60.pct`*::
+
--
The average share of time in which in which all non-idle tasks were stalled on io simultaneously over a sixty second window.


type: float

format: percent

--

*`linux.pressure.io.full.300.pct`*::
+
--
The average share of time in which in which all non-idle tasks were stalled on io simultaneously over a three hundred second window.


type: float

format: percent

--

*`linux.pressure.io.full.total.time.us`*::
+
--
The total absolute stall time (in microseconds) in which in which all non-idle tasks were stalled on io.


type: long

--

[[exported-fields-logstash]]
== Logstash fields

Logstash module



[float]
=== logstash




[float]
=== node

node



*`logstash.node.host`*::
+
--
Host name


type: alias

alias to: host.hostname

--

*`logstash.node.version`*::
+
--
Logstash Version


type: alias

alias to: service.version

--

[float]
=== jvm

JVM Info



*`logstash.node.jvm.version`*::
+
--
Version


type: keyword

--

*`logstash.node.jvm.pid`*::
+
--
Process ID


type: alias

alias to: process.pid

--

[float]
=== node.stats

node_stats metrics.



[float]
=== events

Events stats



*`logstash.node.stats.events.in`*::
+
--
Incoming events counter.


type: long

--

*`logstash.node.stats.events.out`*::
+
--
Outgoing events counter.


type: long

--

*`logstash.node.stats.events.filtered`*::
+
--
Filtered events counter.


type: long

--

[[exported-fields-memcached]]
== Memcached fields

Memcached module



[float]
=== memcached




[float]
=== stats

stats



*`memcached.stats.pid`*::
+
--
Current process ID of the Memcached task.


type: long

--

*`memcached.stats.uptime.sec`*::
+
--
Memcached server uptime.


type: long

--

*`memcached.stats.threads`*::
+
--
Number of threads used by the current Memcached server process.


type: long

--

*`memcached.stats.connections.current`*::
+
--
Number of open connections to this Memcached server, should be the same value on all servers during normal operation.


type: long

--

*`memcached.stats.connections.total`*::
+
--
Numer of successful connect attempts to this server since it has been started.


type: long

--

*`memcached.stats.get.hits`*::
+
--
Number of successful "get" commands (cache hits) since startup, divide them by the "cmd_get" value to get the cache hitrate.


type: long

--

*`memcached.stats.get.misses`*::
+
--
Number of failed "get" requests because nothing was cached for this key or the cached value was too old.


type: long

--

*`memcached.stats.cmd.get`*::
+
--
Number of "get" commands received since server startup not counting if they were successful or not.


type: long

--

*`memcached.stats.cmd.set`*::
+
--
Number of "set" commands serviced since startup.


type: long

--

*`memcached.stats.read.bytes`*::
+
--
Total number of bytes received from the network by this server.


type: long

--

*`memcached.stats.written.bytes`*::
+
--
Total number of bytes send to the network by this server.


type: long

--

*`memcached.stats.items.current`*::
+
--
Number of items currently in this server's cache.


type: long

--

*`memcached.stats.items.total`*::
+
--
Number of items stored ever stored on this server. This is no "maximum item count" value but a counted increased by every new item stored in the cache.


type: long

--

*`memcached.stats.evictions`*::
+
--
Number of objects removed from the cache to free up memory for new items because Memcached reached it's maximum memory setting (limit_maxbytes).


type: long

--

*`memcached.stats.bytes.current`*::
+
--
Number of bytes currently used for caching items.


type: long

--

*`memcached.stats.bytes.limit`*::
+
--
Number of bytes this server is allowed to use for storage.


type: long

--

[[exported-fields-mongodb]]
== MongoDB fields

Metrics collected from MongoDB servers.



[float]
=== mongodb

MongoDB metrics.



[float]
=== collstats

MongoDB collection statistics metrics.



*`mongodb.collstats.db`*::
+
--
Database name.


type: keyword

--

*`mongodb.collstats.collection`*::
+
--
Collection name.


type: keyword

--

*`mongodb.collstats.name`*::
+
--
Combination of database and collection name.


type: keyword

--

*`mongodb.collstats.total.time.us`*::
+
--
Total waiting time for locks in microseconds.


type: long

--

*`mongodb.collstats.total.count`*::
+
--
Total number of lock wait events.


type: long

--


*`mongodb.collstats.lock.read.time.us`*::
+
--
Time waiting for read locks in microseconds.


type: long

--

*`mongodb.collstats.lock.read.count`*::
+
--
Number of read lock wait events.


type: long

--

*`mongodb.collstats.lock.write.time.us`*::
+
--
Time waiting for write locks in microseconds.


type: long

--

*`mongodb.collstats.lock.write.count`*::
+
--
Number of write lock wait events.


type: long

--

*`mongodb.collstats.queries.time.us`*::
+
--
Time running queries in microseconds.


type: long

--

*`mongodb.collstats.queries.count`*::
+
--
Number of queries executed.


type: long

--

*`mongodb.collstats.getmore.time.us`*::
+
--
Time asking for more cursor rows in microseconds.


type: long

--

*`mongodb.collstats.getmore.count`*::
+
--
Number of times a cursor asked for more data.


type: long

--

*`mongodb.collstats.insert.time.us`*::
+
--
Time inserting new documents in microseconds.


type: long

--

*`mongodb.collstats.insert.count`*::
+
--
Number of document insert events.


type: long

--

*`mongodb.collstats.update.time.us`*::
+
--
Time updating documents in microseconds.


type: long

--

*`mongodb.collstats.update.count`*::
+
--
Number of document update events.


type: long

--

*`mongodb.collstats.remove.time.us`*::
+
--
Time deleting documents in microseconds.


type: long

--

*`mongodb.collstats.remove.count`*::
+
--
Number of document delete events.


type: long

--

*`mongodb.collstats.commands.time.us`*::
+
--
Time executing database commands in microseconds.


type: long

--

*`mongodb.collstats.commands.count`*::
+
--
Number of database commands executed.


type: long

--

[float]
=== dbstats

dbstats provides an overview of a particular mongo database. This document is most concerned with data volumes of a database.



*`mongodb.dbstats.avg_obj_size.bytes`*::
+
--
type: long

format: bytes

--

*`mongodb.dbstats.collections`*::
+
--
type: integer

--

*`mongodb.dbstats.data_size.bytes`*::
+
--
type: long

format: bytes

--

*`mongodb.dbstats.db`*::
+
--
type: keyword

--

*`mongodb.dbstats.file_size.bytes`*::
+
--
type: long

format: bytes

--

*`mongodb.dbstats.index_size.bytes`*::
+
--
type: long

format: bytes

--

*`mongodb.dbstats.indexes`*::
+
--
type: long

--

*`mongodb.dbstats.num_extents`*::
+
--
type: long

--

*`mongodb.dbstats.objects`*::
+
--
type: long

--

*`mongodb.dbstats.storage_size.bytes`*::
+
--
type: long

format: bytes

--

*`mongodb.dbstats.ns_size_mb.mb`*::
+
--
type: long

--


*`mongodb.dbstats.data_file_version.major`*::
+
--
type: long

--

*`mongodb.dbstats.data_file_version.minor`*::
+
--
type: long

--


*`mongodb.dbstats.extent_free_list.num`*::
+
--
type: long

--

*`mongodb.dbstats.extent_free_list.size.bytes`*::
+
--
type: long

format: bytes

--

[float]
=== metrics

Statistics that reflect the current use and state of a running `mongod` instance for more information, take a look at https://docs.mongodb.com/manual/reference/command/serverStatus/#serverstatus.metrics



[float]
=== commands

Reports on the use of database commands. The fields in metrics.commands are the names of database commands and each value is a document that reports the total number of commands executed as well as the number of failed executions.
metrics.commands.<command>.failed shows the number of times <command> failed on this mongod. metrics.commands.<command>.total shows the number of times <command> executed on this mongod.




*`mongodb.metrics.commands.is_self.failed`*::
+
--
type: long

--

*`mongodb.metrics.commands.is_self.total`*::
+
--
type: long

--


*`mongodb.metrics.commands.aggregate.failed`*::
+
--
type: long

--

*`mongodb.metrics.commands.aggregate.total`*::
+
--
type: long

--


*`mongodb.metrics.commands.build_info.failed`*::
+
--
type: long

--

*`mongodb.metrics.commands.build_info.total`*::
+
--
type: long

--


*`mongodb.metrics.commands.coll_stats.failed`*::
+
--
type: long

--

*`mongodb.metrics.commands.coll_stats.total`*::
+
--
type: long

--


*`mongodb.metrics.commands.connection_pool_stats.failed`*::
+
--
type: long

--

*`mongodb.metrics.commands.connection_pool_stats.total`*::
+
--
type: long

--


*`mongodb.metrics.commands.count.failed`*::
+
--
type: long

--

*`mongodb.metrics.commands.count.total`*::
+
--
type: long

--


*`mongodb.metrics.commands.db_stats.failed`*::
+
--
type: long

--

*`mongodb.metrics.commands.db_stats.total`*::
+
--
type: long

--


*`mongodb.metrics.commands.distinct.failed`*::
+
--
type: long

--

*`mongodb.metrics.commands.distinct.total`*::
+
--
type: long

--


*`mongodb.metrics.commands.find.failed`*::
+
--
type: long

--

*`mongodb.metrics.commands.find.total`*::
+
--
type: long

--


*`mongodb.metrics.commands.get_cmd_line_opts.failed`*::
+
--
type: long

--

*`mongodb.metrics.commands.get_cmd_line_opts.total`*::
+
--
type: long

--


*`mongodb.metrics.commands.get_last_error.failed`*::
+
--
type: long

--

*`mongodb.metrics.commands.get_last_error.total`*::
+
--
type: long

--


*`mongodb.metrics.commands.get_log.failed`*::
+
--
type: long

--

*`mongodb.metrics.commands.get_log.total`*::
+
--
type: long

--


*`mongodb.metrics.commands.get_more.failed`*::
+
--
type: long

--

*`mongodb.metrics.commands.get_more.total`*::
+
--
type: long

--


*`mongodb.metrics.commands.get_parameter.failed`*::
+
--
type: long

--

*`mongodb.metrics.commands.get_parameter.total`*::
+
--
type: long

--


*`mongodb.metrics.commands.host_info.failed`*::
+
--
type: long

--

*`mongodb.metrics.commands.host_info.total`*::
+
--
type: long

--


*`mongodb.metrics.commands.insert.failed`*::
+
--
type: long

--

*`mongodb.metrics.commands.insert.total`*::
+
--
type: long

--


*`mongodb.metrics.commands.is_master.failed`*::
+
--
type: long

--

*`mongodb.metrics.commands.is_master.total`*::
+
--
type: long

--


*`mongodb.metrics.commands.last_collections.failed`*::
+
--
type: long

--

*`mongodb.metrics.commands.last_collections.total`*::
+
--
type: long

--


*`mongodb.metrics.commands.last_commands.failed`*::
+
--
type: long

--

*`mongodb.metrics.commands.last_commands.total`*::
+
--
type: long

--


*`mongodb.metrics.commands.list_databased.failed`*::
+
--
type: long

--

*`mongodb.metrics.commands.list_databased.total`*::
+
--
type: long

--


*`mongodb.metrics.commands.list_indexes.failed`*::
+
--
type: long

--

*`mongodb.metrics.commands.list_indexes.total`*::
+
--
type: long

--


*`mongodb.metrics.commands.ping.failed`*::
+
--
type: long

--

*`mongodb.metrics.commands.ping.total`*::
+
--
type: long

--


*`mongodb.metrics.commands.profile.failed`*::
+
--
type: long

--

*`mongodb.metrics.commands.profile.total`*::
+
--
type: long

--


*`mongodb.metrics.commands.replset_get_rbid.failed`*::
+
--
type: long

--

*`mongodb.metrics.commands.replset_get_rbid.total`*::
+
--
type: long

--


*`mongodb.metrics.commands.replset_get_status.failed`*::
+
--
type: long

--

*`mongodb.metrics.commands.replset_get_status.total`*::
+
--
type: long

--


*`mongodb.metrics.commands.replset_heartbeat.failed`*::
+
--
type: long

--

*`mongodb.metrics.commands.replset_heartbeat.total`*::
+
--
type: long

--


*`mongodb.metrics.commands.replset_update_position.failed`*::
+
--
type: long

--

*`mongodb.metrics.commands.replset_update_position.total`*::
+
--
type: long

--


*`mongodb.metrics.commands.server_status.failed`*::
+
--
type: long

--

*`mongodb.metrics.commands.server_status.total`*::
+
--
type: long

--


*`mongodb.metrics.commands.update.failed`*::
+
--
type: long

--

*`mongodb.metrics.commands.update.total`*::
+
--
type: long

--


*`mongodb.metrics.commands.whatsmyuri.failed`*::
+
--
type: long

--

*`mongodb.metrics.commands.whatsmyuri.total`*::
+
--
type: long

--

[float]
=== cursor

Contains data regarding cursor state and use.



*`mongodb.metrics.cursor.timed_out`*::
+
--
The total number of cursors that have timed out since the server process started.


type: long

--

[float]
=== open

Contains data regarding open cursors.



*`mongodb.metrics.cursor.open.no_timeout`*::
+
--
The number of open cursors with the option DBQuery.Option.noTimeout set to prevent timeout.


type: long

--

*`mongodb.metrics.cursor.open.pinned`*::
+
--
The number of `pinned` open cursors.


type: long

--

*`mongodb.metrics.cursor.open.total`*::
+
--
The number of cursors that MongoDB is maintaining for clients.


type: long

--

[float]
=== document

Reflects document access and modification patterns.



*`mongodb.metrics.document.deleted`*::
+
--
The total number of documents deleted.


type: long

--

*`mongodb.metrics.document.inserted`*::
+
--
The total number of documents inserted.


type: long

--

*`mongodb.metrics.document.returned`*::
+
--
The total number of documents returned by queries.


type: long

--

*`mongodb.metrics.document.updated`*::
+
--
The total number of documents updated.


type: long

--

[float]
=== get_last_error

Returns the error status of the preceding write operation on the current connection.



*`mongodb.metrics.get_last_error.write_wait.ms`*::
+
--
The total amount of time in milliseconds that the mongod has spent performing getLastError operations with write concern (i.e. w) greater than 1.


type: long

--

*`mongodb.metrics.get_last_error.write_wait.count`*::
+
--
The total number of getLastError operations with a specified write concern (i.e. w) greater than 1.


type: long

--

*`mongodb.metrics.get_last_error.write_timeouts`*::
+
--
The number of times that write concern operations have timed out as a result of the wtimeout threshold to getLastError.


type: long

--

[float]
=== operation

Holds counters for several types of update and query operations that MongoDB handles using special operation types.



*`mongodb.metrics.operation.scan_and_order`*::
+
--
The total number of queries that return sorted numbers that cannot perform the sort operation using an index.


type: long

--

*`mongodb.metrics.operation.write_conflicts`*::
+
--
The total number of queries that encountered write conflicts.


type: long

--

[float]
=== query_executor

Reports data from the query execution system.



*`mongodb.metrics.query_executor.scanned_indexes.count`*::
+
--
The total number of index items scanned during queries and query-plan evaluation.


type: long

--

*`mongodb.metrics.query_executor.scanned_documents.count`*::
+
--
The total number of documents scanned during queries and query-plan evaluation.


type: long

--

[float]
=== replication

Reports metrics related to the replication process. metrics.replication appears on all mongod instances, even those that aren't members of replica sets.



[float]
=== executor

Reports on various statistics for the replication executor.




*`mongodb.metrics.replication.executor.counters.event_created`*::
+
--
type: long

--

*`mongodb.metrics.replication.executor.counters.event_wait`*::
+
--
type: long

--

*`mongodb.metrics.replication.executor.counters.cancels`*::
+
--
type: long

--

*`mongodb.metrics.replication.executor.counters.waits`*::
+
--
type: long

--


*`mongodb.metrics.replication.executor.counters.scheduled.netcmd`*::
+
--
type: long

--

*`mongodb.metrics.replication.executor.counters.scheduled.dbwork`*::
+
--
type: long

--

*`mongodb.metrics.replication.executor.counters.scheduled.exclusive`*::
+
--
type: long

--

*`mongodb.metrics.replication.executor.counters.scheduled.work_at`*::
+
--
type: long

--

*`mongodb.metrics.replication.executor.counters.scheduled.work`*::
+
--
type: long

--

*`mongodb.metrics.replication.executor.counters.scheduled.failures`*::
+
--
type: long

--



*`mongodb.metrics.replication.executor.queues.in_progress.network`*::
+
--
type: long

--

*`mongodb.metrics.replication.executor.queues.in_progress.dbwork`*::
+
--
type: long

--

*`mongodb.metrics.replication.executor.queues.in_progress.exclusive`*::
+
--
type: long

--

*`mongodb.metrics.replication.executor.queues.sleepers`*::
+
--
type: long

--

*`mongodb.metrics.replication.executor.queues.ready`*::
+
--
type: long

--

*`mongodb.metrics.replication.executor.queues.free`*::
+
--
type: long

--

*`mongodb.metrics.replication.executor.unsignaled_events`*::
+
--
type: long

--

*`mongodb.metrics.replication.executor.event_waiters`*::
+
--
type: long

--

*`mongodb.metrics.replication.executor.shutting_down`*::
+
--
type: boolean

--

*`mongodb.metrics.replication.executor.network_interface`*::
+
--
type: keyword

--

[float]
=== apply

Reports on the application of operations from the replication oplog.



*`mongodb.metrics.replication.apply.attempts_to_become_secondary`*::
+
--
type: long

--

[float]
=== batches

Reports on the oplog application process on secondaries members of replica sets.



*`mongodb.metrics.replication.apply.batches.count`*::
+
--
The total number of batches applied across all databases.


type: long

--

*`mongodb.metrics.replication.apply.batches.time.ms`*::
+
--
The total amount of time in milliseconds the mongod has spent applying operations from the oplog.


type: long

--

*`mongodb.metrics.replication.apply.ops`*::
+
--
The total number of oplog operations applied.


type: long

--

[float]
=== buffer

MongoDB buffers oplog operations from the replication sync source buffer before applying oplog entries in a batch. metrics.replication.buffer provides a way to track the oplog buffer.



*`mongodb.metrics.replication.buffer.count`*::
+
--
The current number of operations in the oplog buffer.


type: long

--

*`mongodb.metrics.replication.buffer.max_size.bytes`*::
+
--
The maximum size of the buffer. This value is a constant setting in the mongod, and is not configurable.


type: long

--

*`mongodb.metrics.replication.buffer.size.bytes`*::
+
--
The current size of the contents of the oplog buffer.


type: long

--

[float]
=== initial_sync

Report initial sync status



*`mongodb.metrics.replication.initial_sync.completed`*::
+
--
type: long

--

*`mongodb.metrics.replication.initial_sync.failed_attempts`*::
+
--
type: long

--

*`mongodb.metrics.replication.initial_sync.failures`*::
+
--
type: long

--

[float]
=== network

Reports network use by the replication process.



*`mongodb.metrics.replication.network.bytes`*::
+
--
The total amount of data read from the replication sync source.


type: long

--

[float]
=== getmores

Reports on the getmore operations, which are requests for additional results from the oplog cursor as part of the oplog replication process.



*`mongodb.metrics.replication.network.getmores.count`*::
+
--
The total number of getmore operations


type: long

--

*`mongodb.metrics.replication.network.getmores.time.ms`*::
+
--
The total amount of time required to collect data from getmore operations.


type: long

--

*`mongodb.metrics.replication.network.ops`*::
+
--
The total number of operations read from the replication source.


type: long

--

*`mongodb.metrics.replication.network.reders_created`*::
+
--
The total number of oplog query processes created.


type: long

--

[float]
=== preload

Reports on the `pre-fetch` stage, where MongoDB loads documents and indexes into RAM to improve replication throughput.



[float]
=== docs

Reports on the documents loaded into memory during the pre-fetch stage.



*`mongodb.metrics.replication.preload.docs.count`*::
+
--
The total number of documents loaded during the pre-fetch stage of replication.


type: long

--

*`mongodb.metrics.replication.preload.docs.time.ms`*::
+
--
type: long

--

[float]
=== indexes

Reports on the index items loaded into memory during the pre-fetch stage of replication.



*`mongodb.metrics.replication.preload.indexes.count`*::
+
--
The total number of index entries loaded by members before updating documents as part of the pre-fetch stage of replication.


type: long

--

*`mongodb.metrics.replication.preload.indexes.time.ms`*::
+
--
The total amount of time, in milliseconds, spent loading index entries as part of the pre-fetch stage of replication.


type: long

--


*`mongodb.metrics.storage.free_list.search.bucket_exhausted`*::
+
--
The number of times that mongod has checked the free list without finding a suitably large record allocation.


type: long

--

*`mongodb.metrics.storage.free_list.search.requests`*::
+
--
The number of times mongod has searched for available record allocations.


type: long

--

*`mongodb.metrics.storage.free_list.search.scanned`*::
+
--
The number of available record allocations mongod has searched.


type: long

--

[float]
=== ttl

Reports on the operation of the resource use of the ttl index process.



*`mongodb.metrics.ttl.deleted_documents.count`*::
+
--
The total number of documents deleted from collections with a ttl index.


type: long

--

*`mongodb.metrics.ttl.passes.count`*::
+
--
The number of times the background process removes documents from collections with a ttl index.


type: long

--

[float]
=== replstatus

replstatus provides an overview of replica set status.



[float]
=== oplog

oplog provides an overview of replication oplog status, which is retrieved from db.getReplicationInfo().



*`mongodb.replstatus.oplog.size.allocated`*::
+
--
The total amount of space used by the replstatus in bytes.


type: long

format: bytes

--

*`mongodb.replstatus.oplog.size.used`*::
+
--
total amount of space allocated to the replstatus in bytes.


type: long

format: bytes

--

*`mongodb.replstatus.oplog.first.timestamp`*::
+
--
Timestamp of the first (i.e. earliest) operation in the replstatus


type: long

--

*`mongodb.replstatus.oplog.last.timestamp`*::
+
--
Timestamp of the last (i.e. latest) operation in the replstatus


type: long

--

*`mongodb.replstatus.oplog.window`*::
+
--
The difference between the first and last operation in the replstatus.


type: long

--

*`mongodb.replstatus.set_name`*::
+
--
The name of the replica set.


type: keyword

--

*`mongodb.replstatus.server_date`*::
+
--
Reflects the current time according to the server that processed the replSetGetStatus command.


type: date

--


*`mongodb.replstatus.optimes.last_committed`*::
+
--
Information, from the viewpoint of this member, regarding the most recent operation that has been written to a majority of replica set members.


type: long

--

*`mongodb.replstatus.optimes.applied`*::
+
--
Information, from the viewpoint of this member, regarding the most recent operation that has been applied to this member of the replica set.


type: long

--

*`mongodb.replstatus.optimes.durable`*::
+
--
Information, from the viewpoint of this member, regarding the most recent operation that has been written to the journal of this member of the replica set.


type: long

--

[float]
=== lag

Delay between a write operation on the primary and its copy to a secondary



*`mongodb.replstatus.lag.max`*::
+
--
Difference between optime of primary and slowest secondary


type: long

format: duration

--

*`mongodb.replstatus.lag.min`*::
+
--
Difference between optime of primary and fastest secondary


type: long

format: duration

--

[float]
=== headroom

Difference between the primary's oplog window and the replication lag of the secondary



*`mongodb.replstatus.headroom.max`*::
+
--
Difference between primary's oplog window and the replication lag of the fastest secondary


type: long

format: duration

--

*`mongodb.replstatus.headroom.min`*::
+
--
Difference between primary's oplog window and the replication lag of the slowest secondary


type: long

format: duration

--

[float]
=== members

Provides information about members of replica set grouped by their state



*`mongodb.replstatus.members.primary.host`*::
+
--
Host address of the primary


type: keyword

--

*`mongodb.replstatus.members.primary.optime`*::
+
--
Optime of primary


type: keyword

--

*`mongodb.replstatus.members.secondary.hosts`*::
+
--
List of secondary hosts


type: keyword

--

*`mongodb.replstatus.members.secondary.optimes`*::
+
--
Optimes of secondaries


type: keyword

--

*`mongodb.replstatus.members.secondary.count`*::
+
--
type: long

--

*`mongodb.replstatus.members.recovering.hosts`*::
+
--
List of recovering members hosts


type: keyword

--

*`mongodb.replstatus.members.recovering.count`*::
+
--
Count of members in the `recovering` state


type: long

--

*`mongodb.replstatus.members.unknown.hosts`*::
+
--
List of members' hosts in the `unknown` state


type: keyword

--

*`mongodb.replstatus.members.unknown.count`*::
+
--
Count of members with `unknown` state


type: long

--

*`mongodb.replstatus.members.startup2.hosts`*::
+
--
List of initializing members hosts


type: keyword

--

*`mongodb.replstatus.members.startup2.count`*::
+
--
Count of members in the `startup2` state


type: long

--

*`mongodb.replstatus.members.arbiter.hosts`*::
+
--
List of arbiters hosts


type: keyword

--

*`mongodb.replstatus.members.arbiter.count`*::
+
--
Count of arbiters


type: long

--

*`mongodb.replstatus.members.down.hosts`*::
+
--
List of `down` members hosts


type: keyword

--

*`mongodb.replstatus.members.down.count`*::
+
--
Count of `down` members


type: long

--

*`mongodb.replstatus.members.rollback.hosts`*::
+
--
List of members in the `rollback` state


type: keyword

--

*`mongodb.replstatus.members.rollback.count`*::
+
--
Count of members in the `rollback` state


type: long

--

*`mongodb.replstatus.members.unhealthy.hosts`*::
+
--
List of members' hosts with healthy = false


type: keyword

--

*`mongodb.replstatus.members.unhealthy.count`*::
+
--
Count of unhealthy members


type: long

--

[float]
=== status

MongoDB server status metrics.



*`mongodb.status.version`*::
+
--
Instance version.


type: alias

alias to: service.version

--

*`mongodb.status.process`*::
+
--
The current MongoDB process. Possible values are mongos or mongod.


type: alias

alias to: process.name

--

*`mongodb.status.uptime.ms`*::
+
--
Instance uptime in milliseconds.


type: long

--

*`mongodb.status.local_time`*::
+
--
Local time as reported by the MongoDB instance.


type: date

--

*`mongodb.status.asserts.regular`*::
+
--
Number of regular assertions produced by the server.


type: long

--

*`mongodb.status.asserts.warning`*::
+
--
Number of warning assertions produced by the server.


type: long

--

*`mongodb.status.asserts.msg`*::
+
--
Number of msg assertions produced by the server.


type: long

--

*`mongodb.status.asserts.user`*::
+
--
Number of user assertions produced by the server.


type: long

--

*`mongodb.status.asserts.rollovers`*::
+
--
Number of rollovers assertions produced by the server.


type: long

--

[float]
=== connections

Data regarding the current status of incoming connections and availability of the database server.



*`mongodb.status.connections.current`*::
+
--
The number of connections to the database server from clients. This number includes the current shell session. Consider the value of `available` to add more context to this datum.


type: long

--

*`mongodb.status.connections.available`*::
+
--
The number of unused available incoming connections the database can provide.


type: long

--

*`mongodb.status.connections.total_created`*::
+
--
A count of all incoming connections created to the server. This number includes connections that have since closed.


type: long

--

[float]
=== extra_info

Platform specific data.



*`mongodb.status.extra_info.heap_usage.bytes`*::
+
--
The total size in bytes of heap space used by the database process. Only available on Unix/Linux.


type: long

format: bytes

--

*`mongodb.status.extra_info.page_faults`*::
+
--
The total number of page faults that require disk operations. Page faults refer to operations that require the database server to access data that isn't available in active memory.


type: long

--

[float]
=== global_lock

Reports on lock state of the database.



*`mongodb.status.global_lock.total_time.us`*::
+
--
The time, in microseconds, since the database last started and created the globalLock. This is roughly equivalent to total server uptime.


type: long

--

[float]
=== current_queue

The number of operations queued because of a lock.



*`mongodb.status.global_lock.current_queue.total`*::
+
--
The total number of operations queued waiting for the lock (i.e., the sum of current_queue.readers and current_queue.writers).


type: long

--

*`mongodb.status.global_lock.current_queue.readers`*::
+
--
The number of operations that are currently queued and waiting for the read lock.


type: long

--

*`mongodb.status.global_lock.current_queue.writers`*::
+
--
The number of operations that are currently queued and waiting for the write lock.


type: long

--

[float]
=== active_clients

The number of connected clients and the read and write operations performed by these clients.



*`mongodb.status.global_lock.active_clients.total`*::
+
--
Total number of the active client connections performing read or write operations.


type: long

--

*`mongodb.status.global_lock.active_clients.readers`*::
+
--
The number of the active client connections performing read operations.


type: long

--

*`mongodb.status.global_lock.active_clients.writers`*::
+
--
The number of the active client connections performing write operations.


type: long

--

[float]
=== locks

A document that reports for each lock <type>, data on lock <mode>s. The possible lock <type>s are global, database, collection, metadata and oplog. The possible <mode>s are r, w, R and W which respresent shared, exclusive, intent shared and intent exclusive.
locks.<type>.acquire.count.<mode> shows the number of times the lock was acquired in the specified mode. locks.<type>.wait.count.<mode> shows the number of times the locks.acquireCount lock acquisitions encountered waits because the locks were held in a conflicting mode. locks.<type>.wait.us.<mode> shows the cumulative wait time in microseconds for the lock acquisitions. locks.<type>.deadlock.count.<mode> shows the number of times the lock acquisitions encountered deadlocks.




*`mongodb.status.locks.global.acquire.count.r`*::
+
--
type: long

--

*`mongodb.status.locks.global.acquire.count.w`*::
+
--
type: long

--

*`mongodb.status.locks.global.acquire.count.R`*::
+
--
type: long

--

*`mongodb.status.locks.global.acquire.count.W`*::
+
--
type: long

--

*`mongodb.status.locks.global.wait.count.r`*::
+
--
type: long

--

*`mongodb.status.locks.global.wait.count.w`*::
+
--
type: long

--

*`mongodb.status.locks.global.wait.count.R`*::
+
--
type: long

--

*`mongodb.status.locks.global.wait.count.W`*::
+
--
type: long

--

*`mongodb.status.locks.global.wait.us.r`*::
+
--
type: long

--

*`mongodb.status.locks.global.wait.us.w`*::
+
--
type: long

--

*`mongodb.status.locks.global.wait.us.R`*::
+
--
type: long

--

*`mongodb.status.locks.global.wait.us.W`*::
+
--
type: long

--

*`mongodb.status.locks.global.deadlock.count.r`*::
+
--
type: long

--

*`mongodb.status.locks.global.deadlock.count.w`*::
+
--
type: long

--

*`mongodb.status.locks.global.deadlock.count.R`*::
+
--
type: long

--

*`mongodb.status.locks.global.deadlock.count.W`*::
+
--
type: long

--


*`mongodb.status.locks.database.acquire.count.r`*::
+
--
type: long

--

*`mongodb.status.locks.database.acquire.count.w`*::
+
--
type: long

--

*`mongodb.status.locks.database.acquire.count.R`*::
+
--
type: long

--

*`mongodb.status.locks.database.acquire.count.W`*::
+
--
type: long

--

*`mongodb.status.locks.database.wait.count.r`*::
+
--
type: long

--

*`mongodb.status.locks.database.wait.count.w`*::
+
--
type: long

--

*`mongodb.status.locks.database.wait.count.R`*::
+
--
type: long

--

*`mongodb.status.locks.database.wait.count.W`*::
+
--
type: long

--

*`mongodb.status.locks.database.wait.us.r`*::
+
--
type: long

--

*`mongodb.status.locks.database.wait.us.w`*::
+
--
type: long

--

*`mongodb.status.locks.database.wait.us.R`*::
+
--
type: long

--

*`mongodb.status.locks.database.wait.us.W`*::
+
--
type: long

--

*`mongodb.status.locks.database.deadlock.count.r`*::
+
--
type: long

--

*`mongodb.status.locks.database.deadlock.count.w`*::
+
--
type: long

--

*`mongodb.status.locks.database.deadlock.count.R`*::
+
--
type: long

--

*`mongodb.status.locks.database.deadlock.count.W`*::
+
--
type: long

--


*`mongodb.status.locks.collection.acquire.count.r`*::
+
--
type: long

--

*`mongodb.status.locks.collection.acquire.count.w`*::
+
--
type: long

--

*`mongodb.status.locks.collection.acquire.count.R`*::
+
--
type: long

--

*`mongodb.status.locks.collection.acquire.count.W`*::
+
--
type: long

--

*`mongodb.status.locks.collection.wait.count.r`*::
+
--
type: long

--

*`mongodb.status.locks.collection.wait.count.w`*::
+
--
type: long

--

*`mongodb.status.locks.collection.wait.count.R`*::
+
--
type: long

--

*`mongodb.status.locks.collection.wait.count.W`*::
+
--
type: long

--

*`mongodb.status.locks.collection.wait.us.r`*::
+
--
type: long

--

*`mongodb.status.locks.collection.wait.us.w`*::
+
--
type: long

--

*`mongodb.status.locks.collection.wait.us.R`*::
+
--
type: long

--

*`mongodb.status.locks.collection.wait.us.W`*::
+
--
type: long

--

*`mongodb.status.locks.collection.deadlock.count.r`*::
+
--
type: long

--

*`mongodb.status.locks.collection.deadlock.count.w`*::
+
--
type: long

--

*`mongodb.status.locks.collection.deadlock.count.R`*::
+
--
type: long

--

*`mongodb.status.locks.collection.deadlock.count.W`*::
+
--
type: long

--


*`mongodb.status.locks.meta_data.acquire.count.r`*::
+
--
type: long

--

*`mongodb.status.locks.meta_data.acquire.count.w`*::
+
--
type: long

--

*`mongodb.status.locks.meta_data.acquire.count.R`*::
+
--
type: long

--

*`mongodb.status.locks.meta_data.acquire.count.W`*::
+
--
type: long

--

*`mongodb.status.locks.meta_data.wait.count.r`*::
+
--
type: long

--

*`mongodb.status.locks.meta_data.wait.count.w`*::
+
--
type: long

--

*`mongodb.status.locks.meta_data.wait.count.R`*::
+
--
type: long

--

*`mongodb.status.locks.meta_data.wait.count.W`*::
+
--
type: long

--

*`mongodb.status.locks.meta_data.wait.us.r`*::
+
--
type: long

--

*`mongodb.status.locks.meta_data.wait.us.w`*::
+
--
type: long

--

*`mongodb.status.locks.meta_data.wait.us.R`*::
+
--
type: long

--

*`mongodb.status.locks.meta_data.wait.us.W`*::
+
--
type: long

--

*`mongodb.status.locks.meta_data.deadlock.count.r`*::
+
--
type: long

--

*`mongodb.status.locks.meta_data.deadlock.count.w`*::
+
--
type: long

--

*`mongodb.status.locks.meta_data.deadlock.count.R`*::
+
--
type: long

--

*`mongodb.status.locks.meta_data.deadlock.count.W`*::
+
--
type: long

--


*`mongodb.status.locks.oplog.acquire.count.r`*::
+
--
type: long

--

*`mongodb.status.locks.oplog.acquire.count.w`*::
+
--
type: long

--

*`mongodb.status.locks.oplog.acquire.count.R`*::
+
--
type: long

--

*`mongodb.status.locks.oplog.acquire.count.W`*::
+
--
type: long

--

*`mongodb.status.locks.oplog.wait.count.r`*::
+
--
type: long

--

*`mongodb.status.locks.oplog.wait.count.w`*::
+
--
type: long

--

*`mongodb.status.locks.oplog.wait.count.R`*::
+
--
type: long

--

*`mongodb.status.locks.oplog.wait.count.W`*::
+
--
type: long

--

*`mongodb.status.locks.oplog.wait.us.r`*::
+
--
type: long

--

*`mongodb.status.locks.oplog.wait.us.w`*::
+
--
type: long

--

*`mongodb.status.locks.oplog.wait.us.R`*::
+
--
type: long

--

*`mongodb.status.locks.oplog.wait.us.W`*::
+
--
type: long

--

*`mongodb.status.locks.oplog.deadlock.count.r`*::
+
--
type: long

--

*`mongodb.status.locks.oplog.deadlock.count.w`*::
+
--
type: long

--

*`mongodb.status.locks.oplog.deadlock.count.R`*::
+
--
type: long

--

*`mongodb.status.locks.oplog.deadlock.count.W`*::
+
--
type: long

--

[float]
=== network

Platform specific data.



*`mongodb.status.network.in.bytes`*::
+
--
The amount of network traffic, in bytes, received by this database.


type: long

format: bytes

--

*`mongodb.status.network.out.bytes`*::
+
--
The amount of network traffic, in bytes, sent from this database.


type: long

format: bytes

--

*`mongodb.status.network.requests`*::
+
--
The total number of requests received by the server.


type: long

--

[float]
=== ops.latencies

Operation latencies for the database as a whole. Only mongod instances report this metric.



*`mongodb.status.ops.latencies.reads.latency`*::
+
--
Total combined latency in microseconds.


type: long

--

*`mongodb.status.ops.latencies.reads.count`*::
+
--
Total number of read operations performed on the collection since startup.


type: long

--

*`mongodb.status.ops.latencies.writes.latency`*::
+
--
Total combined latency in microseconds.


type: long

--

*`mongodb.status.ops.latencies.writes.count`*::
+
--
Total number of write operations performed on the collection since startup.


type: long

--

*`mongodb.status.ops.latencies.commands.latency`*::
+
--
Total combined latency in microseconds.


type: long

--

*`mongodb.status.ops.latencies.commands.count`*::
+
--
Total number of commands performed on the collection since startup.


type: long

--

[float]
=== ops.counters

An overview of database operations by type.



*`mongodb.status.ops.counters.insert`*::
+
--
The total number of insert operations received since the mongod instance last started.


type: long

--

*`mongodb.status.ops.counters.query`*::
+
--
The total number of queries received since the mongod instance last started.


type: long

--

*`mongodb.status.ops.counters.update`*::
+
--
The total number of update operations received since the mongod instance last started.


type: long

--

*`mongodb.status.ops.counters.delete`*::
+
--
The total number of delete operations received since the mongod instance last started.


type: long

--

*`mongodb.status.ops.counters.getmore`*::
+
--
The total number of getmore operations received since the mongod instance last started.


type: long

--

*`mongodb.status.ops.counters.command`*::
+
--
The total number of commands issued to the database since the mongod instance last started.


type: long

--

[float]
=== ops.replicated

An overview of database replication operations by type.



*`mongodb.status.ops.replicated.insert`*::
+
--
The total number of replicated insert operations received since the mongod instance last started.


type: long

--

*`mongodb.status.ops.replicated.query`*::
+
--
The total number of replicated queries received since the mongod instance last started.


type: long

--

*`mongodb.status.ops.replicated.update`*::
+
--
The total number of replicated update operations received since the mongod instance last started.


type: long

--

*`mongodb.status.ops.replicated.delete`*::
+
--
The total number of replicated delete operations received since the mongod instance last started.


type: long

--

*`mongodb.status.ops.replicated.getmore`*::
+
--
The total number of replicated getmore operations received since the mongod instance last started.


type: long

--

*`mongodb.status.ops.replicated.command`*::
+
--
The total number of replicated commands issued to the database since the mongod instance last started.


type: long

--

[float]
=== memory

Data about the current memory usage of the mongod server.



*`mongodb.status.memory.bits`*::
+
--
Either 64 or 32, depending on which target architecture was specified during the mongod compilation process.


type: long

--

*`mongodb.status.memory.resident.mb`*::
+
--
The amount of RAM, in megabytes (MB), currently used by the database process.


type: long

--

*`mongodb.status.memory.virtual.mb`*::
+
--
The amount, in megabytes (MB), of virtual memory used by the mongod process.


type: long

--

*`mongodb.status.memory.mapped.mb`*::
+
--
The amount of mapped memory, in megabytes (MB), used by the database. Because MongoDB uses memory-mapped files, this value is likely to be to be roughly equivalent to the total size of your database or databases.


type: long

--

*`mongodb.status.memory.mapped_with_journal.mb`*::
+
--
The amount of mapped memory, in megabytes (MB), including the memory used for journaling.


type: long

--

*`mongodb.status.write_backs_queued`*::
+
--
True when there are operations from a mongos instance queued for retrying.


type: boolean

--

*`mongodb.status.storage_engine.name`*::
+
--
A string that represents the name of the current storage engine.


type: keyword

--

[float]
=== wired_tiger

Statistics about the WiredTiger storage engine.



[float]
=== concurrent_transactions

Statistics about the transactions currently in progress.



*`mongodb.status.wired_tiger.concurrent_transactions.write.out`*::
+
--
Number of concurrent write transaction in progress.


type: long

--

*`mongodb.status.wired_tiger.concurrent_transactions.write.available`*::
+
--
Number of concurrent write tickets available.


type: long

--

*`mongodb.status.wired_tiger.concurrent_transactions.write.total_tickets`*::
+
--
Number of total write tickets.


type: long

--

*`mongodb.status.wired_tiger.concurrent_transactions.read.out`*::
+
--
Number of concurrent read transaction in progress.


type: long

--

*`mongodb.status.wired_tiger.concurrent_transactions.read.available`*::
+
--
Number of concurrent read tickets available.


type: long

--

*`mongodb.status.wired_tiger.concurrent_transactions.read.total_tickets`*::
+
--
Number of total read tickets.


type: long

--

[float]
=== cache

Statistics about the cache and page evictions from the cache.



*`mongodb.status.wired_tiger.cache.maximum.bytes`*::
+
--
Maximum cache size.


type: long

format: bytes

--

*`mongodb.status.wired_tiger.cache.used.bytes`*::
+
--
Size in byte of the data currently in cache.


type: long

format: bytes

--

*`mongodb.status.wired_tiger.cache.dirty.bytes`*::
+
--
Size in bytes of the dirty data in the cache.


type: long

format: bytes

--

*`mongodb.status.wired_tiger.cache.pages.read`*::
+
--
Number of pages read into the cache.


type: long

--

*`mongodb.status.wired_tiger.cache.pages.write`*::
+
--
Number of pages written from the cache.


type: long

--

*`mongodb.status.wired_tiger.cache.pages.evicted`*::
+
--
Number of pages evicted from the cache.


type: long

--

[float]
=== log

Statistics about the write ahead log used by WiredTiger.



*`mongodb.status.wired_tiger.log.size.bytes`*::
+
--
Total log size in bytes.


type: long

format: bytes

--

*`mongodb.status.wired_tiger.log.write.bytes`*::
+
--
Number of bytes written into the log.


type: long

format: bytes

--

*`mongodb.status.wired_tiger.log.max_file_size.bytes`*::
+
--
Maximum file size.


type: long

format: bytes

--

*`mongodb.status.wired_tiger.log.flushes`*::
+
--
Number of flush operations.


type: long

--

*`mongodb.status.wired_tiger.log.writes`*::
+
--
Number of write operations.


type: long

--

*`mongodb.status.wired_tiger.log.scans`*::
+
--
Number of scan operations.


type: long

--

*`mongodb.status.wired_tiger.log.syncs`*::
+
--
Number of sync operations.


type: long

--

[float]
=== background_flushing

Data about the process MongoDB uses to write data to disk. This data is only available for instances that use the MMAPv1 storage engine.



*`mongodb.status.background_flushing.flushes`*::
+
--
A counter that collects the number of times the database has flushed all writes to disk.


type: long

--

*`mongodb.status.background_flushing.total.ms`*::
+
--
The total number of milliseconds (ms) that the mongod processes have spent writing (i.e. flushing) data to disk. Because this is an absolute value, consider the value of `flushes` and `average_ms` to provide better context for this datum.


type: long

--

*`mongodb.status.background_flushing.average.ms`*::
+
--
The average time spent flushing to disk per flush event.


type: long

--

*`mongodb.status.background_flushing.last.ms`*::
+
--
The amount of time, in milliseconds, that the last flush operation took to complete.


type: long

--

*`mongodb.status.background_flushing.last_finished`*::
+
--
A timestamp of the last completed flush operation.


type: date

--

[float]
=== journaling

Data about the journaling-related operations and performance. Journaling information only appears for mongod instances that use the MMAPv1 storage engine and have journaling enabled.



*`mongodb.status.journaling.commits`*::
+
--
The number of transactions written to the journal during the last journal group commit interval.


type: long

--

*`mongodb.status.journaling.journaled.mb`*::
+
--
The amount of data in megabytes (MB) written to journal during the last journal group commit interval.


type: long

--

*`mongodb.status.journaling.write_to_data_files.mb`*::
+
--
The amount of data in megabytes (MB) written from journal to the data files during the last journal group commit interval.


type: long

--

*`mongodb.status.journaling.compression`*::
+
--
The compression ratio of the data written to the journal.


type: long

--

*`mongodb.status.journaling.commits_in_write_lock`*::
+
--
Count of the commits that occurred while a write lock was held. Commits in a write lock indicate a MongoDB node under a heavy write load and call for further diagnosis.


type: long

--

*`mongodb.status.journaling.early_commits`*::
+
--
The number of times MongoDB requested a commit before the scheduled journal group commit interval.


type: long

--

[float]
=== times

Information about the performance of the mongod instance during the various phases of journaling in the last journal group commit interval.



*`mongodb.status.journaling.times.dt.ms`*::
+
--
The amount of time over which MongoDB collected the times data. Use this field to provide context to the other times field values.


type: long

--

*`mongodb.status.journaling.times.prep_log_buffer.ms`*::
+
--
The amount of time spent preparing to write to the journal. Smaller values indicate better journal performance.


type: long

--

*`mongodb.status.journaling.times.write_to_journal.ms`*::
+
--
The amount of time spent actually writing to the journal. File system speeds and device interfaces can affect performance.


type: long

--

*`mongodb.status.journaling.times.write_to_data_files.ms`*::
+
--
The amount of time spent writing to data files after journaling. File system speeds and device interfaces can affect performance.


type: long

--

*`mongodb.status.journaling.times.remap_private_view.ms`*::
+
--
The amount of time spent remapping copy-on-write memory mapped views. Smaller values indicate better journal performance.


type: long

--

*`mongodb.status.journaling.times.commits.ms`*::
+
--
The amount of time spent for commits.


type: long

--

*`mongodb.status.journaling.times.commits_in_write_lock.ms`*::
+
--
The amount of time spent for commits that occurred while a write lock was held.


type: long

--

[[exported-fields-mssql]]
== MSSQL fields

MS SQL module


[float]
=== mssql

The root field containing all MSSQL fields


[float]
=== database

The database that the metrics is being referred to


*`mssql.database.id`*::
+
--
Unique ID of the database inside MSSQL

type: long

--

*`mssql.database.name`*::
+
--
Name of the database

type: keyword

--

[float]
=== performance

performance metricset fetches information about the Performance Counters


*`mssql.performance.page_splits_per_sec`*::
+
--
Number of page splits per second that occur as the result of overflowing index pages.

type: long

--

*`mssql.performance.lock_waits_per_sec`*::
+
--
Number of lock requests per second that required the caller to wait.

type: long

--

*`mssql.performance.user_connections`*::
+
--
Total number of user connections

type: long

--

*`mssql.performance.transactions`*::
+
--
Total number of transactions

type: long

--

*`mssql.performance.active_temp_tables`*::
+
--
Number of temporary tables/table variables in use.

type: long

--

*`mssql.performance.connections_reset_per_sec`*::
+
--
Total number of logins started from the connection pool.

type: long

--

*`mssql.performance.logins_per_sec`*::
+
--
Total number of logins started per second. This does not include pooled connections.

type: long

--

*`mssql.performance.logouts_per_sec`*::
+
--
Total number of logout operations started per second.

type: long

--

*`mssql.performance.recompilations_per_sec`*::
+
--
Number of statement recompiles per second. Counts the number of times statement recompiles are triggered. Generally, you want the recompiles to be low.

type: long

--

*`mssql.performance.compilations_per_sec`*::
+
--
Number of SQL compilations per second. Indicates the number of times the compile code path is entered. Includes compiles caused by statement-level recompilations in SQL Server. After SQL Server user activity is stable, this value reaches a steady state.

type: long

--

*`mssql.performance.batch_requests_per_sec`*::
+
--
Number of Transact-SQL command batches received per second. This statistic is affected by all constraints (such as I/O, number of users, cache size, complexity of requests, and so on). High batch requests mean good throughput.

type: long

--


[float]
=== cache_hit

Indicates the percentage of pages found in the buffer cache without having to read from disk.


*`mssql.performance.buffer.cache_hit.pct`*::
+
--
The ratio is the total number of cache hits divided by the total number of cache lookups over the last few thousand page accesses. After a long period of time, the ratio moves very little. Because reading from the cache is much less expensive than reading from disk, you want this ratio to be high

type: double

--

[float]
=== page_life_expectancy

Indicates the number of seconds a page will stay in the buffer pool without references.


*`mssql.performance.buffer.page_life_expectancy.sec`*::
+
--
Indicates the number of seconds a page will stay in the buffer pool without references (in seconds).

type: long

--

*`mssql.performance.buffer.checkpoint_pages_per_sec`*::
+
--
Indicates the number of pages flushed to disk per second by a checkpoint or other operation that require all dirty pages to be flushed.

type: long

--

*`mssql.performance.buffer.database_pages`*::
+
--
Indicates the number of pages in the buffer pool with database content.

type: long

--

*`mssql.performance.buffer.target_pages`*::
+
--
Ideal number of pages in the buffer pool.

type: long

--

[float]
=== transaction_log

transaction_log metricset will fetch information about the operation and transaction log of each database from a MSSQL instance


[float]
=== space_usage

Space usage information for the transaction log


[float]
=== since_last_backup

The amount of space used since the last log backup


*`mssql.transaction_log.space_usage.since_last_backup.bytes`*::
+
--
The amount of space used since the last log backup in bytes

type: long

--

[float]
=== total

The size of the log


*`mssql.transaction_log.space_usage.total.bytes`*::
+
--
The size of the log in bytes

type: long

--

[float]
=== used

The occupied size of the log


*`mssql.transaction_log.space_usage.used.bytes`*::
+
--
The occupied size of the log in bytes

type: long

--

*`mssql.transaction_log.space_usage.used.pct`*::
+
--
A percentage of the occupied size of the log as a percent of the total log size

type: float

--

[float]
=== stats

Returns summary level attributes and information on transaction log files of databases. Use this information for monitoring and diagnostics of transaction log health.


[float]
=== active_size

Total active transaction log size.


*`mssql.transaction_log.stats.active_size.bytes`*::
+
--
Total active transaction log size in bytes

type: long

--

*`mssql.transaction_log.stats.backup_time`*::
+
--
Last transaction log backup time.

type: date

--

[float]
=== recovery_size

Log size since log recovery log sequence number (LSN).


*`mssql.transaction_log.stats.recovery_size.bytes`*::
+
--
Log size in bytes since log recovery log sequence number (LSN).

type: long

--

[float]
=== since_last_checkpoint

Log size since last checkpoint log sequence number (LSN).


*`mssql.transaction_log.stats.since_last_checkpoint.bytes`*::
+
--
Log size in bytes since last checkpoint log sequence number (LSN).

type: long

--

[float]
=== total_size

Total transaction log size.


*`mssql.transaction_log.stats.total_size.bytes`*::
+
--
Total transaction log size in bytes.

type: long

--

[[exported-fields-munin]]
== Munin fields

Munin node metrics exporter



*`munin.metrics.*`*::
+
--
Metrics exposed by a plugin of a munin node agent.


type: object

--

*`munin.plugin.name`*::
+
--
Name of the plugin collecting these metrics.


type: keyword

--


[[exported-fields-mysql]]
== MySQL fields

MySQL server status metrics collected from MySQL.



[float]
=== mysql

`mysql` contains the metrics that were obtained from MySQL query.



[float]
=== galera_status

`galera_status` contains the metrics that were obtained by the status SQL query on Galera.



[float]
=== apply

Apply status fields.



*`mysql.galera_status.apply.oooe`*::
+
--
How often applier started write-set applying out-of-order (parallelization efficiency).


type: double

--

*`mysql.galera_status.apply.oool`*::
+
--
How often write-set was so slow to apply that write-set with higher seqno's were applied earlier. Values closer to 0 refer to a greater gap between slow and fast write-sets.


type: double

--

*`mysql.galera_status.apply.window`*::
+
--
Average distance between highest and lowest concurrently applied seqno.


type: double

--

[float]
=== cert

Certification status fields.



*`mysql.galera_status.cert.deps_distance`*::
+
--
Average distance between highest and lowest seqno value that can be possibly applied in parallel (potential degree of parallelization).


type: double

--

*`mysql.galera_status.cert.index_size`*::
+
--
The number of entries in the certification index.


type: long

--

*`mysql.galera_status.cert.interval`*::
+
--
Average number of transactions received while a transaction replicates.


type: double

--

[float]
=== cluster

Cluster status fields.



*`mysql.galera_status.cluster.conf_id`*::
+
--
Total number of cluster membership changes happened.


type: long

--

*`mysql.galera_status.cluster.size`*::
+
--
Current number of members in the cluster.


type: long

--

*`mysql.galera_status.cluster.status`*::
+
--
Status of this cluster component. That is, whether the node is part of a PRIMARY or NON_PRIMARY component.


type: keyword

--

[float]
=== commit

Commit status fields.



*`mysql.galera_status.commit.oooe`*::
+
--
How often a transaction was committed out of order.


type: double

--

*`mysql.galera_status.commit.window`*::
+
--
Average distance between highest and lowest concurrently committed seqno.


type: long

--

*`mysql.galera_status.connected`*::
+
--
If the value is OFF, the node has not yet connected to any of the cluster components. This may be due to misconfiguration. Check the error log for proper diagnostics.


type: keyword

--

[float]
=== evs

Evs Fields.



*`mysql.galera_status.evs.evict`*::
+
--
Lists the UUID's of all nodes evicted from the cluster. Evicted nodes cannot rejoin the cluster until you restart their mysqld processes.


type: keyword

--

*`mysql.galera_status.evs.state`*::
+
--
Shows the internal state of the EVS Protocol.


type: keyword

--

[float]
=== flow_ctl

Flow Control fields.



*`mysql.galera_status.flow_ctl.paused`*::
+
--
The fraction of time since the last FLUSH STATUS command that replication was paused due to flow control. In other words, how much the slave lag is slowing down the cluster.


type: double

--

*`mysql.galera_status.flow_ctl.paused_ns`*::
+
--
The total time spent in a paused state measured in nanoseconds.


type: long

--

*`mysql.galera_status.flow_ctl.recv`*::
+
--
Returns the number of FC_PAUSE events the node has received, including those the node has sent. Unlike most status variables, the counter for this one does not reset every time you run the query.


type: long

--

*`mysql.galera_status.flow_ctl.sent`*::
+
--
Returns the number of FC_PAUSE events the node has sent. Unlike most status variables, the counter for this one does not reset every time you run the query.


type: long

--

*`mysql.galera_status.last_committed`*::
+
--
The sequence number, or seqno, of the last committed transaction.


type: long

--

[float]
=== local

Node specific Cluster status fields.



*`mysql.galera_status.local.bf_aborts`*::
+
--
Total number of local transactions that were aborted by slave transactions while in execution.


type: long

--

*`mysql.galera_status.local.cert_failures`*::
+
--
Total number of local transactions that failed certification test.


type: long

--

*`mysql.galera_status.local.commits`*::
+
--
Total number of local transactions committed.


type: long

--

[float]
=== recv

Node specific recv fields.



*`mysql.galera_status.local.recv.queue`*::
+
--
Current (instantaneous) length of the recv queue.


type: long

--

*`mysql.galera_status.local.recv.queue_avg`*::
+
--
Recv queue length averaged over interval since the last FLUSH STATUS command. Values considerably larger than 0.0 mean that the node cannot apply write-sets as fast as they are received and will generate a lot of replication throttling.


type: double

--

*`mysql.galera_status.local.recv.queue_max`*::
+
--
The maximum length of the recv queue since the last FLUSH STATUS command.


type: long

--

*`mysql.galera_status.local.recv.queue_min`*::
+
--
The minimum length of the recv queue since the last FLUSH STATUS command.


type: long

--

*`mysql.galera_status.local.replays`*::
+
--
Total number of transaction replays due to asymmetric lock granularity.


type: long

--

[float]
=== send

Node specific sent fields.



*`mysql.galera_status.local.send.queue`*::
+
--
Current (instantaneous) length of the send queue.


type: long

--

*`mysql.galera_status.local.send.queue_avg`*::
+
--
Send queue length averaged over time since the last FLUSH STATUS command. Values considerably larger than 0.0 indicate replication throttling or network throughput issue.


type: double

--

*`mysql.galera_status.local.send.queue_max`*::
+
--
The maximum length of the send queue since the last FLUSH STATUS command.


type: long

--

*`mysql.galera_status.local.send.queue_min`*::
+
--
The minimum length of the send queue since the last FLUSH STATUS command.


type: long

--

*`mysql.galera_status.local.state`*::
+
--
Internal Galera Cluster FSM state number.


type: keyword

--

*`mysql.galera_status.ready`*::
+
--
Whether the server is ready to accept queries.


type: keyword

--

[float]
=== received

Write-Set receive status fields.



*`mysql.galera_status.received.count`*::
+
--
Total number of write-sets received from other nodes.


type: long

--

*`mysql.galera_status.received.bytes`*::
+
--
Total size of write-sets received from other nodes.


type: long

--

[float]
=== repl

Replication status fields.



*`mysql.galera_status.repl.data_bytes`*::
+
--
Total size of data replicated.


type: long

--

*`mysql.galera_status.repl.keys`*::
+
--
Total number of keys replicated.


type: long

--

*`mysql.galera_status.repl.keys_bytes`*::
+
--
Total size of keys replicated.


type: long

--

*`mysql.galera_status.repl.other_bytes`*::
+
--
Total size of other bits replicated.


type: long

--

*`mysql.galera_status.repl.count`*::
+
--
Total number of write-sets replicated (sent to other nodes).


type: long

--

*`mysql.galera_status.repl.bytes`*::
+
--
Total size of write-sets replicated.


type: long

--

[float]
=== performance

`performance` contains metrics related to the performance of a MySQL instance



[float]
=== events_statements

Records statement events summarized by schema and digest


*`mysql.performance.events_statements.max.timer.wait`*::
+
--
Maximum wait time of the summarized events that are timed

type: long

--

*`mysql.performance.events_statements.last.seen`*::
+
--
Time at which the digest was most recently seen

type: date

--

*`mysql.performance.events_statements.quantile.95`*::
+
--
The 95th percentile of the statement latency, in picoseconds

type: long

--

*`mysql.performance.events_statements.digest`*::
+
--
Performance schema digest

type: text

--

*`mysql.performance.events_statements.count.star`*::
+
--
Number of summarized events

type: long

--

*`mysql.performance.events_statements.avg.timer.wait`*::
+
--
Average wait time of the summarized events that are timed

type: long

--

[float]
=== table_io_waits

Records table I/O waits by index



*`mysql.performance.table_io_waits.object.schema`*::
+
--
Schema name

type: keyword

--

*`mysql.performance.table_io_waits.object.name`*::
+
--
Table name

type: keyword

--

*`mysql.performance.table_io_waits.index.name`*::
+
--
Name of the index that was used when the table I/O wait event was recorded. PRIMARY indicates that table I/O used the primary index. NULL means that table I/O used no index. Inserts are counted against INDEX_NAME = NULL


type: keyword

--

*`mysql.performance.table_io_waits.count.fetch`*::
+
--
Number of all fetch operations > 0

type: long

--

[float]
=== query

`query` metricset fetches custom queries from the user to a MySQL instance.


[float]
=== status

`status` contains the metrics that were obtained by the status SQL query.



[float]
=== aborted

Aborted status fields.



*`mysql.status.aborted.clients`*::
+
--
The number of connections that were aborted because the client died without closing the connection properly.


type: long

--

*`mysql.status.aborted.connects`*::
+
--
The number of failed attempts to connect to the MySQL server.


type: long

--

[float]
=== connection




[float]
=== errors




*`mysql.status.connection.errors.peer_address`*::
+
--
The number of errors that occurred while searching for connecting client IP addresses.

type: long

--

*`mysql.status.connection.errors.accept`*::
+
--
The number of errors that occurred during calls to accept() on the listening port.

type: long

--

*`mysql.status.connection.errors.internal`*::
+
--
The number of connections refused due to internal errors in the server, such as failure to start a new thread or an out-of-memory condition.


type: long

--

*`mysql.status.connection.errors.max`*::
+
--
The number of connections refused because the server max_connections limit was reached. thread or an out-of-memory condition.

type: long

--

*`mysql.status.connection.errors.tcpwrap`*::
+
--
The number of connections refused by the libwrap library.

type: long

--

*`mysql.status.connection.errors.select`*::
+
--
The number of errors that occurred during calls to select() or poll() on the listening port. (Failure of this operation does not necessarily means a client connection was rejected.)


type: long

--

[float]
=== cache




[float]
=== ssl

SSL session cache hits and misses.


*`mysql.status.cache.ssl.hits`*::
+
--
The number of SSL session cache hits.

type: long

--

*`mysql.status.cache.ssl.misses`*::
+
--
The number of SSL session cache misses.

type: long

--

*`mysql.status.cache.ssl.size`*::
+
--
The SSL session cache size.

type: long

--

[float]
=== table




[float]
=== open_cache




*`mysql.status.cache.table.open_cache.hits`*::
+
--
The number of hits for open tables cache lookups.

type: long

--

*`mysql.status.cache.table.open_cache.misses`*::
+
--
The number of misses for open tables cache lookups.

type: long

--

*`mysql.status.cache.table.open_cache.overflows`*::
+
--
Number of times, after a table is opened or closed, a cache instance has an unused entry and the size of the instance is larger than table_open_cache / table_open_cache_instances


type: long

--

[float]
=== binlog




*`mysql.status.binlog.cache.disk_use`*::
+
--


type: long

--

*`mysql.status.binlog.cache.use`*::
+
--


type: long

--

[float]
=== bytes

Bytes stats.



*`mysql.status.bytes.received`*::
+
--
The number of bytes received from all clients.


type: long

format: bytes

--

*`mysql.status.bytes.sent`*::
+
--
The number of bytes sent to all clients.


type: long

format: bytes

--

[float]
=== threads

Threads stats.



*`mysql.status.threads.cached`*::
+
--
The number of cached threads.


type: long

--

*`mysql.status.threads.created`*::
+
--
The number of created threads.


type: long

--

*`mysql.status.threads.connected`*::
+
--
The number of connected threads.


type: long

--

*`mysql.status.threads.running`*::
+
--
The number of running threads.


type: long

--

*`mysql.status.connections`*::
+
--


type: long

--

[float]
=== created




*`mysql.status.created.tmp.disk_tables`*::
+
--


type: long

--

*`mysql.status.created.tmp.files`*::
+
--


type: long

--

*`mysql.status.created.tmp.tables`*::
+
--


type: long

--

[float]
=== delayed




*`mysql.status.delayed.errors`*::
+
--


type: long

--

*`mysql.status.delayed.insert_threads`*::
+
--


type: long

--

*`mysql.status.delayed.writes`*::
+
--


type: long

--

*`mysql.status.flush_commands`*::
+
--


type: long

--

*`mysql.status.max_used_connections`*::
+
--


type: long

--

[float]
=== open




*`mysql.status.open.files`*::
+
--


type: long

--

*`mysql.status.open.streams`*::
+
--


type: long

--

*`mysql.status.open.tables`*::
+
--


type: long

--

*`mysql.status.opened_tables`*::
+
--


type: long

--

[float]
=== command




*`mysql.status.command.delete`*::
+
--
The number of DELETE queries since startup.


type: long

--

*`mysql.status.command.insert`*::
+
--
The number of INSERT queries since startup.


type: long

--

*`mysql.status.command.select`*::
+
--
The number of SELECT queries since startup.


type: long

--

*`mysql.status.command.update`*::
+
--
The number of UPDATE queries since startup.


type: long

--

*`mysql.status.queries`*::
+
--
The number of statements executed by the server. This variable includes statements executed within stored programs, unlike the Questions variable. It does not count COM_PING or COM_STATISTICS commands.


type: long

--

*`mysql.status.questions`*::
+
--
The number of statements executed by the server. This includes only statements sent to the server by clients and not statements executed within stored programs, unlike the Queries variable. This variable does not count COM_PING, COM_STATISTICS, COM_STMT_PREPARE, COM_STMT_CLOSE, or COM_STMT_RESET commands.


type: long

--

[float]
=== handler




*`mysql.status.handler.commit`*::
+
--
The number of internal COMMIT statements.


type: long

--

*`mysql.status.handler.delete`*::
+
--
The number of times that rows have been deleted from tables.


type: long

--

*`mysql.status.handler.external_lock`*::
+
--
The server increments this variable for each call to its external_lock() function, which generally occurs at the beginning and end of access to a table instance.


type: long

--

*`mysql.status.handler.mrr_init`*::
+
--
The number of times the server uses a storage engine's own Multi-Range Read implementation for table access.


type: long

--

*`mysql.status.handler.prepare`*::
+
--
A counter for the prepare phase of two-phase commit operations.


type: long

--

[float]
=== read




*`mysql.status.handler.read.first`*::
+
--
The number of times the first entry in an index was read.


type: long

--

*`mysql.status.handler.read.key`*::
+
--
The number of requests to read a row based on a key.


type: long

--

*`mysql.status.handler.read.last`*::
+
--
The number of requests to read the last key in an index.


type: long

--

*`mysql.status.handler.read.next`*::
+
--
The number of requests to read the next row in key order.


type: long

--

*`mysql.status.handler.read.prev`*::
+
--
The number of requests to read the previous row in key order.


type: long

--

*`mysql.status.handler.read.rnd`*::
+
--
The number of requests to read a row based on a fixed position.


type: long

--

*`mysql.status.handler.read.rnd_next`*::
+
--
The number of requests to read the next row in the data file.


type: long

--

*`mysql.status.handler.rollback`*::
+
--
The number of requests for a storage engine to perform a rollback operation.


type: long

--

*`mysql.status.handler.savepoint`*::
+
--
The number of requests for a storage engine to place a savepoint.


type: long

--

*`mysql.status.handler.savepoint_rollback`*::
+
--
The number of requests for a storage engine to roll back to a savepoint.


type: long

--

*`mysql.status.handler.update`*::
+
--
The number of requests to update a row in a table.


type: long

--

*`mysql.status.handler.write`*::
+
--
The number of requests to insert a row in a table.


type: long

--

[float]
=== innodb




[float]
=== rows




*`mysql.status.innodb.rows.reads`*::
+
--
The number of rows reads into InnoDB tables.

type: long

--

*`mysql.status.innodb.rows.inserted`*::
+
--
The number of rows inserted into InnoDB tables.

type: long

--

*`mysql.status.innodb.rows.deleted`*::
+
--
The number of rows deleted into InnoDB tables.

type: long

--

*`mysql.status.innodb.rows.updated`*::
+
--
The number of rows updated into InnoDB tables.

type: long

--

[float]
=== buffer_pool




*`mysql.status.innodb.buffer_pool.dump_status`*::
+
--
The progress of an operation to record the pages held in the InnoDB buffer pool, triggered by the setting of innodb_buffer_pool_dump_at_shutdown or innodb_buffer_pool_dump_now.


type: long

--

*`mysql.status.innodb.buffer_pool.load_status`*::
+
--
The progress of an operation to warm up the InnoDB buffer pool by reading in a set of pages corresponding to an earlier point in time, triggered by the setting of innodb_buffer_pool_load_at_startup or innodb_buffer_pool_load_now.


type: long

--

[float]
=== bytes




*`mysql.status.innodb.buffer_pool.bytes.data`*::
+
--
The total number of bytes in the InnoDB buffer pool containing data.


type: long

--

*`mysql.status.innodb.buffer_pool.bytes.dirty`*::
+
--
The total current number of bytes held in dirty pages in the InnoDB buffer pool.


type: long

--

[float]
=== pages




*`mysql.status.innodb.buffer_pool.pages.data`*::
+
--
The number of pages in the InnoDB buffer pool containing data.


type: long

--

*`mysql.status.innodb.buffer_pool.pages.dirty`*::
+
--
The current number of dirty pages in the InnoDB buffer pool.


type: long

--

*`mysql.status.innodb.buffer_pool.pages.flushed`*::
+
--
The number of requests to flush pages from the InnoDB buffer pool.


type: long

--

*`mysql.status.innodb.buffer_pool.pages.free`*::
+
--
The number of free pages in the InnoDB buffer pool.


type: long

--

*`mysql.status.innodb.buffer_pool.pages.latched`*::
+
--
The number of latched pages in the InnoDB buffer pool.


type: long

--

*`mysql.status.innodb.buffer_pool.pages.misc`*::
+
--
The number of pages in the InnoDB buffer pool that are busy because they have been allocated for administrative overhead, such as row locks or the adaptive hash index.


type: long

--

*`mysql.status.innodb.buffer_pool.pages.total`*::
+
--
The total size of the InnoDB buffer pool, in pages.


type: long

--

[float]
=== read




*`mysql.status.innodb.buffer_pool.read.ahead`*::
+
--
The number of pages read into the InnoDB buffer pool by the read-ahead background thread.


type: long

--

*`mysql.status.innodb.buffer_pool.read.ahead_evicted`*::
+
--
The number of pages read into the InnoDB buffer pool by the read-ahead background thread that were subsequently evicted without having been accessed by queries.


type: long

--

*`mysql.status.innodb.buffer_pool.read.ahead_rnd`*::
+
--
The number of "random" read-aheads initiated by InnoDB.


type: long

--

*`mysql.status.innodb.buffer_pool.read.requests`*::
+
--
The number of logical read requests.


type: long

--

[float]
=== pool




*`mysql.status.innodb.buffer_pool.pool.reads`*::
+
--
The number of logical reads that InnoDB could not satisfy from the buffer pool, and had to read directly from disk.


type: long

--

*`mysql.status.innodb.buffer_pool.pool.resize_status`*::
+
--
The status of an operation to resize the InnoDB buffer pool dynamically, triggered by setting the innodb_buffer_pool_size parameter dynamically.


type: long

--

*`mysql.status.innodb.buffer_pool.pool.wait_free`*::
+
--
Normally, writes to the InnoDB buffer pool happen in the background. When InnoDB needs to read or create a page and no clean pages are available, InnoDB flushes some dirty pages first and waits for that operation to finish. This counter counts instances of these waits.


type: long

--

*`mysql.status.innodb.buffer_pool.write_requests`*::
+
--
The number of writes done to the InnoDB buffer pool.


type: long

--

[[exported-fields-nats]]
== NATS fields

nats Module



[float]
=== nats

`nats` contains statistics that were read from Nats



*`nats.server.id`*::
+
--
The server ID


type: keyword

--

*`nats.server.time`*::
+
--

deprecated:[8.0.0]

Server time of metric creation


type: date

--

[float]
=== connection

Contains nats connection related metrics



*`nats.connection.name`*::
+
--
The name of the connection


type: keyword

--

*`nats.connection.subscriptions`*::
+
--
The number of subscriptions in this connection


type: integer

--

*`nats.connection.pending_bytes`*::
+
--
The number of pending bytes of this connection


type: long

format: bytes

--

*`nats.connection.uptime`*::
+
--
The period the connection is up (sec)


type: long

format: duration

--

*`nats.connection.idle_time`*::
+
--
The period the connection is idle (sec)


type: long

format: duration

--

[float]
=== in

The amount of incoming data



*`nats.connection.in.messages`*::
+
--
The amount of incoming messages


type: long

--

*`nats.connection.in.bytes`*::
+
--
The amount of incoming bytes


type: long

format: bytes

--

[float]
=== out

The amount of outgoing data



*`nats.connection.out.messages`*::
+
--
The amount of outgoing messages


type: long

--

*`nats.connection.out.bytes`*::
+
--
The amount of outgoing bytes


type: long

format: bytes

--

[float]
=== connections

Contains nats connection related metrics



*`nats.connections.total`*::
+
--
The number of currently active clients


type: integer

--

[float]
=== route

Contains nats route related metrics



*`nats.route.subscriptions`*::
+
--
The number of subscriptions in this connection


type: integer

--

*`nats.route.remote_id`*::
+
--
The remote id on which the route is connected to


type: keyword

--

*`nats.route.pending_size`*::
+
--
The number of pending routes


type: long

--

*`nats.route.port`*::
+
--
The port of the route


type: integer

--

*`nats.route.ip`*::
+
--
The ip of the route


type: ip

--

[float]
=== in

The amount of incoming data



*`nats.route.in.messages`*::
+
--
The amount of incoming messages


type: long

--

*`nats.route.in.bytes`*::
+
--
The amount of incoming bytes


type: long

format: bytes

--

[float]
=== out

The amount of outgoing data



*`nats.route.out.messages`*::
+
--
The amount of outgoing messages


type: long

--

*`nats.route.out.bytes`*::
+
--
The amount of outgoing bytes


type: long

format: bytes

--

[float]
=== routes

Contains nats route related metrics



*`nats.routes.total`*::
+
--
The number of registered routes


type: integer

--

[float]
=== stats

Contains nats var related metrics



*`nats.stats.uptime`*::
+
--
The period the server is up (sec)


type: long

format: duration

--

*`nats.stats.mem.bytes`*::
+
--
The current memory usage of NATS process


type: long

format: bytes

--

*`nats.stats.cores`*::
+
--
The number of logical cores the NATS process runs on


type: integer

--

*`nats.stats.cpu`*::
+
--
The current cpu usage of NATs process


type: scaled_float

format: percent

--

*`nats.stats.total_connections`*::
+
--
The number of totally created clients


type: long

--

*`nats.stats.remotes`*::
+
--
The number of registered remotes


type: integer

--

[float]
=== in

The amount of incoming data



*`nats.stats.in.messages`*::
+
--
The amount of incoming messages


type: long

--

*`nats.stats.in.bytes`*::
+
--
The amount of incoming bytes


type: long

format: bytes

--

[float]
=== out

The amount of outgoing data



*`nats.stats.out.messages`*::
+
--
The amount of outgoing messages


type: long

--

*`nats.stats.out.bytes`*::
+
--
The amount of outgoing bytes


type: long

format: bytes

--

*`nats.stats.slow_consumers`*::
+
--
The number of slow consumers currently on NATS


type: long

--

[float]
=== http

The http metrics of NATS server



[float]
=== req_stats

The requests statistics



[float]
=== uri

The request distribution on monitoring URIS



*`nats.stats.http.req_stats.uri.routez`*::
+
--
The number of hits on routez monitoring uri


type: long

--

*`nats.stats.http.req_stats.uri.connz`*::
+
--
The number of hits on connz monitoring uri


type: long

--

*`nats.stats.http.req_stats.uri.varz`*::
+
--
The number of hits on varz monitoring uri


type: long

--

*`nats.stats.http.req_stats.uri.subsz`*::
+
--
The number of hits on subsz monitoring uri


type: long

--

*`nats.stats.http.req_stats.uri.root`*::
+
--
The number of hits on root monitoring uri


type: long

--

[float]
=== subscriptions

Contains nats subscriptions related metrics



*`nats.subscriptions.total`*::
+
--
The number of active subscriptions


type: integer

--

*`nats.subscriptions.inserts`*::
+
--
The number of insert operations in subscriptions list


type: long

--

*`nats.subscriptions.removes`*::
+
--
The number of remove operations in subscriptions list


type: long

--

*`nats.subscriptions.matches`*::
+
--
The number of times a match is found for a subscription


type: long

--

*`nats.subscriptions.cache.size`*::
+
--
The number of result sets in the cache


type: integer

--

*`nats.subscriptions.cache.hit_rate`*::
+
--
The rate matches are being retrieved from cache


type: scaled_float

format: percent

--

*`nats.subscriptions.cache.fanout.max`*::
+
--
The maximum fanout served by cache


type: integer

--

*`nats.subscriptions.cache.fanout.avg`*::
+
--
The average fanout served by cache


type: double

--

[[exported-fields-nginx]]
== Nginx fields

Nginx server status metrics collected from various modules.



[float]
=== nginx

`nginx` contains the metrics that were scraped from nginx.



[float]
=== stubstatus

`stubstatus` contains the metrics that were scraped from the ngx_http_stub_status_module status page.



*`nginx.stubstatus.hostname`*::
+
--
Nginx hostname.


type: keyword

--

*`nginx.stubstatus.active`*::
+
--
The current number of active client connections including Waiting connections.


type: long

--

*`nginx.stubstatus.accepts`*::
+
--
The total number of accepted client connections.


type: long

--

*`nginx.stubstatus.handled`*::
+
--
The total number of handled client connections.


type: long

--

*`nginx.stubstatus.dropped`*::
+
--
The total number of dropped client connections.


type: long

--

*`nginx.stubstatus.requests`*::
+
--
The total number of client requests.


type: long

--

*`nginx.stubstatus.current`*::
+
--
The current number of client requests.


type: long

--

*`nginx.stubstatus.reading`*::
+
--
The current number of connections where Nginx is reading the request header.


type: long

--

*`nginx.stubstatus.writing`*::
+
--
The current number of connections where Nginx is writing the response back to the client.


type: long

--

*`nginx.stubstatus.waiting`*::
+
--
The current number of idle client connections waiting for a request.


type: long

--

[[exported-fields-openmetrics]]
== Openmetrics fields

Openmetrics module



[float]
=== openmetrics

`openmetrics` contains metrics from endpoints that are following Openmetrics format.



*`openmetrics.labels.*`*::
+
--
Prometheus metric labels


type: object

--

*`openmetrics.metrics.*`*::
+
--
Prometheus metric


type: object

--

[[exported-fields-oracle]]
== Oracle fields

Oracle database module


[float]
=== oracle

Oracle module


[float]
=== performance

Performance related metrics on a single database instance


*`oracle.performance.machine`*::
+
--
Operating system machine name

type: keyword

--

*`oracle.performance.buffer_pool`*::
+
--
Name of the buffer pool in the instance

type: keyword

--

*`oracle.performance.username`*::
+
--
Oracle username

type: keyword

--

*`oracle.performance.io_reloads`*::
+
--
Reloads / Pins ratio. A Reload is any PIN of an object that is not the first PIN performed since the object handle was created, and which requires loading the object from disk. Pins are the number of times a PIN was requested for objects of this namespace

type: double

--

*`oracle.performance.lock_requests`*::
+
--
Average of the ratio between 'gethits' and 'gets' being 'Gethits' the number of times an object's handle was found in memory and 'gets' the number of times a lock was requested for objects of this namespace.

type: long

--

*`oracle.performance.pin_requests`*::
+
--
Average of all pinhits/pins ratios being 'PinHits' the number of times all of the metadata pieces of the library object were found in memory and 'pins' the number of times a PIN was requested for objects of this namespace

type: double

--

[float]
=== cache

Statistics about all buffer pools available for the instance


*`oracle.performance.cache.buffer.hit.pct`*::
+
--
The cache hit ratio of the specified buffer pool.

type: double

--

*`oracle.performance.cache.physical_reads`*::
+
--
Physical reads

type: long

--

[float]
=== get

Buffer pool 'get' statistics


*`oracle.performance.cache.get.consistent`*::
+
--
Consistent gets statistic

type: long

--

*`oracle.performance.cache.get.db_blocks`*::
+
--
Database blocks gotten

type: long

--

[float]
=== cursors

Cursors information


*`oracle.performance.cursors.avg`*::
+
--
Average cursors opened by username and machine

type: double

--

*`oracle.performance.cursors.max`*::
+
--
Max cursors opened by username and machine

type: double

--

*`oracle.performance.cursors.total`*::
+
--
Total opened cursors by username and machine

type: double

--

[float]
=== opened

Opened cursors statistic


*`oracle.performance.cursors.opened.current`*::
+
--
Total number of current open cursors

type: long

--

*`oracle.performance.cursors.opened.total`*::
+
--
Total number of cursors opened since the instance started

type: long

--

[float]
=== parse

Parses statistic information that occured in the current session


*`oracle.performance.cursors.parse.real`*::
+
--
Real number of parses that occurred: session cursor cache hits - parse count (total)

type: long

--

*`oracle.performance.cursors.parse.total`*::
+
--
Total number of parse calls (hard and soft). A soft parse is a check on an object already in the shared pool, to verify that the permissions on the underlying object have not changed.

type: long

--

*`oracle.performance.cursors.session.cache_hits`*::
+
--
Number of hits in the session cursor cache. A hit means that the SQL statement did not have to be reparsed.

type: long

--

*`oracle.performance.cursors.cache_hit.pct`*::
+
--
Ratio of session cursor cache hits from total number of cursors

type: double

--

[float]
=== tablespace

tablespace


*`oracle.tablespace.name`*::
+
--
Tablespace name

type: keyword

--

[float]
=== data_file

Database files information


*`oracle.tablespace.data_file.id`*::
+
--
Tablespace unique identifier

type: long

--

*`oracle.tablespace.data_file.name`*::
+
--
Filename of the data file

type: keyword

--

[float]
=== size

Size information about the file


*`oracle.tablespace.data_file.size.max.bytes`*::
+
--
Maximum file size in bytes

type: long

format: bytes

--

*`oracle.tablespace.data_file.size.bytes`*::
+
--
Size of the file in bytes

type: long

format: bytes

--

*`oracle.tablespace.data_file.size.free.bytes`*::
+
--
The size of the file available for user data. The actual size of the file minus this value is used to store file related metadata.


type: long

format: bytes

--

*`oracle.tablespace.data_file.status`*::
+
--
'File status: AVAILABLE or INVALID (INVALID means that the file number is not in use, for example, a file in a tablespace that was dropped)'


type: keyword

--

*`oracle.tablespace.data_file.online_status`*::
+
--
Last known online status of the data file. One of SYSOFF, SYSTEM, OFFLINE, ONLINE or RECOVER.

type: keyword

--

[float]
=== space

Tablespace space usage information


*`oracle.tablespace.space.free.bytes`*::
+
--
Tablespace total free space available, in bytes.

type: long

format: bytes

--

*`oracle.tablespace.space.used.bytes`*::
+
--
Tablespace used space, in bytes.

type: long

format: bytes

--

*`oracle.tablespace.space.total.bytes`*::
+
--
Tablespace total size, in bytes.

type: long

format: bytes

--

[[exported-fields-php_fpm]]
== PHP_FPM fields

PHP-FPM server status metrics collected from PHP-FPM.



[float]
=== php_fpm

`php_fpm` contains the metrics that were obtained from PHP-FPM status page call.



[float]
=== pool

`pool` contains the metrics that were obtained from the PHP-FPM process pool.



*`php_fpm.pool.name`*::
+
--
The name of the pool.


type: keyword

--

[float]
=== pool

`pool` contains the metrics that were obtained from the PHP-FPM process pool.



*`php_fpm.pool.process_manager`*::
+
--
Static, dynamic or ondemand.


type: keyword

--

[float]
=== connections

Connection state specific statistics.



*`php_fpm.pool.connections.accepted`*::
+
--
The number of incoming requests that the PHP-FPM server has accepted; when a connection is accepted it is removed from the listen queue.


type: long

--

*`php_fpm.pool.connections.queued`*::
+
--
The current number of connections that have been initiated, but not yet accepted. If this value is non-zero it typically means that all the available server processes are currently busy, and there are no processes available to serve the next request. Raising `pm.max_children` (provided the server can handle it) should help keep this number low. This property follows from the fact that PHP-FPM listens via a socket (TCP or file based), and thus inherits some of the characteristics of sockets.


type: long

--

*`php_fpm.pool.connections.max_listen_queue`*::
+
--
The maximum number of requests in the queue of pending connections since FPM has started.


type: long

--

*`php_fpm.pool.connections.listen_queue_len`*::
+
--
The size of the socket queue of pending connections.


type: long

--

[float]
=== processes

Process state specific statistics.



*`php_fpm.pool.processes.idle`*::
+
--
The number of servers in the `waiting to process` state (i.e. not currently serving a page). This value should fall between the `pm.min_spare_servers` and `pm.max_spare_servers` values when the process manager is `dynamic`.


type: long

--

*`php_fpm.pool.processes.active`*::
+
--
The number of servers current processing a page - the minimum is `1` (so even on a fully idle server, the result will be not read `0`).


type: long

--

*`php_fpm.pool.processes.total`*::
+
--
The number of idle + active processes.


type: long

--

*`php_fpm.pool.processes.max_active`*::
+
--
The maximum number of active processes since FPM has started.


type: long

--

*`php_fpm.pool.processes.max_children_reached`*::
+
--
Number of times, the process limit has been reached, when pm tries to start more children (works only for pm 'dynamic' and 'ondemand').


type: long

--

*`php_fpm.pool.slow_requests`*::
+
--
The number of times a request execution time has exceeded `request_slowlog_timeout`.


type: long

--

*`php_fpm.pool.start_since`*::
+
--
Number of seconds since FPM has started.


type: long

--

*`php_fpm.pool.start_time`*::
+
--
The date and time FPM has started.


type: date

--

[float]
=== process

process contains the metrics that were obtained from the PHP-FPM process.



*`php_fpm.process.pid`*::
+
--
The PID of the process


type: alias

alias to: process.pid

--

*`php_fpm.process.state`*::
+
--
The state of the process (Idle, Running, etc)


type: keyword

--

*`php_fpm.process.start_time`*::
+
--
The date and time the process has started


type: date

--

*`php_fpm.process.start_since`*::
+
--
The number of seconds since the process has started


type: integer

--

*`php_fpm.process.requests`*::
+
--
The number of requests the process has served


type: integer

--

*`php_fpm.process.request_duration`*::
+
--
The duration in microseconds (1 million in a second) of the current request (my own definition)


type: integer

--

*`php_fpm.process.request_method`*::
+
--
The request method (GET, POST, etc) (of the current request)


type: alias

alias to: http.request.method

--

*`php_fpm.process.request_uri`*::
+
--
The request URI with the query string (of the current request)


type: alias

alias to: url.original

--

*`php_fpm.process.content_length`*::
+
--
The content length of the request (only with POST) (of the current request)


type: alias

alias to: http.response.body.bytes

--

*`php_fpm.process.user`*::
+
--
The user (PHP_AUTH_USER) (or - if not set) (for the current request)


type: alias

alias to: user.name

--

*`php_fpm.process.script`*::
+
--
The main script called (or - if not set) (for the current request)


type: keyword

--

*`php_fpm.process.last_request_cpu`*::
+
--
The CPU percentage the last request consumed. It's always 0 if the process is not in Idle state because CPU calculation is done when the request processing has terminated


type: long

--

*`php_fpm.process.last_request_memory`*::
+
--
The max amount of memory the last request consumed. It's always 0 if the process is not in Idle state because memory calculation is done when the request processing has terminated


type: integer

--

[[exported-fields-postgresql]]
== PostgreSQL fields

Metrics collected from PostgreSQL servers.



[float]
=== postgresql

PostgreSQL metrics.



[float]
=== activity

One document per server process, showing information related to the current activity of that process, such as state and current query. Collected by querying pg_stat_activity.



*`postgresql.activity.database.oid`*::
+
--
OID of the database this backend is connected to.


type: long

--

*`postgresql.activity.database.name`*::
+
--
Name of the database this backend is connected to.


type: keyword

--

*`postgresql.activity.pid`*::
+
--
Process ID of this backend.


type: long

--

*`postgresql.activity.user.id`*::
+
--
OID of the user logged into this backend.


type: long

--

*`postgresql.activity.user.name`*::
+
--
Name of the user logged into this backend.


--

*`postgresql.activity.application_name`*::
+
--
Name of the application that is connected to this backend.


--

*`postgresql.activity.client.address`*::
+
--
IP address of the client connected to this backend.


--

*`postgresql.activity.client.hostname`*::
+
--
Host name of the connected client, as reported by a reverse DNS lookup of client_addr.


--

*`postgresql.activity.client.port`*::
+
--
TCP port number that the client is using for communication with this backend, or -1 if a Unix socket is used.


type: long

--

*`postgresql.activity.backend_type`*::
+
--
Type of the current backend. Possible types are autovacuum launcher, autovacuum worker, logical replication launcher, logical replication worker, parallel worker, background writer, client backend, checkpointer, startup, walreceiver, walsender and walwriter. Extensions may register workers with additional backend types.


--

*`postgresql.activity.backend_start`*::
+
--
Time when this process was started, i.e., when the client connected to the server.


type: date

--

*`postgresql.activity.transaction_start`*::
+
--
Time when this process' current transaction was started.


type: date

--

*`postgresql.activity.query_start`*::
+
--
Time when the currently active query was started, or if state is not active, when the last query was started.


type: date

--

*`postgresql.activity.state_change`*::
+
--
Time when the state was last changed.


type: date

--

*`postgresql.activity.waiting`*::
+
--
True if this backend is currently waiting on a lock.


type: boolean

--

*`postgresql.activity.state`*::
+
--
Current overall state of this backend. Possible values are:

  * active: The backend is executing a query.
  * idle: The backend is waiting for a new client command.
  * idle in transaction: The backend is in a transaction, but is not
    currently executing a query.
  * idle in transaction (aborted): This state is similar to idle in
    transaction, except one of the statements in the transaction caused
    an error.
  * fastpath function call: The backend is executing a fast-path function.
  * disabled: This state is reported if track_activities is disabled in this backend.


--

*`postgresql.activity.query`*::
+
--
Text of this backend's most recent query. If state is active this field shows the currently executing query. In all other states, it shows the last query that was executed.


--

*`postgresql.activity.wait_event`*::
+
--
Wait event name if the backend is currently waiting.


--

*`postgresql.activity.wait_event_type`*::
+
--
The type of event for which the backend is waiting.


--

[float]
=== bgwriter

Statistics about the background writer process's activity. Collected using the pg_stat_bgwriter query.



*`postgresql.bgwriter.checkpoints.scheduled`*::
+
--
Number of scheduled checkpoints that have been performed.


type: long

--

*`postgresql.bgwriter.checkpoints.requested`*::
+
--
Number of requested checkpoints that have been performed.


type: long

--

*`postgresql.bgwriter.checkpoints.times.write.ms`*::
+
--
Total amount of time that has been spent in the portion of checkpoint processing where files are written to disk, in milliseconds.


type: float

--

*`postgresql.bgwriter.checkpoints.times.sync.ms`*::
+
--
Total amount of time that has been spent in the portion of checkpoint processing where files are synchronized to disk, in milliseconds.


type: float

--

*`postgresql.bgwriter.buffers.checkpoints`*::
+
--
Number of buffers written during checkpoints.


type: long

--

*`postgresql.bgwriter.buffers.clean`*::
+
--
Number of buffers written by the background writer.


type: long

--

*`postgresql.bgwriter.buffers.clean_full`*::
+
--
Number of times the background writer stopped a cleaning scan because it had written too many buffers.


type: long

--

*`postgresql.bgwriter.buffers.backend`*::
+
--
Number of buffers written directly by a backend.


type: long

--

*`postgresql.bgwriter.buffers.backend_fsync`*::
+
--
Number of times a backend had to execute its own fsync call (normally the background writer handles those even when the backend does its own write)


type: long

--

*`postgresql.bgwriter.buffers.allocated`*::
+
--
Number of buffers allocated.


type: long

--

*`postgresql.bgwriter.stats_reset`*::
+
--
Time at which these statistics were last reset.


type: date

--

[float]
=== database

One row per database, showing database-wide statistics. Collected by querying pg_stat_database



*`postgresql.database.oid`*::
+
--
OID of the database this backend is connected to, or 0 for shared resources.


type: long

--

*`postgresql.database.name`*::
+
--
Name of the database this backend is connected to, empty for shared resources.


type: keyword

--

*`postgresql.database.number_of_backends`*::
+
--
Number of backends currently connected to this database.


type: long

--

*`postgresql.database.transactions.commit`*::
+
--
Number of transactions in this database that have been committed.


type: long

--

*`postgresql.database.transactions.rollback`*::
+
--
Number of transactions in this database that have been rolled back.


type: long

--

*`postgresql.database.blocks.read`*::
+
--
Number of disk blocks read in this database.


type: long

--

*`postgresql.database.blocks.hit`*::
+
--
Number of times disk blocks were found already in the buffer cache, so that a read was not necessary (this only includes hits in the PostgreSQL buffer cache, not the operating system's file system cache).


type: long

--

*`postgresql.database.blocks.time.read.ms`*::
+
--
Time spent reading data file blocks by backends in this database, in milliseconds.


type: long

--

*`postgresql.database.blocks.time.write.ms`*::
+
--
Time spent writing data file blocks by backends in this database, in milliseconds.


type: long

--

*`postgresql.database.rows.returned`*::
+
--
Number of rows returned by queries in this database.


type: long

--

*`postgresql.database.rows.fetched`*::
+
--
Number of rows fetched by queries in this database.


type: long

--

*`postgresql.database.rows.inserted`*::
+
--
Number of rows inserted by queries in this database.


type: long

--

*`postgresql.database.rows.updated`*::
+
--
Number of rows updated by queries in this database.


type: long

--

*`postgresql.database.rows.deleted`*::
+
--
Number of rows deleted by queries in this database.


type: long

--

*`postgresql.database.conflicts`*::
+
--
Number of queries canceled due to conflicts with recovery in this database.


type: long

--

*`postgresql.database.temporary.files`*::
+
--
Number of temporary files created by queries in this database. All temporary files are counted, regardless of why the temporary file was created (e.g., sorting or hashing), and regardless of the log_temp_files setting.


type: long

--

*`postgresql.database.temporary.bytes`*::
+
--
Total amount of data written to temporary files by queries in this database. All temporary files are counted, regardless of why the temporary file was created, and regardless of the log_temp_files setting.


type: long

--

*`postgresql.database.deadlocks`*::
+
--
Number of deadlocks detected in this database.


type: long

--

*`postgresql.database.stats_reset`*::
+
--
Time at which these statistics were last reset.


type: date

--

[float]
=== statement

One document per query per user per database, showing information related invocation of that query, such as cpu usage and total time. Collected by querying pg_stat_statements.



*`postgresql.statement.user.id`*::
+
--
OID of the user logged into the backend that ran the query.


type: long

--

*`postgresql.statement.database.oid`*::
+
--
OID of the database the query was run on.


type: long

--

*`postgresql.statement.query.id`*::
+
--
ID of the statement.


type: long

--

*`postgresql.statement.query.text`*::
+
--
Query text


--

*`postgresql.statement.query.calls`*::
+
--
Number of times the query has been run.


type: long

--

*`postgresql.statement.query.rows`*::
+
--
Total number of rows returned by query.


type: long

--

*`postgresql.statement.query.time.total.ms`*::
+
--
Total number of milliseconds spent running query.


type: float

--

*`postgresql.statement.query.time.min.ms`*::
+
--
Minimum number of milliseconds spent running query.


type: float

--

*`postgresql.statement.query.time.max.ms`*::
+
--
Maximum number of milliseconds spent running query.


type: float

--

*`postgresql.statement.query.time.mean.ms`*::
+
--
Mean number of milliseconds spent running query.


type: long

--

*`postgresql.statement.query.time.stddev.ms`*::
+
--
Population standard deviation of time spent running query, in milliseconds.


type: long

--

*`postgresql.statement.query.memory.shared.hit`*::
+
--
Total number of shared block cache hits by the query.


type: long

--

*`postgresql.statement.query.memory.shared.read`*::
+
--
Total number of shared block cache read by the query.


type: long

--

*`postgresql.statement.query.memory.shared.dirtied`*::
+
--
Total number of shared block cache dirtied by the query.


type: long

--

*`postgresql.statement.query.memory.shared.written`*::
+
--
Total number of shared block cache written by the query.


type: long

--

*`postgresql.statement.query.memory.local.hit`*::
+
--
Total number of local block cache hits by the query.


type: long

--

*`postgresql.statement.query.memory.local.read`*::
+
--
Total number of local block cache read by the query.


type: long

--

*`postgresql.statement.query.memory.local.dirtied`*::
+
--
Total number of local block cache dirtied by the query.


type: long

--

*`postgresql.statement.query.memory.local.written`*::
+
--
Total number of local block cache written by the query.


type: long

--

*`postgresql.statement.query.memory.temp.read`*::
+
--
Total number of temp block cache read by the query.


type: long

--

*`postgresql.statement.query.memory.temp.written`*::
+
--
Total number of temp block cache written by the query.


type: long

--

[[exported-fields-process]]
== Process fields

Process metadata fields




*`process.exe`*::
+
--
type: alias

alias to: process.executable

--

[[exported-fields-prometheus]]
== Prometheus fields

Stats scraped from a Prometheus endpoint.




*`prometheus.labels.*`*::
+
--
Prometheus metric labels


type: object

--

*`prometheus.metrics.*`*::
+
--
Prometheus metric


type: object

--

*`prometheus.query.*`*::
+
--
Prometheus value resulted from PromQL


type: object

--

[float]
=== query

query metricset


[float]
=== remote_write

remote write metrics from Prometheus server


[[exported-fields-prometheus-xpack]]
== Prometheus typed metrics fields

Stats scraped from a Prometheus endpoint.



*`prometheus.*.value`*::
+
--
Prometheus gauge metric


type: object

--

*`prometheus.*.counter`*::
+
--
Prometheus counter metric


type: object

--

*`prometheus.*.rate`*::
+
--
Prometheus rated counter metric


type: object

--

*`prometheus.*.histogram`*::
+
--
Prometheus histogram metric - release: ga


type: object

--

[[exported-fields-rabbitmq]]
== RabbitMQ fields

RabbitMQ module



[float]
=== rabbitmq




*`rabbitmq.vhost`*::
+
--
Virtual host name with non-ASCII characters escaped as in C.


type: keyword

--

[float]
=== connection

connection



*`rabbitmq.connection.name`*::
+
--
The name of the connection with non-ASCII characters escaped as in C.


type: keyword

--

*`rabbitmq.connection.vhost`*::
+
--
Virtual host name with non-ASCII characters escaped as in C.


type: alias

alias to: rabbitmq.vhost

--

*`rabbitmq.connection.user`*::
+
--
User name.


type: alias

alias to: user.name

--

*`rabbitmq.connection.node`*::
+
--
Node name.


type: alias

alias to: rabbitmq.node.name

--

*`rabbitmq.connection.channels`*::
+
--
The number of channels on the connection.


type: long

--

*`rabbitmq.connection.channel_max`*::
+
--
The maximum number of channels allowed on the connection.


type: long

--

*`rabbitmq.connection.frame_max`*::
+
--
Maximum permissible size of a frame (in bytes) to negotiate with clients.


type: long

format: bytes

--

*`rabbitmq.connection.type`*::
+
--
Type of the connection.


type: keyword

--

*`rabbitmq.connection.host`*::
+
--
Server hostname obtained via reverse DNS, or its IP address if reverse DNS failed or was disabled.


type: keyword

--

*`rabbitmq.connection.peer.host`*::
+
--
Peer hostname obtained via reverse DNS, or its IP address if reverse DNS failed or was not enabled.


type: keyword

--

*`rabbitmq.connection.port`*::
+
--
Server port.


type: long

--

*`rabbitmq.connection.peer.port`*::
+
--
Peer port.


type: long

--

*`rabbitmq.connection.packet_count.sent`*::
+
--
Number of packets sent on the connection.


type: long

--

*`rabbitmq.connection.packet_count.received`*::
+
--
Number of packets received on the connection.


type: long

--

*`rabbitmq.connection.packet_count.pending`*::
+
--
Number of packets pending on the connection.


type: long

--

*`rabbitmq.connection.octet_count.sent`*::
+
--
Number of octets sent on the connection.


type: long

--

*`rabbitmq.connection.octet_count.received`*::
+
--
Number of octets received on the connection.


type: long

--

*`rabbitmq.connection.client_provided.name`*::
+
--
User specified connection name.


type: keyword

--

[float]
=== exchange

exchange



*`rabbitmq.exchange.name`*::
+
--
The name of the queue with non-ASCII characters escaped as in C.


type: keyword

--

*`rabbitmq.exchange.vhost`*::
+
--
Virtual host name with non-ASCII characters escaped as in C.


type: alias

alias to: rabbitmq.vhost

--

*`rabbitmq.exchange.durable`*::
+
--
Whether or not the queue survives server restarts.


type: boolean

--

*`rabbitmq.exchange.auto_delete`*::
+
--
Whether the queue will be deleted automatically when no longer used.


type: boolean

--

*`rabbitmq.exchange.internal`*::
+
--
Whether the exchange is internal, i.e. cannot be directly published to by a client.


type: boolean

--

*`rabbitmq.exchange.user`*::
+
--
User who created the exchange.


type: alias

alias to: user.name

--

*`rabbitmq.exchange.messages.publish_in.count`*::
+
--
Count of messages published "in" to an exchange, i.e. not taking account of routing.


type: long

--

*`rabbitmq.exchange.messages.publish_in.details.rate`*::
+
--
How much the exchange publish-in count has changed per second in the most recent sampling interval.


type: float

--

*`rabbitmq.exchange.messages.publish_out.count`*::
+
--
Count of messages published "out" of an exchange, i.e. taking account of routing.


type: long

--

*`rabbitmq.exchange.messages.publish_out.details.rate`*::
+
--
How much the exchange publish-out count has changed per second in the most recent sampling interval.


type: float

--

[float]
=== node

node



*`rabbitmq.node.disk.free.bytes`*::
+
--
Disk free space in bytes.


type: long

format: bytes

--

*`rabbitmq.node.disk.free.limit.bytes`*::
+
--
Point at which the disk alarm will go off.


type: long

format: bytes

--

*`rabbitmq.node.fd.total`*::
+
--
File descriptors available.


type: long

--

*`rabbitmq.node.fd.used`*::
+
--
Used file descriptors.


type: long

--

*`rabbitmq.node.gc.num.count`*::
+
--
Number of GC operations.


type: long

--

*`rabbitmq.node.gc.reclaimed.bytes`*::
+
--
GC bytes reclaimed.


type: long

format: bytes

--

*`rabbitmq.node.io.file_handle.open_attempt.avg.ms`*::
+
--
File handle open avg time


type: long

--

*`rabbitmq.node.io.file_handle.open_attempt.count`*::
+
--
File handle open attempts


type: long

--

*`rabbitmq.node.io.read.avg.ms`*::
+
--
File handle read avg time


type: long

--

*`rabbitmq.node.io.read.bytes`*::
+
--
Data read in bytes


type: long

format: bytes

--

*`rabbitmq.node.io.read.count`*::
+
--
Data read operations


type: long

--

*`rabbitmq.node.io.reopen.count`*::
+
--
Data reopen operations


type: long

--

*`rabbitmq.node.io.seek.avg.ms`*::
+
--
Data seek avg time


type: long

--

*`rabbitmq.node.io.seek.count`*::
+
--
Data seek operations


type: long

--

*`rabbitmq.node.io.sync.avg.ms`*::
+
--
Data sync avg time


type: long

--

*`rabbitmq.node.io.sync.count`*::
+
--
Data sync operations


type: long

--

*`rabbitmq.node.io.write.avg.ms`*::
+
--
Data write avg time


type: long

--

*`rabbitmq.node.io.write.bytes`*::
+
--
Data write in bytes


type: long

format: bytes

--

*`rabbitmq.node.io.write.count`*::
+
--
Data write operations


type: long

--

*`rabbitmq.node.mem.limit.bytes`*::
+
--
Point at which the memory alarm will go off.


type: long

format: bytes

--

*`rabbitmq.node.mem.used.bytes`*::
+
--
Memory used in bytes.


type: long

--

*`rabbitmq.node.mnesia.disk.tx.count`*::
+
--
Number of Mnesia transactions which have been performed that required writes to disk.


type: long

--

*`rabbitmq.node.mnesia.ram.tx.count`*::
+
--
Number of Mnesia transactions which have been performed that did not require writes to disk.


type: long

--

*`rabbitmq.node.msg.store_read.count`*::
+
--
Number of messages which have been read from the message store.


type: long

--

*`rabbitmq.node.msg.store_write.count`*::
+
--
Number of messages which have been written to the message store.


type: long

--

*`rabbitmq.node.name`*::
+
--
Node name

type: keyword

--

*`rabbitmq.node.proc.total`*::
+
--
Maximum number of Erlang processes.


type: long

--

*`rabbitmq.node.proc.used`*::
+
--
Number of Erlang processes in use.


type: long

--

*`rabbitmq.node.processors`*::
+
--
Number of cores detected and usable by Erlang.


type: long

--

*`rabbitmq.node.queue.index.journal_write.count`*::
+
--
Number of records written to the queue index journal.


type: long

--

*`rabbitmq.node.queue.index.read.count`*::
+
--
Number of records read from the queue index.


type: long

--

*`rabbitmq.node.queue.index.write.count`*::
+
--
Number of records written to the queue index.


type: long

--

*`rabbitmq.node.run.queue`*::
+
--
Average number of Erlang processes waiting to run.


type: long

--

*`rabbitmq.node.socket.total`*::
+
--
File descriptors available for use as sockets.


type: long

--

*`rabbitmq.node.socket.used`*::
+
--
File descriptors used as sockets.


type: long

--

*`rabbitmq.node.type`*::
+
--
Node type.


type: keyword

--

*`rabbitmq.node.uptime`*::
+
--
Node uptime.


type: long

--

[float]
=== queue

queue



*`rabbitmq.queue.name`*::
+
--
The name of the queue with non-ASCII characters escaped as in C.


type: keyword

--

*`rabbitmq.queue.vhost`*::
+
--
Virtual host name with non-ASCII characters escaped as in C.


type: alias

alias to: rabbitmq.vhost

--

*`rabbitmq.queue.durable`*::
+
--
Whether or not the queue survives server restarts.


type: boolean

--

*`rabbitmq.queue.auto_delete`*::
+
--
Whether the queue will be deleted automatically when no longer used.


type: boolean

--

*`rabbitmq.queue.exclusive`*::
+
--
Whether the queue is exclusive (i.e. has owner_pid).


type: boolean

--

*`rabbitmq.queue.node`*::
+
--
Node name.


type: alias

alias to: rabbitmq.node.name

--

*`rabbitmq.queue.state`*::
+
--
The state of the queue. Normally 'running', but may be "{syncing, MsgCount}" if the queue is synchronising. Queues which are located on cluster nodes that are currently down will be shown with a status of 'down'.


type: keyword

--

*`rabbitmq.queue.arguments.max_priority`*::
+
--
Maximum number of priority levels for the queue to support.


type: long

--

*`rabbitmq.queue.consumers.count`*::
+
--
Number of consumers.


type: long

--

*`rabbitmq.queue.consumers.utilisation.pct`*::
+
--
Fraction of the time (between 0.0 and 1.0) that the queue is able to immediately deliver messages to consumers. This can be less than 1.0 if consumers are limited by network congestion or prefetch count.


type: long

format: percent

--

*`rabbitmq.queue.messages.total.count`*::
+
--
Sum of ready and unacknowledged messages (queue depth).


type: long

--

*`rabbitmq.queue.messages.total.details.rate`*::
+
--
How much the queue depth has changed per second in the most recent sampling interval.


type: float

--

*`rabbitmq.queue.messages.ready.count`*::
+
--
Number of messages ready to be delivered to clients.


type: long

--

*`rabbitmq.queue.messages.ready.details.rate`*::
+
--
How much the count of messages ready has changed per second in the most recent sampling interval.


type: float

--

*`rabbitmq.queue.messages.unacknowledged.count`*::
+
--
Number of messages delivered to clients but not yet acknowledged.


type: long

--

*`rabbitmq.queue.messages.unacknowledged.details.rate`*::
+
--
How much the count of unacknowledged messages has changed per second in the most recent sampling interval.


type: float

--

*`rabbitmq.queue.messages.persistent.count`*::
+
--
Total number of persistent messages in the queue (will always be 0 for transient queues).


type: long

--

*`rabbitmq.queue.memory.bytes`*::
+
--
Bytes of memory consumed by the Erlang process associated with the queue, including stack, heap and internal structures.


type: long

format: bytes

--

*`rabbitmq.queue.disk.reads.count`*::
+
--
Total number of times messages have been read from disk by this queue since it started.


type: long

--

*`rabbitmq.queue.disk.writes.count`*::
+
--
Total number of times messages have been written to disk by this queue since it started.


type: long

--

[[exported-fields-redis]]
== Redis fields

Redis metrics collected from Redis.



[float]
=== redis

`redis` contains the information and statistics from Redis.



[float]
=== info

`info` contains the information and statistics returned by the `INFO` command.



[float]
=== clients

Redis client stats.



*`redis.info.clients.connected`*::
+
--
Number of client connections (excluding connections from slaves).


type: long

--

*`redis.info.clients.longest_output_list`*::
+
--

deprecated:[6.5.0]

Longest output list among current client connections (replaced by max_output_buffer).


type: long

--

*`redis.info.clients.max_output_buffer`*::
+
--
Longest output list among current client connections.


type: long

--

*`redis.info.clients.biggest_input_buf`*::
+
--

deprecated:[6.5.0]

Biggest input buffer among current client connections (replaced by max_input_buffer).


type: long

--

*`redis.info.clients.max_input_buffer`*::
+
--
Biggest input buffer among current client connections (on redis 5.0).


type: long

--

*`redis.info.clients.blocked`*::
+
--
Number of clients pending on a blocking call (BLPOP, BRPOP, BRPOPLPUSH).


type: long

--

[float]
=== cluster

Redis cluster information.



*`redis.info.cluster.enabled`*::
+
--
Indicates that the Redis cluster is enabled.


type: boolean

--

[float]
=== cpu

Redis CPU stats



*`redis.info.cpu.used.sys`*::
+
--
System CPU consumed by the Redis server.


type: scaled_float

--

*`redis.info.cpu.used.sys_children`*::
+
--
System CPU consumed by the background processes.


type: scaled_float

--

*`redis.info.cpu.used.user`*::
+
--
User CPU consumed by the Redis server.


type: scaled_float

--

*`redis.info.cpu.used.user_children`*::
+
--
User CPU consumed by the background processes.


type: scaled_float

--

[float]
=== memory

Redis memory stats.



*`redis.info.memory.used.value`*::
+
--
Total number of bytes allocated by Redis.


type: long

format: bytes

--

*`redis.info.memory.used.rss`*::
+
--
Number of bytes that Redis allocated as seen by the operating system (a.k.a resident set size).


type: long

format: bytes

--

*`redis.info.memory.used.peak`*::
+
--
Peak memory consumed by Redis.


type: long

format: bytes

--

*`redis.info.memory.used.lua`*::
+
--
Used memory by the Lua engine.        


type: long

format: bytes

--

*`redis.info.memory.used.dataset`*::
+
--
The size in bytes of the dataset 


type: long

format: bytes

--

*`redis.info.memory.max.value`*::
+
--
Memory limit.


type: long

format: bytes

--

*`redis.info.memory.max.policy`*::
+
--
Eviction policy to use when memory limit is reached.


type: keyword

--

*`redis.info.memory.fragmentation.ratio`*::
+
--
Ratio between used_memory_rss and used_memory


type: float

--

*`redis.info.memory.fragmentation.bytes`*::
+
--
Bytes between used_memory_rss and used_memory


type: long

format: bytes

--

*`redis.info.memory.active_defrag.is_running`*::
+
--
Flag indicating if active defragmentation is active


type: boolean

--

*`redis.info.memory.allocator`*::
+
--
Memory allocator.


type: keyword

--


*`redis.info.memory.allocator_stats.allocated`*::
+
--
Allocated memory


type: long

format: bytes

--

*`redis.info.memory.allocator_stats.active`*::
+
--
Active memory


type: long

format: bytes

--

*`redis.info.memory.allocator_stats.resident`*::
+
--
Resident memory


type: long

format: bytes

--

*`redis.info.memory.allocator_stats.fragmentation.ratio`*::
+
--
Fragmentation ratio


type: float

--

*`redis.info.memory.allocator_stats.fragmentation.bytes`*::
+
--
Fragmented bytes


type: long

format: bytes

--

*`redis.info.memory.allocator_stats.rss.ratio`*::
+
--
Resident ratio


type: float

--

*`redis.info.memory.allocator_stats.rss.bytes`*::
+
--
Resident bytes


type: long

format: bytes

--

[float]
=== persistence

Redis CPU stats.



*`redis.info.persistence.loading`*::
+
--
Flag indicating if the load of a dump file is on-going


type: boolean

--

[float]
=== rdb

Provides information about RDB persistence



*`redis.info.persistence.rdb.last_save.changes_since`*::
+
--
Number of changes since the last dump


type: long

--

*`redis.info.persistence.rdb.last_save.time`*::
+
--
Epoch-based timestamp of last successful RDB save


type: long

--

*`redis.info.persistence.rdb.bgsave.in_progress`*::
+
--
Flag indicating a RDB save is on-going


type: boolean

--

*`redis.info.persistence.rdb.bgsave.last_status`*::
+
--
Status of the last RDB save operation


type: keyword

--

*`redis.info.persistence.rdb.bgsave.last_time.sec`*::
+
--
Duration of the last RDB save operation in seconds


type: long

format: duration

--

*`redis.info.persistence.rdb.bgsave.current_time.sec`*::
+
--
Duration of the on-going RDB save operation if any


type: long

format: duration

--

*`redis.info.persistence.rdb.copy_on_write.last_size`*::
+
--
The size in bytes of copy-on-write allocations during the last RBD save operation                


type: long

format: bytes

--

[float]
=== aof

Provides information about AOF persitence



*`redis.info.persistence.aof.enabled`*::
+
--
Flag indicating AOF logging is activated


type: boolean

--

*`redis.info.persistence.aof.rewrite.in_progress`*::
+
--
Flag indicating a AOF rewrite operation is on-going


type: boolean

--

*`redis.info.persistence.aof.rewrite.scheduled`*::
+
--
Flag indicating an AOF rewrite operation will be scheduled once the on-going RDB save is complete.


type: boolean

--

*`redis.info.persistence.aof.rewrite.last_time.sec`*::
+
--
Duration of the last AOF rewrite operation in seconds


type: long

format: duration

--

*`redis.info.persistence.aof.rewrite.current_time.sec`*::
+
--
Duration of the on-going AOF rewrite operation if any


type: long

format: duration

--

*`redis.info.persistence.aof.rewrite.buffer.size`*::
+
--
Size of the AOF rewrite buffer


type: long

format: bytes

--

*`redis.info.persistence.aof.bgrewrite.last_status`*::
+
--
Status of the last AOF rewrite operatio


type: keyword

--

*`redis.info.persistence.aof.write.last_status`*::
+
--
Status of the last write operation to the AOF


type: keyword

--

*`redis.info.persistence.aof.copy_on_write.last_size`*::
+
--
The size in bytes of copy-on-write allocations during the last RBD save operation


type: long

format: bytes

--

*`redis.info.persistence.aof.buffer.size`*::
+
--
Size of the AOF buffer


type: long

format: bytes

--

*`redis.info.persistence.aof.size.current`*::
+
--
AOF current file size             


type: long

format: bytes

--

*`redis.info.persistence.aof.size.base`*::
+
--
AOF file size on latest startup or rewrite


type: long

format: bytes

--

*`redis.info.persistence.aof.fsync.pending`*::
+
--
Number of fsync pending jobs in background I/O queue


type: long

--

*`redis.info.persistence.aof.fsync.delayed`*::
+
--
Delayed fsync counter


type: long

--

[float]
=== replication

Replication



*`redis.info.replication.role`*::
+
--
Role of the instance (can be "master", or "slave").


type: keyword

--

*`redis.info.replication.connected_slaves`*::
+
--
Number of connected slaves


type: long

--

*`redis.info.replication.master_offset`*::
+
--

deprecated:[6.5]

The server's current replication offset


type: long

--

*`redis.info.replication.backlog.active`*::
+
--
Flag indicating replication backlog is active


type: long

--

*`redis.info.replication.backlog.size`*::
+
--
Total size in bytes of the replication backlog buffer


type: long

format: bytes

--

*`redis.info.replication.backlog.first_byte_offset`*::
+
--
The master offset of the replication backlog buffer          


type: long

--

*`redis.info.replication.backlog.histlen`*::
+
--
Size in bytes of the data in the replication backlog buffer


type: long

--

*`redis.info.replication.master.offset`*::
+
--
The server's current replication offset


type: long

--

*`redis.info.replication.master.second_offset`*::
+
--
The offset up to which replication IDs are accepted


type: long

--

*`redis.info.replication.master.link_status`*::
+
--
Status of the link (up/down)


type: keyword

--

*`redis.info.replication.master.last_io_seconds_ago`*::
+
--
Number of seconds since the last interaction with master


type: long

format: duration

--

*`redis.info.replication.master.sync.in_progress`*::
+
--
Indicate the master is syncing to the slave


type: boolean

--

*`redis.info.replication.master.sync.left_bytes`*::
+
--
Number of bytes left before syncing is complete


type: long

format: bytes

--

*`redis.info.replication.master.sync.last_io_seconds_ago`*::
+
--
Number of seconds since last transfer I/O during a SYNC operation


type: long

format: duration

--

*`redis.info.replication.slave.offset`*::
+
--
The replication offset of the slave instance


type: long

--

*`redis.info.replication.slave.priority`*::
+
--
The priority of the instance as a candidate for failover


type: long

--

*`redis.info.replication.slave.is_readonly`*::
+
--
Flag indicating if the slave is read-only


type: boolean

--

[float]
=== server

Server info



*`redis.info.server.version`*::
+
--
None

type: alias

alias to: service.version

--

*`redis.info.server.git_sha1`*::
+
--
None

type: keyword

--

*`redis.info.server.git_dirty`*::
+
--
None

type: keyword

--

*`redis.info.server.build_id`*::
+
--
None

type: keyword

--

*`redis.info.server.mode`*::
+
--
None

type: keyword

--

*`redis.info.server.os`*::
+
--
None

type: alias

alias to: os.full

--

*`redis.info.server.arch_bits`*::
+
--
None

type: keyword

--

*`redis.info.server.multiplexing_api`*::
+
--
None

type: keyword

--

*`redis.info.server.gcc_version`*::
+
--
None

type: keyword

--

*`redis.info.server.process_id`*::
+
--
None

type: alias

alias to: process.pid

--

*`redis.info.server.run_id`*::
+
--
None

type: keyword

--

*`redis.info.server.tcp_port`*::
+
--
None

type: long

--

*`redis.info.server.uptime`*::
+
--
None

type: long

--

*`redis.info.server.hz`*::
+
--
None

type: long

--

*`redis.info.server.lru_clock`*::
+
--
None

type: long

--

*`redis.info.server.config_file`*::
+
--
None

type: keyword

--

[float]
=== stats

Redis stats.



*`redis.info.stats.connections.received`*::
+
--
Total number of connections received.

type: long

--

*`redis.info.stats.connections.rejected`*::
+
--
Total number of connections rejected.

type: long

--

*`redis.info.stats.commands_processed`*::
+
--
Total number of commands processed.

type: long

--

*`redis.info.stats.net.input.bytes`*::
+
--
Total network input in bytes.

type: long

--

*`redis.info.stats.net.output.bytes`*::
+
--
Total network output in bytes.

type: long

--

*`redis.info.stats.instantaneous.ops_per_sec`*::
+
--
Number of commands processed per second


type: long

--

*`redis.info.stats.instantaneous.input_kbps`*::
+
--
The network's read rate per second in KB/sec


type: scaled_float

--

*`redis.info.stats.instantaneous.output_kbps`*::
+
--
The network's write rate per second in KB/sec


type: scaled_float

--

*`redis.info.stats.sync.full`*::
+
--
The number of full resyncs with slaves


type: long

--

*`redis.info.stats.sync.partial.ok`*::
+
--
The number of accepted partial resync requests


type: long

--

*`redis.info.stats.sync.partial.err`*::
+
--
The number of denied partial resync requests


type: long

--

*`redis.info.stats.keys.expired`*::
+
--
Total number of key expiration events


type: long

--

*`redis.info.stats.keys.evicted`*::
+
--
Number of evicted keys due to maxmemory limit


type: long

--

*`redis.info.stats.keyspace.hits`*::
+
--
Number of successful lookup of keys in the main dictionary


type: long

--

*`redis.info.stats.keyspace.misses`*::
+
--
Number of failed lookup of keys in the main dictionary


type: long

--

*`redis.info.stats.pubsub.channels`*::
+
--
Global number of pub/sub channels with client subscriptions


type: long

--

*`redis.info.stats.pubsub.patterns`*::
+
--
Global number of pub/sub pattern with client subscriptions


type: long

--

*`redis.info.stats.latest_fork_usec`*::
+
--
Duration of the latest fork operation in microseconds


type: long

--

*`redis.info.stats.migrate_cached_sockets`*::
+
--
The number of sockets open for MIGRATE purposes


type: long

--

*`redis.info.stats.slave_expires_tracked_keys`*::
+
--
The number of keys tracked for expiry purposes (applicable only to writable slaves)


type: long

--

*`redis.info.stats.active_defrag.hits`*::
+
--
Number of value reallocations performed by active the defragmentation process


type: long

--

*`redis.info.stats.active_defrag.misses`*::
+
--
Number of aborted value reallocations started by the active defragmentation process


type: long

--

*`redis.info.stats.active_defrag.key_hits`*::
+
--
Number of keys that were actively defragmented


type: long

--

*`redis.info.stats.active_defrag.key_misses`*::
+
--
Number of keys that were skipped by the active defragmentation process


type: long

--

*`redis.info.slowlog.count`*::
+
--
Count of slow operations


type: long

--

[float]
=== key

`key` contains information about keys.



*`redis.key.name`*::
+
--
Key name.


type: keyword

--

*`redis.key.id`*::
+
--
Unique id for this key (With the form <keyspace>:<name>).


type: keyword

--

*`redis.key.type`*::
+
--
Key type as shown by `TYPE` command.


type: keyword

--

*`redis.key.length`*::
+
--
Length of the key (Number of elements for lists, length for strings, cardinality for sets).


type: long

--

*`redis.key.expire.ttl`*::
+
--
Seconds to expire.


type: long

--

[float]
=== keyspace

`keyspace` contains the information about the keyspaces returned by the `INFO` command.



*`redis.keyspace.id`*::
+
--
Keyspace identifier.


type: keyword

--

*`redis.keyspace.avg_ttl`*::
+
--
Average ttl.


type: long

--

*`redis.keyspace.keys`*::
+
--
Number of keys in the keyspace.


type: long

--

*`redis.keyspace.expires`*::
+
--


type: long

--

[[exported-fields-redisenterprise]]
== Redis Enterprise fields

Redis metrics collected from Redis Enterprise Server.



[float]
=== redisenterprise

`redisenterprise` contains the information and statistics from Redis Enterprise Server.



[[exported-fields-sql]]
== SQL fields

SQL module fetches metrics from a SQL database




*`sql.driver`*::
+
--
Driver used to execute the query.


type: keyword

--

*`sql.query`*::
+
--
Query executed to collect metrics.


type: keyword

--

*`sql.metrics.numeric.*`*::
+
--
Numeric metrics collected.


type: object

--

*`sql.metrics.string.*`*::
+
--
Non-numeric values collected.


type: object

--

*`sql.metrics.boolean.*`*::
+
--
Boolean values collected.


type: object

--

[[exported-fields-stan]]
== Stan fields

stan Module



[float]
=== stan

`stan` contains statistics that were read from Nats Streaming server (STAN)



*`stan.server.id`*::
+
--
The server ID


type: keyword

--

*`stan.cluster.id`*::
+
--
The cluster ID


type: keyword

--

[float]
=== channels

Contains stan / nats streaming/serverz endpoint metrics



*`stan.channels.name`*::
+
--
The name of the STAN streaming channel


type: keyword

--

*`stan.channels.messages`*::
+
--
The number of STAN streaming messages


type: long

--

*`stan.channels.bytes`*::
+
--
The number of STAN bytes in the channel


type: long

--

*`stan.channels.first_seq`*::
+
--
First sequence number stored in the channel. If first_seq > min([seq in subscriptions]) data loss has possibly occurred


type: long

--

*`stan.channels.last_seq`*::
+
--
Last sequence number stored in the channel


type: long

--

*`stan.channels.depth`*::
+
--
Queue depth based upon current sequence number and highest reported subscriber sequence number


type: long

--

[float]
=== stats

Contains only high-level stan / nats streaming server related metrics



*`stan.stats.state`*::
+
--
The cluster / streaming configuration state (STANDALONE, CLUSTERED)


type: keyword

--

*`stan.stats.role`*::
+
--
If clustered, role of this node in the cluster (Leader, Follower, Candidate)


type: keyword

--

*`stan.stats.clients`*::
+
--
The number of STAN clients


type: integer

--

*`stan.stats.subscriptions`*::
+
--
The number of STAN streaming subscriptions


type: integer

--

*`stan.stats.channels`*::
+
--
The number of STAN channels


type: integer

--

*`stan.stats.messages`*::
+
--
Number of messages across all STAN queues


type: long

--

*`stan.stats.bytes`*::
+
--
Number of bytes consumed across all STAN queues


type: long

--

[float]
=== subscriptions

Contains stan / nats streaming/serverz endpoint subscription metrics



*`stan.subscriptions.id`*::
+
--
The name of the STAN channel subscription (client_id)


type: keyword

--

*`stan.subscriptions.channel`*::
+
--
The name of the STAN channel the subscription is associated with


type: keyword

--

*`stan.subscriptions.queue`*::
+
--
The name of the NATS queue that the STAN channel subscription is associated with, if any


type: keyword

--

*`stan.subscriptions.last_sent`*::
+
--
Last known sequence number of the subscription that was acked


type: long

--

*`stan.subscriptions.pending`*::
+
--
Number of pending messages from / to the subscriber


type: long

--

*`stan.subscriptions.offline`*::
+
--
Is the subscriber marked as offline?


type: boolean

--

*`stan.subscriptions.stalled`*::
+
--
Is the subscriber known to be stalled?


type: boolean

--

[[exported-fields-statsd]]
== Statsd fields

Statsd module




*`statsd.*.count`*::
+
--
Statsd counters


type: object

--

*`statsd.*.*`*::
+
--
Statsd metrics


type: object

--

[[exported-fields-syncgateway]]
== SyncGateway fields

SyncGateway metrics


[float]
=== syncgateway

`syncgateway` contains the information and statistics from SyncGateway.



[float]
=== syncgateway

Couchbase Sync Gateway metrics.



*`syncgateway.syncgateway.name`*::
+
--
Name of the database on when field `couchbase.syncgateway.type` is `db_stats`.


type: keyword

--

[float]
=== metrics

Metrics of all databases contained in the config file of the SyncGateway instance.




*`syncgateway.syncgateway.metrics.docs.writes.conflict.count`*::
+
--
type: long

--

*`syncgateway.syncgateway.metrics.docs.writes.count`*::
+
--
type: long

--

*`syncgateway.syncgateway.metrics.docs.writes.bytes`*::
+
--
type: long

--


*`syncgateway.syncgateway.metrics.replications.active`*::
+
--
Number of active replications

type: long

--

*`syncgateway.syncgateway.metrics.replications.total`*::
+
--
Total number of replications (active or not)

type: long

--





*`syncgateway.syncgateway.gsi.views.tombstones.query.count`*::
+
--
type: double

--

*`syncgateway.syncgateway.gsi.views.tombstones.query.time`*::
+
--
type: double

--

*`syncgateway.syncgateway.gsi.views.tombstones.query.error.count`*::
+
--
type: double

--



*`syncgateway.syncgateway.gsi.views.access.query.count`*::
+
--
type: double

--


*`syncgateway.syncgateway.gsi.views.access.query.error.count`*::
+
--
type: double

--

*`syncgateway.syncgateway.gsi.views.access.query.time`*::
+
--
type: double

--



*`syncgateway.syncgateway.gsi.views.channels.query.count`*::
+
--
type: double

--


*`syncgateway.syncgateway.gsi.views.channels.query.error.count`*::
+
--
type: double

--

*`syncgateway.syncgateway.gsi.views.channels.query.time`*::
+
--
type: double

--



*`syncgateway.syncgateway.gsi.views.channels.star.query.time`*::
+
--
type: double

--

*`syncgateway.syncgateway.gsi.views.channels.star.query.count`*::
+
--
type: double

--


*`syncgateway.syncgateway.gsi.views.channels.star.query.error.count`*::
+
--
type: double

--



*`syncgateway.syncgateway.gsi.views.role_access.query.count`*::
+
--
type: double

--


*`syncgateway.syncgateway.gsi.views.role_access.query.error.count`*::
+
--
type: double

--

*`syncgateway.syncgateway.gsi.views.role_access.query.time`*::
+
--
type: double

--



*`syncgateway.syncgateway.gsi.views.sequences.query.count`*::
+
--
type: double

--


*`syncgateway.syncgateway.gsi.views.sequences.query.error.count`*::
+
--
type: double

--

*`syncgateway.syncgateway.gsi.views.sequences.query.time`*::
+
--
type: double

--



*`syncgateway.syncgateway.gsi.views.all_docs.query.count`*::
+
--
type: double

--


*`syncgateway.syncgateway.gsi.views.all_docs.query.error.count`*::
+
--
type: double

--

*`syncgateway.syncgateway.gsi.views.all_docs.query.time`*::
+
--
type: double

--



*`syncgateway.syncgateway.gsi.views.principals.query.count`*::
+
--
type: double

--


*`syncgateway.syncgateway.gsi.views.principals.query.error.count`*::
+
--
type: double

--

*`syncgateway.syncgateway.gsi.views.principals.query.time`*::
+
--
type: double

--



*`syncgateway.syncgateway.gsi.views.resync.query.count`*::
+
--
type: double

--


*`syncgateway.syncgateway.gsi.views.resync.query.error.count`*::
+
--
type: double

--

*`syncgateway.syncgateway.gsi.views.resync.query.time`*::
+
--
type: double

--



*`syncgateway.syncgateway.gsi.views.sessions.query.count`*::
+
--
type: double

--


*`syncgateway.syncgateway.gsi.views.sessions.query.error.count`*::
+
--
type: double

--

*`syncgateway.syncgateway.gsi.views.sessions.query.time`*::
+
--
type: double

--



*`syncgateway.syncgateway.security.access_errors.count`*::
+
--
type: double

--



*`syncgateway.syncgateway.security.auth.failed.count`*::
+
--
type: double

--


*`syncgateway.syncgateway.security.docs_rejected.count`*::
+
--
type: double

--




*`syncgateway.syncgateway.cache.channel.revs.active`*::
+
--
type: double

--

*`syncgateway.syncgateway.cache.channel.revs.removal`*::
+
--
type: double

--

*`syncgateway.syncgateway.cache.channel.revs.tombstone`*::
+
--
type: double

--

*`syncgateway.syncgateway.cache.channel.hits`*::
+
--
type: double

--

*`syncgateway.syncgateway.cache.channel.misses`*::
+
--
type: double

--


*`syncgateway.syncgateway.cache.revs.hits`*::
+
--
type: double

--

*`syncgateway.syncgateway.cache.revs.misses`*::
+
--
type: double

--




*`syncgateway.syncgateway.cbl.replication.pull.caught_up`*::
+
--
type: double

--

*`syncgateway.syncgateway.cbl.replication.pull.since_zero`*::
+
--
type: double

--


*`syncgateway.syncgateway.cbl.replication.pull.total.continuous`*::
+
--
type: double

--

*`syncgateway.syncgateway.cbl.replication.pull.total.one_shot`*::
+
--
type: double

--


*`syncgateway.syncgateway.cbl.replication.pull.active.continuous`*::
+
--
type: double

--

*`syncgateway.syncgateway.cbl.replication.pull.active.count`*::
+
--
type: double

--

*`syncgateway.syncgateway.cbl.replication.pull.active.one_shot`*::
+
--
type: double

--


*`syncgateway.syncgateway.cbl.replication.pull.attachment.bytes`*::
+
--
type: long

--

*`syncgateway.syncgateway.cbl.replication.pull.attachment.count`*::
+
--
type: long

--


*`syncgateway.syncgateway.cbl.replication.pull.request_changes.count`*::
+
--
type: double

--

*`syncgateway.syncgateway.cbl.replication.pull.request_changes.time`*::
+
--
type: double

--


*`syncgateway.syncgateway.cbl.replication.pull.rev.processing_time`*::
+
--
type: double

--


*`syncgateway.syncgateway.cbl.replication.pull.rev.send.count`*::
+
--
type: double

--

*`syncgateway.syncgateway.cbl.replication.pull.rev.send.latency`*::
+
--
type: double

--



*`syncgateway.syncgateway.cbl.replication.push.attachment.bytes`*::
+
--
type: double

--

*`syncgateway.syncgateway.cbl.replication.push.attachment.count`*::
+
--
type: double

--

*`syncgateway.syncgateway.cbl.replication.push.doc_push_count`*::
+
--
type: double

--


*`syncgateway.syncgateway.cbl.replication.push.propose_change.count`*::
+
--
type: double

--

*`syncgateway.syncgateway.cbl.replication.push.propose_change.time`*::
+
--
type: double

--


*`syncgateway.syncgateway.cbl.replication.push.sync_function.count`*::
+
--
type: double

--

*`syncgateway.syncgateway.cbl.replication.push.sync_function.time`*::
+
--
type: double

--

*`syncgateway.syncgateway.cbl.replication.push.write_processing_time`*::
+
--
type: double

--

[float]
=== memstats

Dumps a large amount of information about the memory heap and garbage collector


*`syncgateway.syncgateway.memstats.BuckHashSys`*::
+
--
type: double

--

*`syncgateway.syncgateway.memstats.Mallocs`*::
+
--
type: double

--

*`syncgateway.syncgateway.memstats.PauseTotalNs`*::
+
--
type: double

--

*`syncgateway.syncgateway.memstats.TotalAlloc`*::
+
--
type: double

--

*`syncgateway.syncgateway.memstats.Alloc`*::
+
--
type: double

--

*`syncgateway.syncgateway.memstats.GCSys`*::
+
--
type: double

--

*`syncgateway.syncgateway.memstats.LastGC`*::
+
--
type: double

--

*`syncgateway.syncgateway.memstats.MSpanSys`*::
+
--
type: double

--

*`syncgateway.syncgateway.memstats.GCCPUFraction`*::
+
--
type: double

--

*`syncgateway.syncgateway.memstats.HeapReleased`*::
+
--
type: double

--

*`syncgateway.syncgateway.memstats.HeapSys`*::
+
--
type: double

--

*`syncgateway.syncgateway.memstats.DebugGC`*::
+
--
type: long

--

*`syncgateway.syncgateway.memstats.HeapIdle`*::
+
--
type: double

--

*`syncgateway.syncgateway.memstats.Lookups`*::
+
--
type: double

--

*`syncgateway.syncgateway.memstats.HeapObjects`*::
+
--
type: double

--

*`syncgateway.syncgateway.memstats.MSpanInuse`*::
+
--
type: double

--

*`syncgateway.syncgateway.memstats.NumForcedGC`*::
+
--
type: double

--

*`syncgateway.syncgateway.memstats.OtherSys`*::
+
--
type: double

--

*`syncgateway.syncgateway.memstats.Frees`*::
+
--
type: double

--

*`syncgateway.syncgateway.memstats.NextGC`*::
+
--
type: double

--

*`syncgateway.syncgateway.memstats.StackInuse`*::
+
--
type: double

--

*`syncgateway.syncgateway.memstats.Sys`*::
+
--
type: double

--

*`syncgateway.syncgateway.memstats.NumGC`*::
+
--
type: double

--

*`syncgateway.syncgateway.memstats.EnableGC`*::
+
--
type: long

--

*`syncgateway.syncgateway.memstats.HeapAlloc`*::
+
--
type: double

--

*`syncgateway.syncgateway.memstats.MCacheInuse`*::
+
--
type: double

--

*`syncgateway.syncgateway.memstats.MCacheSys`*::
+
--
type: double

--

*`syncgateway.syncgateway.memstats.HeapInuse`*::
+
--
type: double

--

*`syncgateway.syncgateway.memstats.StackSys`*::
+
--
type: double

--

[float]
=== memory

SyncGateway memory metrics. It dumps a large amount of information about the memory heap and garbage collector



*`syncgateway.memory.BuckHashSys`*::
+
--
type: double

--

*`syncgateway.memory.Mallocs`*::
+
--
type: double

--

*`syncgateway.memory.PauseTotalNs`*::
+
--
type: double

--

*`syncgateway.memory.TotalAlloc`*::
+
--
type: double

--

*`syncgateway.memory.Alloc`*::
+
--
type: double

--

*`syncgateway.memory.GCSys`*::
+
--
type: double

--

*`syncgateway.memory.LastGC`*::
+
--
type: double

--

*`syncgateway.memory.MSpanSys`*::
+
--
type: double

--

*`syncgateway.memory.GCCPUFraction`*::
+
--
type: double

--

*`syncgateway.memory.HeapReleased`*::
+
--
type: double

--

*`syncgateway.memory.HeapSys`*::
+
--
type: double

--

*`syncgateway.memory.DebugGC`*::
+
--
type: long

--

*`syncgateway.memory.HeapIdle`*::
+
--
type: double

--

*`syncgateway.memory.Lookups`*::
+
--
type: double

--

*`syncgateway.memory.HeapObjects`*::
+
--
type: double

--

*`syncgateway.memory.MSpanInuse`*::
+
--
type: double

--

*`syncgateway.memory.NumForcedGC`*::
+
--
type: double

--

*`syncgateway.memory.OtherSys`*::
+
--
type: double

--

*`syncgateway.memory.Frees`*::
+
--
type: double

--

*`syncgateway.memory.NextGC`*::
+
--
type: double

--

*`syncgateway.memory.StackInuse`*::
+
--
type: double

--

*`syncgateway.memory.Sys`*::
+
--
type: double

--

*`syncgateway.memory.NumGC`*::
+
--
type: double

--

*`syncgateway.memory.EnableGC`*::
+
--
type: long

--

*`syncgateway.memory.HeapAlloc`*::
+
--
type: double

--

*`syncgateway.memory.MCacheInuse`*::
+
--
type: double

--

*`syncgateway.memory.MCacheSys`*::
+
--
type: double

--

*`syncgateway.memory.HeapInuse`*::
+
--
type: double

--

*`syncgateway.memory.StackSys`*::
+
--
type: double

--

[float]
=== replication

SyncGateway per replication metrics.



[float]
=== metrics

Metrics related with data replication.




*`syncgateway.replication.metrics.attachment.transferred.bytes`*::
+
--
Number of attachment bytes transferred for this replica.

type: long

--

*`syncgateway.replication.metrics.attachment.transferred.count`*::
+
--
The total number of attachments transferred since replication started.

type: long

--


*`syncgateway.replication.metrics.docs.checked_sent`*::
+
--
The total number of documents checked for changes since replication started.

type: double

--


*`syncgateway.replication.metrics.docs.pushed.count`*::
+
--
The total number of documents checked for changes since replication started.

type: long

--

*`syncgateway.replication.metrics.docs.pushed.failed`*::
+
--
The total number of documents that failed to be pushed since replication started.

type: long

--

*`syncgateway.replication.id`*::
+
--
ID of the replica.

type: keyword

--

[float]
=== resources

SyncGateway global resource utilization



*`syncgateway.resources.error_count`*::
+
--
type: long

--

*`syncgateway.resources.goroutines_high_watermark`*::
+
--
type: long

--

*`syncgateway.resources.num_goroutines`*::
+
--
type: long

--


*`syncgateway.resources.process.cpu_percent_utilization`*::
+
--
type: long

--

*`syncgateway.resources.process.memory_resident`*::
+
--
type: long

--



*`syncgateway.resources.pub_net.recv.bytes`*::
+
--
type: long

--


*`syncgateway.resources.pub_net.sent.bytes`*::
+
--
type: long

--


*`syncgateway.resources.admin_net_bytes.recv`*::
+
--
type: long

--

*`syncgateway.resources.admin_net_bytes.sent`*::
+
--
type: long

--



*`syncgateway.resources.go_memstats.heap.alloc`*::
+
--
type: long

--

*`syncgateway.resources.go_memstats.heap.idle`*::
+
--
type: long

--

*`syncgateway.resources.go_memstats.heap.inuse`*::
+
--
type: long

--

*`syncgateway.resources.go_memstats.heap.released`*::
+
--
type: long

--


*`syncgateway.resources.go_memstats.pause.ns`*::
+
--
type: long

--


*`syncgateway.resources.go_memstats.stack.inuse`*::
+
--
type: long

--

*`syncgateway.resources.go_memstats.stack.sys`*::
+
--
type: long

--

*`syncgateway.resources.go_memstats.sys`*::
+
--
type: long

--

*`syncgateway.resources.system_memory_total`*::
+
--
type: long

--

*`syncgateway.resources.warn_count`*::
+
--
type: long

--

[[exported-fields-system]]
== System fields

System status metrics, like CPU and memory usage, that are collected from the operating system.



[float]
=== process

Process metrics.



*`process.state`*::
+
--
The process state. For example: "running".


type: keyword

--

*`process.cpu.pct`*::
+
--
The percentage of CPU time spent by the process since the last event. This value is normalized by the number of CPU cores and it ranges from 0 to 1.


type: scaled_float

format: percent

--

*`process.cpu.start_time`*::
+
--
The time when the process was started.


type: date

--

*`process.memory.pct`*::
+
--
The percentage of memory the process occupied in main memory (RAM).


type: scaled_float

format: percent

--

[float]
=== system

`system` contains local system metrics.



[float]
=== core

`system-core` contains CPU metrics for a single core of a multi-core system.



*`system.core.id`*::
+
--
CPU Core number.


type: long

--

*`system.core.total.pct`*::
+
--
Total active time spent by the core


type: scaled_float

format: percent

--

*`system.core.user.pct`*::
+
--
The percentage of CPU time spent in user space.


type: scaled_float

format: percent

--

*`system.core.user.ticks`*::
+
--
The amount of CPU time spent in user space.


type: long

--

*`system.core.system.pct`*::
+
--
The percentage of CPU time spent in kernel space.


type: scaled_float

format: percent

--

*`system.core.system.ticks`*::
+
--
The amount of CPU time spent in kernel space.


type: long

--

*`system.core.nice.pct`*::
+
--
The percentage of CPU time spent on low-priority processes.


type: scaled_float

format: percent

--

*`system.core.nice.ticks`*::
+
--
The amount of CPU time spent on low-priority processes.


type: long

--

*`system.core.idle.pct`*::
+
--
The percentage of CPU time spent idle.


type: scaled_float

format: percent

--

*`system.core.idle.ticks`*::
+
--
The amount of CPU time spent idle.


type: long

--

*`system.core.iowait.pct`*::
+
--
The percentage of CPU time spent in wait (on disk).


type: scaled_float

format: percent

--

*`system.core.iowait.ticks`*::
+
--
The amount of CPU time spent in wait (on disk).


type: long

--

*`system.core.irq.pct`*::
+
--
The percentage of CPU time spent servicing and handling hardware interrupts.


type: scaled_float

format: percent

--

*`system.core.irq.ticks`*::
+
--
The amount of CPU time spent servicing and handling hardware interrupts.


type: long

--

*`system.core.softirq.pct`*::
+
--
The percentage of CPU time spent servicing and handling software interrupts.


type: scaled_float

format: percent

--

*`system.core.softirq.ticks`*::
+
--
The amount of CPU time spent servicing and handling software interrupts.


type: long

--

*`system.core.steal.pct`*::
+
--
The percentage of CPU time spent in involuntary wait by the virtual CPU while the hypervisor was servicing another processor. Available only on Unix.


type: scaled_float

format: percent

--

*`system.core.steal.ticks`*::
+
--
The amount of CPU time spent in involuntary wait by the virtual CPU while the hypervisor was servicing another processor. Available only on Unix.


type: long

--

[float]
=== cpu

`cpu` contains local CPU stats.



*`system.cpu.cores`*::
+
--
The number of CPU cores present on the host. The non-normalized percentages will have a maximum value of `100% * cores`. The normalized percentages already take this value into account and have a maximum value of 100%.


type: long

--

*`system.cpu.user.pct`*::
+
--
The percentage of CPU time spent in user space. On multi-core systems, you can have percentages that are greater than 100%. For example, if 3 cores are at 60% use, then the `system.cpu.user.pct` will be 180%.


type: scaled_float

format: percent

--

*`system.cpu.system.pct`*::
+
--
The percentage of CPU time spent in kernel space.


type: scaled_float

format: percent

--

*`system.cpu.nice.pct`*::
+
--
The percentage of CPU time spent on low-priority processes.


type: scaled_float

format: percent

--

*`system.cpu.idle.pct`*::
+
--
The percentage of CPU time spent idle.


type: scaled_float

format: percent

--

*`system.cpu.iowait.pct`*::
+
--
The percentage of CPU time spent in wait (on disk).


type: scaled_float

format: percent

--

*`system.cpu.irq.pct`*::
+
--
The percentage of CPU time spent servicing and handling hardware interrupts.


type: scaled_float

format: percent

--

*`system.cpu.softirq.pct`*::
+
--
The percentage of CPU time spent servicing and handling software interrupts.


type: scaled_float

format: percent

--

*`system.cpu.steal.pct`*::
+
--
The percentage of CPU time spent in involuntary wait by the virtual CPU while the hypervisor was servicing another processor. Available only on Unix.


type: scaled_float

format: percent

--

*`system.cpu.total.pct`*::
+
--
The percentage of CPU time spent in states other than Idle and IOWait.


type: scaled_float

format: percent

--

*`system.cpu.user.norm.pct`*::
+
--
The percentage of CPU time spent in user space.


type: scaled_float

format: percent

--

*`system.cpu.system.norm.pct`*::
+
--
The percentage of CPU time spent in kernel space.


type: scaled_float

format: percent

--

*`system.cpu.nice.norm.pct`*::
+
--
The percentage of CPU time spent on low-priority processes.


type: scaled_float

format: percent

--

*`system.cpu.idle.norm.pct`*::
+
--
The percentage of CPU time spent idle.


type: scaled_float

format: percent

--

*`system.cpu.iowait.norm.pct`*::
+
--
The percentage of CPU time spent in wait (on disk).


type: scaled_float

format: percent

--

*`system.cpu.irq.norm.pct`*::
+
--
The percentage of CPU time spent servicing and handling hardware interrupts.


type: scaled_float

format: percent

--

*`system.cpu.softirq.norm.pct`*::
+
--
The percentage of CPU time spent servicing and handling software interrupts.


type: scaled_float

format: percent

--

*`system.cpu.steal.norm.pct`*::
+
--
The percentage of CPU time spent in involuntary wait by the virtual CPU while the hypervisor was servicing another processor. Available only on Unix.


type: scaled_float

format: percent

--

*`system.cpu.total.norm.pct`*::
+
--
The percentage of CPU time in states other than Idle and IOWait, normalised by the number of cores.


type: scaled_float

format: percent

--

*`system.cpu.user.ticks`*::
+
--
The amount of CPU time spent in user space.


type: long

--

*`system.cpu.system.ticks`*::
+
--
The amount of CPU time spent in kernel space.


type: long

--

*`system.cpu.nice.ticks`*::
+
--
The amount of CPU time spent on low-priority processes.


type: long

--

*`system.cpu.idle.ticks`*::
+
--
The amount of CPU time spent idle.


type: long

--

*`system.cpu.iowait.ticks`*::
+
--
The amount of CPU time spent in wait (on disk).


type: long

--

*`system.cpu.irq.ticks`*::
+
--
The amount of CPU time spent servicing and handling hardware interrupts.


type: long

--

*`system.cpu.softirq.ticks`*::
+
--
The amount of CPU time spent servicing and handling software interrupts.


type: long

--

*`system.cpu.steal.ticks`*::
+
--
The amount of CPU time spent in involuntary wait by the virtual CPU while the hypervisor was servicing another processor. Available only on Unix.


type: long

--

[float]
=== diskio

`disk` contains disk IO metrics collected from the operating system.



*`system.diskio.name`*::
+
--
The disk name.


type: keyword

example: sda1

--

*`system.diskio.serial_number`*::
+
--
The disk's serial number. This may not be provided by all operating systems.


type: keyword

--

*`system.diskio.read.count`*::
+
--
The total number of reads completed successfully.


type: long

--

*`system.diskio.write.count`*::
+
--
The total number of writes completed successfully.


type: long

--

*`system.diskio.read.bytes`*::
+
--
The total number of bytes read successfully. On Linux this is the number of sectors read multiplied by an assumed sector size of 512.


type: long

format: bytes

--

*`system.diskio.write.bytes`*::
+
--
The total number of bytes written successfully. On Linux this is the number of sectors written multiplied by an assumed sector size of 512.


type: long

format: bytes

--

*`system.diskio.read.time`*::
+
--
The total number of milliseconds spent by all reads.


type: long

--

*`system.diskio.write.time`*::
+
--
The total number of milliseconds spent by all writes.


type: long

--

*`system.diskio.io.time`*::
+
--
The total number of of milliseconds spent doing I/Os.


type: long

--

*`system.diskio.io.ops`*::
+
--
The total number of I/Os in progress.


type: long

--

*`system.diskio.iostat.read.request.merges_per_sec`*::
+
--
The number of read requests merged per second that were queued to the device.


type: float

--

*`system.diskio.iostat.write.request.merges_per_sec`*::
+
--
The number of write requests merged per second that were queued to the device.


type: float

--

*`system.diskio.iostat.read.request.per_sec`*::
+
--
The number of read requests that were issued to the device per second


type: float

--

*`system.diskio.iostat.write.request.per_sec`*::
+
--
The number of write requests that were issued to the device per second


type: float

--

*`system.diskio.iostat.read.per_sec.bytes`*::
+
--
The number of Bytes read from the device per second.


type: float

format: bytes

--

*`system.diskio.iostat.read.await`*::
+
--
The average time spent for read requests issued to the device to be served.


type: float

--

*`system.diskio.iostat.write.per_sec.bytes`*::
+
--
The number of Bytes write from the device per second.


type: float

format: bytes

--

*`system.diskio.iostat.write.await`*::
+
--
The average time spent for write requests issued to the device to be served.


type: float

--

*`system.diskio.iostat.request.avg_size`*::
+
--
The average size (in bytes) of the requests that were issued to the device.


type: float

--

*`system.diskio.iostat.queue.avg_size`*::
+
--
The average queue length of the requests that were issued to the device.


type: float

--

*`system.diskio.iostat.await`*::
+
--
The average time spent for requests issued to the device to be served.


type: float

--

*`system.diskio.iostat.service_time`*::
+
--
The average service time (in milliseconds) for I/O requests that were issued to the device.


type: float

--

*`system.diskio.iostat.busy`*::
+
--
Percentage of CPU time during which I/O requests were issued to the device (bandwidth utilization for the device). Device saturation occurs when this value is close to 100%.


type: float

--

[float]
=== entropy

Available system entropy



*`system.entropy.available_bits`*::
+
--
The available bits of entropy


type: long

--

*`system.entropy.pct`*::
+
--
The percentage of available entropy, relative to the pool size of 4096


type: scaled_float

format: percent

--

[float]
=== filesystem

`filesystem` contains local filesystem stats.



*`system.filesystem.available`*::
+
--
The disk space available to an unprivileged user in bytes.


type: long

format: bytes

--

*`system.filesystem.device_name`*::
+
--
The disk name. For example: `/dev/disk1`


type: keyword

--

*`system.filesystem.type`*::
+
--
The disk type. For example: `ext4`. In some case for Windows OS the value will be `unavailable` as access to this information is not allowed (ex. external disks).


type: keyword

--

*`system.filesystem.mount_point`*::
+
--
The mounting point. For example: `/`


type: keyword

--

*`system.filesystem.files`*::
+
--
Total number of inodes on the system, which will be a combination of files, folders, symlinks, and devices.


type: long

--

*`system.filesystem.options`*::
+
--
The options present on the filesystem mount.


type: keyword

--

*`system.filesystem.free`*::
+
--
The disk space available in bytes.


type: long

format: bytes

--

*`system.filesystem.free_files`*::
+
--
The number of free file nodes in the file system.


type: long

--

*`system.filesystem.total`*::
+
--
The total disk space in bytes.


type: long

format: bytes

--

*`system.filesystem.used.bytes`*::
+
--
The used disk space in bytes.


type: long

format: bytes

--

*`system.filesystem.used.pct`*::
+
--
The percentage of used disk space.


type: scaled_float

format: percent

--

[float]
=== fsstat

`system.fsstat` contains filesystem metrics aggregated from all mounted filesystems.



*`system.fsstat.count`*::
+
--
Number of file systems found.

type: long

--

*`system.fsstat.total_files`*::
+
--
Total number of files. Not on Windows.

type: long

--

[float]
=== total_size

Nested file system docs.


*`system.fsstat.total_size.free`*::
+
--
Total free space.


type: long

format: bytes

--

*`system.fsstat.total_size.used`*::
+
--
Total used space.


type: long

format: bytes

--

*`system.fsstat.total_size.total`*::
+
--
Total space (used plus free).


type: long

format: bytes

--

[float]
=== load

CPU load averages.



*`system.load.1`*::
+
--
Load average for the last minute.


type: scaled_float

--

*`system.load.5`*::
+
--
Load average for the last 5 minutes.


type: scaled_float

--

*`system.load.15`*::
+
--
Load average for the last 15 minutes.


type: scaled_float

--

*`system.load.norm.1`*::
+
--
Load for the last minute divided by the number of cores.


type: scaled_float

--

*`system.load.norm.5`*::
+
--
Load for the last 5 minutes divided by the number of cores.


type: scaled_float

--

*`system.load.norm.15`*::
+
--
Load for the last 15 minutes divided by the number of cores.


type: scaled_float

--

*`system.load.cores`*::
+
--
The number of CPU cores present on the host.


type: long

--

[float]
=== memory

`memory` contains local memory stats.



*`system.memory.total`*::
+
--
Total memory.


type: long

format: bytes

--

*`system.memory.used.bytes`*::
+
--
Used memory.


type: long

format: bytes

--

*`system.memory.free`*::
+
--
The total amount of free memory in bytes. This value does not include memory consumed by system caches and buffers (see system.memory.actual.free).


type: long

format: bytes

--

*`system.memory.cached`*::
+
--
Total Cached memory on system.


type: long

format: bytes

--

*`system.memory.used.pct`*::
+
--
The percentage of used memory.


type: scaled_float

format: percent

--

[float]
=== actual

Actual memory used and free.



*`system.memory.actual.used.bytes`*::
+
--
Actual used memory in bytes. It represents the difference between the total and the available memory. The available memory depends on the OS. For more details, please check `system.actual.free`.


type: long

format: bytes

--

*`system.memory.actual.free`*::
+
--
Actual free memory in bytes. It is calculated based on the OS. On Linux this value will be MemAvailable from /proc/meminfo,  or calculated from free memory plus caches and buffers if /proc/meminfo is not available. On OSX it is a sum of free memory and the inactive memory. On Windows, it is equal to `system.memory.free`.


type: long

format: bytes

--

*`system.memory.actual.used.pct`*::
+
--
The percentage of actual used memory.


type: scaled_float

format: percent

--

[float]
=== swap

This group contains statistics related to the swap memory usage on the system.


*`system.memory.swap.total`*::
+
--
Total swap memory.


type: long

format: bytes

--

*`system.memory.swap.used.bytes`*::
+
--
Used swap memory.


type: long

format: bytes

--

*`system.memory.swap.free`*::
+
--
Available swap memory.


type: long

format: bytes

--

*`system.memory.swap.out.pages`*::
+
--
count of pages swapped out

type: long

--

*`system.memory.swap.in.pages`*::
+
--
count of pages swapped in

type: long

--

*`system.memory.swap.readahead.pages`*::
+
--
swap readahead pages

type: long

--

*`system.memory.swap.readahead.cached`*::
+
--
swap readahead cache hits

type: long

--

*`system.memory.swap.used.pct`*::
+
--
The percentage of used swap memory.


type: scaled_float

format: percent

--

[float]
=== page_stats

memory page statistics


*`system.memory.page_stats.pgscan_kswapd.pages`*::
+
--
pages scanned by kswapd

type: long

format: number

--

*`system.memory.page_stats.pgscan_direct.pages`*::
+
--
pages scanned directly

type: long

format: number

--

*`system.memory.page_stats.pgfree.pages`*::
+
--
pages freed by the system

type: long

format: number

--

*`system.memory.page_stats.pgsteal_kswapd.pages`*::
+
--
number of pages reclaimed by kswapd

type: long

format: number

--

*`system.memory.page_stats.pgsteal_direct.pages`*::
+
--
number of pages reclaimed directly

type: long

format: number

--

*`system.memory.page_stats.direct_efficiency.pct`*::
+
--
direct reclaim efficiency percentage. A lower percentage indicates the system is struggling to reclaim memory.

type: scaled_float

format: percent

--

*`system.memory.page_stats.kswapd_efficiency.pct`*::
+
--
kswapd reclaim efficiency percentage. A lower percentage indicates the system is struggling to reclaim memory.

type: scaled_float

format: percent

--

[float]
=== hugepages

This group contains statistics related to huge pages usage on the system.


*`system.memory.hugepages.total`*::
+
--
Number of huge pages in the pool.


type: long

format: number

--

*`system.memory.hugepages.used.bytes`*::
+
--
Memory used in allocated huge pages.


type: long

format: bytes

--

*`system.memory.hugepages.used.pct`*::
+
--
Percentage of huge pages used.


type: long

format: percent

--

*`system.memory.hugepages.free`*::
+
--
Number of available huge pages in the pool.


type: long

format: number

--

*`system.memory.hugepages.reserved`*::
+
--
Number of reserved but not allocated huge pages in the pool.


type: long

format: number

--

*`system.memory.hugepages.surplus`*::
+
--
Number of overcommited huge pages.


type: long

format: number

--

*`system.memory.hugepages.default_size`*::
+
--
Default size for huge pages.


type: long

format: bytes

--

[float]
=== swap.out

huge pages swapped out


*`system.memory.hugepages.swap.out.pages`*::
+
--
pages swapped out

type: long

--

*`system.memory.hugepages.swap.out.fallback`*::
+
--
Count of huge pages that must be split before swapout

type: long

--

[float]
=== network

`network` contains network IO metrics for a single network interface.



*`system.network.name`*::
+
--
The network interface name.


type: keyword

example: eth0

--

*`system.network.out.bytes`*::
+
--
The number of bytes sent.


type: long

format: bytes

--

*`system.network.in.bytes`*::
+
--
The number of bytes received.


type: long

format: bytes

--

*`system.network.out.packets`*::
+
--
The number of packets sent.


type: long

--

*`system.network.in.packets`*::
+
--
The number or packets received.


type: long

--

*`system.network.in.errors`*::
+
--
The number of errors while receiving.


type: long

--

*`system.network.out.errors`*::
+
--
The number of errors while sending.


type: long

--

*`system.network.in.dropped`*::
+
--
The number of incoming packets that were dropped.


type: long

--

*`system.network.out.dropped`*::
+
--
The number of outgoing packets that were dropped. This value is always 0 on Darwin and BSD because it is not reported by the operating system.


type: long

--

[float]
=== network_summary

Metrics relating to global network activity



*`system.network_summary.ip.*`*::
+
--
IP counters


type: object

--

*`system.network_summary.tcp.*`*::
+
--
TCP counters


type: object

--

*`system.network_summary.udp.*`*::
+
--
UDP counters


type: object

--

*`system.network_summary.udp_lite.*`*::
+
--
UDP Lite counters


type: object

--

*`system.network_summary.icmp.*`*::
+
--
ICMP counters


type: object

--

[float]
=== process

`process` contains process metadata, CPU metrics, and memory metrics.



*`system.process.name`*::
+
--
type: alias

alias to: process.name

--

*`system.process.state`*::
+
--
The process state. For example: "running".


type: keyword

--

*`system.process.pid`*::
+
--
type: alias

alias to: process.pid

--

*`system.process.ppid`*::
+
--
type: alias

alias to: process.ppid

--

*`system.process.pgid`*::
+
--
type: alias

alias to: process.pgid

--

*`system.process.cmdline`*::
+
--
The full command-line used to start the process, including the arguments separated by space.


type: keyword

--

*`system.process.username`*::
+
--
type: alias

alias to: user.name

--

*`system.process.cwd`*::
+
--
type: alias

alias to: process.working_directory

--

*`system.process.env`*::
+
--
The environment variables used to start the process. The data is available on FreeBSD, Linux, and OS X.


type: object

--

[float]
=== cpu

CPU-specific statistics per process.


*`system.process.cpu.user.ticks`*::
+
--
The amount of CPU time the process spent in user space.


type: long

--

*`system.process.cpu.total.value`*::
+
--
The value of CPU usage since starting the process.


type: long

--

*`system.process.cpu.total.pct`*::
+
--
The percentage of CPU time spent by the process since the last update. Its value is similar to the %CPU value of the process displayed by the top command on Unix systems.


type: scaled_float

format: percent

--

*`system.process.cpu.total.norm.pct`*::
+
--
The percentage of CPU time spent by the process since the last event. This value is normalized by the number of CPU cores and it ranges from 0 to 100%.


type: scaled_float

format: percent

--

*`system.process.cpu.system.ticks`*::
+
--
The amount of CPU time the process spent in kernel space.


type: long

--

*`system.process.cpu.total.ticks`*::
+
--
The total CPU time spent by the process.


type: long

--

*`system.process.cpu.start_time`*::
+
--
The time when the process was started.


type: date

--

[float]
=== memory

Memory-specific statistics per process.


*`system.process.memory.size`*::
+
--
The total virtual memory the process has. On Windows this represents the Commit Charge (the total amount of memory that the memory manager has committed for a running process) value in bytes for this process.


type: long

format: bytes

--

*`system.process.memory.rss.bytes`*::
+
--
The Resident Set Size. The amount of memory the process occupied in main memory (RAM). On Windows this represents the current working set size, in bytes.


type: long

format: bytes

--

*`system.process.memory.rss.pct`*::
+
--
The percentage of memory the process occupied in main memory (RAM).


type: scaled_float

format: percent

--

*`system.process.memory.share`*::
+
--
The shared memory the process uses.


type: long

format: bytes

--

[float]
=== fd

File descriptor usage metrics. This set of metrics is available for Linux and FreeBSD.



*`system.process.fd.open`*::
+
--
The number of file descriptors open by the process.

type: long

--

*`system.process.fd.limit.soft`*::
+
--
The soft limit on the number of file descriptors opened by the process. The soft limit can be changed by the process at any time.


type: long

--

*`system.process.fd.limit.hard`*::
+
--
The hard limit on the number of file descriptors opened by the process. The hard limit can only be raised by root.


type: long

--

[float]
=== cgroup

Metrics and limits from the cgroup of which the task is a member. cgroup metrics are reported when the process has membership in a non-root cgroup. These metrics are only available on Linux.



*`system.process.cgroup.id`*::
+
--
The ID common to all cgroups associated with this task. If there isn't a common ID used by all cgroups this field will be absent.


type: keyword

--

*`system.process.cgroup.path`*::
+
--
The path to the cgroup relative to the cgroup subsystem's mountpoint. If there isn't a common path used by all cgroups this field will be absent.


type: keyword

--

*`system.process.cgroup.cgroups_version`*::
+
--
The version of cgroups reported for the process

type: long

--

[float]
=== cpu

The cpu subsystem schedules CPU access for tasks in the cgroup. Access can be controlled by two separate schedulers, CFS and RT. CFS stands for completely fair scheduler which proportionally divides the CPU time between cgroups based on weight. RT stands for real time scheduler which sets a maximum amount of CPU time that processes in the cgroup can consume during a given period. In CPU under cgroups V2, the cgroup is merged with many of the metrics from cpuacct. In addition, per-scheduler metrics are gone in V2.



*`system.process.cgroup.cpu.id`*::
+
--
ID of the cgroup.

type: keyword

--

*`system.process.cgroup.cpu.path`*::
+
--
Path to the cgroup relative to the cgroup subsystem's mountpoint.


type: keyword

--

[float]
=== stats

cgroupv2 stats


*`system.process.cgroup.cpu.stats.usage.ns`*::
+
--
cgroups v2 usage in nanoseconds

type: long

--

*`system.process.cgroup.cpu.stats.usage.pct`*::
+
--
cgroups v2 usage

type: float

--

*`system.process.cgroup.cpu.stats.usage.norm.pct`*::
+
--
cgroups v2 normalized usage

type: float

--

*`system.process.cgroup.cpu.stats.user.ns`*::
+
--
cgroups v2 cpu user time in nanoseconds

type: long

--

*`system.process.cgroup.cpu.stats.user.pct`*::
+
--
cgroups v2 cpu user time

type: float

--

*`system.process.cgroup.cpu.stats.user.norm.pct`*::
+
--
cgroups v2 normalized cpu user time

type: float

--

*`system.process.cgroup.cpu.stats.system.ns`*::
+
--
cgroups v2 system time in nanoseconds

type: long

--

*`system.process.cgroup.cpu.stats.system.pct`*::
+
--
cgroups v2 system time

type: float

--

*`system.process.cgroup.cpu.stats.system.norm.pct`*::
+
--
cgroups v2 normalized system time

type: float

--

*`system.process.cgroup.cpu.cfs.period.us`*::
+
--
Period of time in microseconds for how regularly a cgroup's access to CPU resources should be reallocated.


type: long

--

*`system.process.cgroup.cpu.cfs.quota.us`*::
+
--
Total amount of time in microseconds for which all tasks in a cgroup can run during one period (as defined by cfs.period.us).


type: long

--

*`system.process.cgroup.cpu.cfs.shares`*::
+
--
An integer value that specifies a relative share of CPU time available to the tasks in a cgroup. The value specified in the cpu.shares file must be 2 or higher.


type: long

--

*`system.process.cgroup.cpu.rt.period.us`*::
+
--
Period of time in microseconds for how regularly a cgroup's access to CPU resources is reallocated.


type: long

--

*`system.process.cgroup.cpu.rt.runtime.us`*::
+
--
Period of time in microseconds for the longest continuous period in which the tasks in a cgroup have access to CPU resources.


type: long

--

*`system.process.cgroup.cpu.stats.periods`*::
+
--
Number of period intervals (as specified in cpu.cfs.period.us) that have elapsed.


type: long

--

*`system.process.cgroup.cpu.stats.throttled.periods`*::
+
--
Number of times tasks in a cgroup have been throttled (that is, not allowed to run because they have exhausted all of the available time as specified by their quota).


type: long

--

*`system.process.cgroup.cpu.stats.throttled.us`*::
+
--
The total time duration (in microseconds) for which tasks in a cgroup have been throttled, as reported by cgroupsv2


type: long

--

*`system.process.cgroup.cpu.stats.throttled.ns`*::
+
--
The total time duration (in nanoseconds) for which tasks in a cgroup have been throttled.


type: long

--

[float]
=== pressure

Pressure (resource contention) stats.


[float]
=== some

Share of time in which at least some tasks are stalled on a given resource


*`system.process.cgroup.cpu.pressure.some.10.pct`*::
+
--
Pressure over 10 seconds

type: float

format: percent

--

*`system.process.cgroup.cpu.pressure.some.60.pct`*::
+
--
Pressure over 60 seconds

type: float

format: percent

--

*`system.process.cgroup.cpu.pressure.some.300.pct`*::
+
--
Pressure over 300 seconds

type: float

format: percent

--

*`system.process.cgroup.cpu.pressure.some.total`*::
+
--
total Some pressure time

type: long

format: percent

--

[float]
=== full

Share of time in which all non-idle tasks are stalled on a given resource simultaneously


*`system.process.cgroup.cpu.pressure.full.10.pct`*::
+
--
Pressure over 10 seconds

type: float

format: percent

--

*`system.process.cgroup.cpu.pressure.full.60.pct`*::
+
--
Pressure over 60 seconds

type: float

format: percent

--

*`system.process.cgroup.cpu.pressure.full.300.pct`*::
+
--
Pressure over 300 seconds

type: float

format: percent

--

*`system.process.cgroup.cpu.pressure.full.total`*::
+
--
total Full pressure time

type: long

--

[float]
=== cpuacct

CPU accounting metrics.


*`system.process.cgroup.cpuacct.id`*::
+
--
ID of the cgroup.

type: keyword

--

*`system.process.cgroup.cpuacct.path`*::
+
--
Path to the cgroup relative to the cgroup subsystem's mountpoint.


type: keyword

--

*`system.process.cgroup.cpuacct.total.ns`*::
+
--
Total CPU time in nanoseconds consumed by all tasks in the cgroup.


type: long

--

*`system.process.cgroup.cpuacct.total.pct`*::
+
--
CPU time of the cgroup as a percentage of overall CPU time.


type: scaled_float

--

*`system.process.cgroup.cpuacct.total.norm.pct`*::
+
--
CPU time of the cgroup as a percentage of overall CPU time, normalized by CPU count. This is functionally an average of time spent across individual CPUs.


type: scaled_float

--

*`system.process.cgroup.cpuacct.stats.user.ns`*::
+
--
CPU time consumed by tasks in user mode.

type: long

--

*`system.process.cgroup.cpuacct.stats.user.pct`*::
+
--
time the cgroup spent in user space, as a percentage of total CPU time

type: scaled_float

--

*`system.process.cgroup.cpuacct.stats.user.norm.pct`*::
+
--
time the cgroup spent in user space, as a percentage of total CPU time, normalized by CPU count.

type: scaled_float

--

*`system.process.cgroup.cpuacct.stats.system.ns`*::
+
--
CPU time consumed by tasks in user (kernel) mode.

type: long

--

*`system.process.cgroup.cpuacct.stats.system.pct`*::
+
--
Time the cgroup spent in kernel space, as a percentage of total CPU time

type: scaled_float

--

*`system.process.cgroup.cpuacct.stats.system.norm.pct`*::
+
--
Time the cgroup spent in kernel space, as a percentage of total CPU time, normalized by CPU count.

type: scaled_float

--

*`system.process.cgroup.cpuacct.percpu`*::
+
--
CPU time (in nanoseconds) consumed on each CPU by all tasks in this cgroup.


type: object

--

[float]
=== memory

Memory limits and metrics.


*`system.process.cgroup.memory.id`*::
+
--
ID of the cgroup.

type: keyword

--

*`system.process.cgroup.memory.path`*::
+
--
Path to the cgroup relative to the cgroup subsystem's mountpoint.


type: keyword

--

*`system.process.cgroup.memory.mem.usage.bytes`*::
+
--
Total memory usage by processes in the cgroup (in bytes).


type: long

format: bytes

--

*`system.process.cgroup.memory.mem.usage.max.bytes`*::
+
--
The maximum memory used by processes in the cgroup (in bytes).


type: long

format: bytes

--

*`system.process.cgroup.memory.mem.limit.bytes`*::
+
--
The maximum amount of user memory in bytes (including file cache) that tasks in the cgroup are allowed to use.


type: long

format: bytes

--

*`system.process.cgroup.memory.mem.failures`*::
+
--
The number of times that the memory limit (mem.limit.bytes) was reached.


type: long

--

*`system.process.cgroup.memory.mem.low.bytes`*::
+
--
memory low threshhold

type: long

format: bytes

--

*`system.process.cgroup.memory.mem.high.bytes`*::
+
--
memory high threshhold

type: long

format: bytes

--

*`system.process.cgroup.memory.mem.max.bytes`*::
+
--
memory max threshhold

type: long

format: bytes

--

[float]
=== mem.events

number of times the controller tripped a given usage level


*`system.process.cgroup.memory.mem.events.low`*::
+
--
low threshold

type: long

--

*`system.process.cgroup.memory.mem.events.high`*::
+
--
high threshold

type: long

--

*`system.process.cgroup.memory.mem.events.max`*::
+
--
max threshold

type: long

--

*`system.process.cgroup.memory.mem.events.oom`*::
+
--
oom threshold

type: long

--

*`system.process.cgroup.memory.mem.events.oom_kill`*::
+
--
oom killer threshold

type: long

--

*`system.process.cgroup.memory.mem.events.fail`*::
+
--
failed threshold

type: long

--

*`system.process.cgroup.memory.memsw.usage.bytes`*::
+
--
The sum of current memory usage plus swap space used by processes in the cgroup (in bytes).


type: long

format: bytes

--

*`system.process.cgroup.memory.memsw.usage.max.bytes`*::
+
--
The maximum amount of memory and swap space used by processes in the cgroup (in bytes).


type: long

format: bytes

--

*`system.process.cgroup.memory.memsw.limit.bytes`*::
+
--
The maximum amount for the sum of memory and swap usage that tasks in the cgroup are allowed to use.


type: long

format: bytes

--

*`system.process.cgroup.memory.memsw.low.bytes`*::
+
--
memory low threshhold

type: long

format: bytes

--

*`system.process.cgroup.memory.memsw.high.bytes`*::
+
--
memory high threshhold

type: long

format: bytes

--

*`system.process.cgroup.memory.memsw.max.bytes`*::
+
--
memory max threshhold

type: long

format: bytes

--

*`system.process.cgroup.memory.memsw.failures`*::
+
--
The number of times that the memory plus swap space limit (memsw.limit.bytes) was reached.


type: long

--

[float]
=== memsw.events

number of times the controller tripped a given usage level


*`system.process.cgroup.memory.memsw.events.low`*::
+
--
low threshold

type: long

--

*`system.process.cgroup.memory.memsw.events.high`*::
+
--
high threshold

type: long

--

*`system.process.cgroup.memory.memsw.events.max`*::
+
--
max threshold

type: long

--

*`system.process.cgroup.memory.memsw.events.oom`*::
+
--
oom threshold

type: long

--

*`system.process.cgroup.memory.memsw.events.oom_kill`*::
+
--
oom killer threshold

type: long

--

*`system.process.cgroup.memory.memsw.events.fail`*::
+
--
failed threshold

type: long

--

*`system.process.cgroup.memory.kmem.usage.bytes`*::
+
--
Total kernel memory usage by processes in the cgroup (in bytes).


type: long

format: bytes

--

*`system.process.cgroup.memory.kmem.usage.max.bytes`*::
+
--
The maximum kernel memory used by processes in the cgroup (in bytes).


type: long

format: bytes

--

*`system.process.cgroup.memory.kmem.limit.bytes`*::
+
--
The maximum amount of kernel memory that tasks in the cgroup are allowed to use.


type: long

format: bytes

--

*`system.process.cgroup.memory.kmem.failures`*::
+
--
The number of times that the memory limit (kmem.limit.bytes) was reached.


type: long

--

*`system.process.cgroup.memory.kmem_tcp.usage.bytes`*::
+
--
Total memory usage for TCP buffers in bytes.


type: long

format: bytes

--

*`system.process.cgroup.memory.kmem_tcp.usage.max.bytes`*::
+
--
The maximum memory used for TCP buffers by processes in the cgroup (in bytes).


type: long

format: bytes

--

*`system.process.cgroup.memory.kmem_tcp.limit.bytes`*::
+
--
The maximum amount of memory for TCP buffers that tasks in the cgroup are allowed to use.


type: long

format: bytes

--

*`system.process.cgroup.memory.kmem_tcp.failures`*::
+
--
The number of times that the memory limit (kmem_tcp.limit.bytes) was reached.


type: long

--

*`system.process.cgroup.memory.stats.*`*::
+
--
detailed memory IO stats

type: object

--

*`system.process.cgroup.memory.stats.*.bytes`*::
+
--
detailed memory IO stats

type: object

--

*`system.process.cgroup.memory.stats.active_anon.bytes`*::
+
--
Anonymous and swap cache on active least-recently-used (LRU) list, including tmpfs (shmem), in bytes.


type: long

format: bytes

--

*`system.process.cgroup.memory.stats.active_file.bytes`*::
+
--
File-backed memory on active LRU list, in bytes.

type: long

format: bytes

--

*`system.process.cgroup.memory.stats.cache.bytes`*::
+
--
Page cache, including tmpfs (shmem), in bytes.

type: long

format: bytes

--

*`system.process.cgroup.memory.stats.hierarchical_memory_limit.bytes`*::
+
--
Memory limit for the hierarchy that contains the memory cgroup, in bytes.


type: long

format: bytes

--

*`system.process.cgroup.memory.stats.hierarchical_memsw_limit.bytes`*::
+
--
Memory plus swap limit for the hierarchy that contains the memory cgroup, in bytes.


type: long

format: bytes

--

*`system.process.cgroup.memory.stats.inactive_anon.bytes`*::
+
--
Anonymous and swap cache on inactive LRU list, including tmpfs (shmem), in bytes


type: long

format: bytes

--

*`system.process.cgroup.memory.stats.inactive_file.bytes`*::
+
--
File-backed memory on inactive LRU list, in bytes.


type: long

format: bytes

--

*`system.process.cgroup.memory.stats.mapped_file.bytes`*::
+
--
Size of memory-mapped mapped files, including tmpfs (shmem), in bytes.


type: long

format: bytes

--

*`system.process.cgroup.memory.stats.page_faults`*::
+
--
Number of times that a process in the cgroup triggered a page fault.


type: long

--

*`system.process.cgroup.memory.stats.major_page_faults`*::
+
--
Number of times that a process in the cgroup triggered a major fault. "Major" faults happen when the kernel actually has to read the data from disk.


type: long

--

*`system.process.cgroup.memory.stats.pages_in`*::
+
--
Number of pages paged into memory. This is a counter.


type: long

--

*`system.process.cgroup.memory.stats.pages_out`*::
+
--
Number of pages paged out of memory. This is a counter.


type: long

--

*`system.process.cgroup.memory.stats.rss.bytes`*::
+
--
Anonymous and swap cache (includes transparent hugepages), not including tmpfs (shmem), in bytes.


type: long

format: bytes

--

*`system.process.cgroup.memory.stats.rss_huge.bytes`*::
+
--
Number of bytes of anonymous transparent hugepages.


type: long

format: bytes

--

*`system.process.cgroup.memory.stats.swap.bytes`*::
+
--
Swap usage, in bytes.


type: long

format: bytes

--

*`system.process.cgroup.memory.stats.unevictable.bytes`*::
+
--
Memory that cannot be reclaimed, in bytes.


type: long

format: bytes

--

[float]
=== blkio

Block IO metrics.


*`system.process.cgroup.blkio.id`*::
+
--
ID of the cgroup.

type: keyword

--

*`system.process.cgroup.blkio.path`*::
+
--
Path to the cgroup relative to the cgroup subsystems mountpoint.


type: keyword

--

*`system.process.cgroup.blkio.total.bytes`*::
+
--
Total number of bytes transferred to and from all block devices by processes in the cgroup.


type: long

format: bytes

--

*`system.process.cgroup.blkio.total.ios`*::
+
--
Total number of I/O operations performed on all devices by processes in the cgroup as seen by the throttling policy.


type: long

--

[float]
=== io

cgroup V2 IO Metrics, replacing blkio.


*`system.process.cgroup.io.id`*::
+
--
ID of the cgroup.

type: keyword

--

*`system.process.cgroup.io.path`*::
+
--
Path to the cgroup relative to the cgroup subsystems mountpoint.


type: keyword

--

*`system.process.cgroup.io.stats.*`*::
+
--
per-device IO usage stats

type: object

--

*`system.process.cgroup.io.stats.*.*`*::
+
--
type: object

--

*`system.process.cgroup.io.stats.*.*.bytes`*::
+
--
per-device IO usage stats

type: object

--

*`system.process.cgroup.io.stats.*.*.ios`*::
+
--
per-device IO usage stats

type: object

--

[float]
=== pressure

Pressure (resource contention) stats.


[float]
=== full

Share of time in which at least some tasks are stalled on a given resource


*`system.process.cgroup.io.pressure.full.10.pct`*::
+
--
Pressure over 10 seconds

type: float

format: percent

--

*`system.process.cgroup.io.pressure.full.60.pct`*::
+
--
Pressure over 60 seconds

type: float

format: percent

--

*`system.process.cgroup.io.pressure.full.300.pct`*::
+
--
Pressure over 300 seconds

type: float

format: percent

--

*`system.process.cgroup.io.pressure.full.total`*::
+
--
total Some pressure time

type: long

--

[float]
=== some

Share of time in which all tasks are stalled on a given resource


*`system.process.cgroup.io.pressure.some.10.pct`*::
+
--
Pressure over 10 seconds

type: float

format: percent

--

*`system.process.cgroup.io.pressure.some.60.pct`*::
+
--
Pressure over 60 seconds

type: float

format: percent

--

*`system.process.cgroup.io.pressure.some.300.pct`*::
+
--
Pressure over 300 seconds

type: float

--

*`system.process.cgroup.io.pressure.some.total`*::
+
--
total Some pressure time

type: long

--

[float]
=== process.summary

Summary metrics for the processes running on the host.



*`system.process.summary.total`*::
+
--
Total number of processes on this host.


type: long

--

*`system.process.summary.running`*::
+
--
Number of running processes on this host.


type: long

--

*`system.process.summary.idle`*::
+
--
Number of idle processes on this host.


type: long

--

*`system.process.summary.sleeping`*::
+
--
Number of sleeping processes on this host.


type: long

--

*`system.process.summary.stopped`*::
+
--
Number of stopped processes on this host.


type: long

--

*`system.process.summary.zombie`*::
+
--
Number of zombie processes on this host.


type: long

--

*`system.process.summary.dead`*::
+
--
Number of dead processes on this host. It's very unlikely that it will appear but in some special situations it may happen.


type: long

--

*`system.process.summary.unknown`*::
+
--
Number of processes for which the state couldn't be retrieved or is unknown.


type: long

--

[float]
=== raid

raid



*`system.raid.name`*::
+
--
Name of the device.


type: keyword

--

*`system.raid.status`*::
+
--
activity-state of the device.


type: keyword

--

*`system.raid.level`*::
+
--
The raid level of the device


type: keyword

--

*`system.raid.sync_action`*::
+
--
Current sync action, if the RAID array is redundant 


type: keyword

--

*`system.raid.disks.active`*::
+
--
Number of active disks.


type: long

--

*`system.raid.disks.total`*::
+
--
Total number of disks the device consists of.


type: long

--

*`system.raid.disks.spare`*::
+
--
Number of spared disks.


type: long

--

*`system.raid.disks.failed`*::
+
--
Number of failed disks.


type: long

--

*`system.raid.disks.states.*`*::
+
--
map of raw disk states


type: object

--

*`system.raid.blocks.total`*::
+
--
Number of blocks the device holds, in 1024-byte blocks.


type: long

--

*`system.raid.blocks.synced`*::
+
--
Number of blocks on the device that are in sync, in 1024-byte blocks.


type: long

--

[float]
=== service

metrics for system services



*`system.service.name`*::
+
--
The name of the service

type: keyword

--

*`system.service.load_state`*::
+
--
The load state of the service

type: keyword

--

*`system.service.state`*::
+
--
The activity state of the service

type: keyword

--

*`system.service.sub_state`*::
+
--
The sub-state of the service

type: keyword

--

*`system.service.state_since`*::
+
--
The timestamp of the last state change. If the service is active and running, this is its uptime.

type: date

--

*`system.service.exec_code`*::
+
--
The SIGCHLD code from the service's main process

type: keyword

--

*`system.service.unit_file.state`*::
+
--
The state of the unit file

type: keyword

--

*`system.service.unit_file.vendor_preset`*::
+
--
The default state of the unit file

type: keyword

--

[float]
=== resources

system metrics associated with the service


*`system.service.resources.cpu.usage.ns`*::
+
--
CPU usage in nanoseconds

type: long

--

*`system.service.resources.memory.usage.bytes`*::
+
--
memory usage in bytes

type: long

--

*`system.service.resources.tasks.count`*::
+
--
number of tasks associated with the service

type: long

--

[float]
=== network

network resource usage


*`system.service.resources.network.in.bytes`*::
+
--
bytes in

type: long

format: bytes

--

*`system.service.resources.network.in.packets`*::
+
--
packets in

type: long

format: bytes

--

*`system.service.resources.network.out.packets`*::
+
--
packets out

type: long

--

*`system.service.resources.network.out.bytes`*::
+
--
bytes out

type: long

--

[float]
=== socket

TCP sockets that are active.



*`system.socket.direction`*::
+
--
type: alias

alias to: network.direction

--

*`system.socket.family`*::
+
--
type: alias

alias to: network.type

--

*`system.socket.local.ip`*::
+
--
Local IP address. This can be an IPv4 or IPv6 address.


type: ip

example: 192.0.2.1 or 2001:0DB8:ABED:8536::1

--

*`system.socket.local.port`*::
+
--
Local port.


type: long

example: 22

--

*`system.socket.remote.ip`*::
+
--
Remote IP address. This can be an IPv4 or IPv6 address.


type: ip

example: 192.0.2.1 or 2001:0DB8:ABED:8536::1

--

*`system.socket.remote.port`*::
+
--
Remote port.


type: long

example: 22

--

*`system.socket.remote.host`*::
+
--
PTR record associated with the remote IP. It is obtained via reverse IP lookup.


type: keyword

example: 76-211-117-36.nw.example.com.

--

*`system.socket.remote.etld_plus_one`*::
+
--
The effective top-level domain (eTLD) of the remote host plus one more label. For example, the eTLD+1 for "foo.bar.golang.org." is "golang.org.". The data for determining the eTLD comes from an embedded copy of the data from http://publicsuffix.org.


type: keyword

example: example.com.

--

*`system.socket.remote.host_error`*::
+
--
Error describing the cause of the reverse lookup failure.


type: keyword

--

*`system.socket.process.pid`*::
+
--
type: alias

alias to: process.pid

--

*`system.socket.process.command`*::
+
--
type: alias

alias to: process.name

--

*`system.socket.process.cmdline`*::
+
--
Full command line


type: keyword

--

*`system.socket.process.exe`*::
+
--
type: alias

alias to: process.executable

--

*`system.socket.user.id`*::
+
--
type: alias

alias to: user.id

--

*`system.socket.user.name`*::
+
--
type: alias

alias to: user.full_name

--

[float]
=== socket.summary

Summary metrics of open sockets in the host system



[float]
=== all

All connections



*`system.socket.summary.all.count`*::
+
--
All open connections


type: integer

--

*`system.socket.summary.all.listening`*::
+
--
All listening ports


type: integer

--

[float]
=== tcp

All TCP connections



*`system.socket.summary.tcp.memory`*::
+
--
Memory used by TCP sockets in bytes, based on number of allocated pages and system page size. Corresponds to limits set in /proc/sys/net/ipv4/tcp_mem. Only available on Linux. 


type: integer

format: bytes

--

[float]
=== all

All TCP connections



*`system.socket.summary.tcp.all.orphan`*::
+
--
A count of all orphaned tcp sockets. Only available on Linux.


type: integer

--

*`system.socket.summary.tcp.all.count`*::
+
--
All open TCP connections


type: integer

--

*`system.socket.summary.tcp.all.listening`*::
+
--
All TCP listening ports


type: integer

--

*`system.socket.summary.tcp.all.established`*::
+
--
Number of established TCP connections


type: integer

--

*`system.socket.summary.tcp.all.close_wait`*::
+
--
Number of TCP connections in _close_wait_ state


type: integer

--

*`system.socket.summary.tcp.all.time_wait`*::
+
--
Number of TCP connections in _time_wait_ state


type: integer

--

*`system.socket.summary.tcp.all.syn_sent`*::
+
--
Number of TCP connections in _syn_sent_ state


type: integer

--

*`system.socket.summary.tcp.all.syn_recv`*::
+
--
Number of TCP connections in _syn_recv_ state


type: integer

--

*`system.socket.summary.tcp.all.fin_wait1`*::
+
--
Number of TCP connections in _fin_wait1_ state


type: integer

--

*`system.socket.summary.tcp.all.fin_wait2`*::
+
--
Number of TCP connections in _fin_wait2_ state


type: integer

--

*`system.socket.summary.tcp.all.last_ack`*::
+
--
Number of TCP connections in _last_ack_ state


type: integer

--

*`system.socket.summary.tcp.all.closing`*::
+
--
Number of TCP connections in _closing_ state


type: integer

--

[float]
=== udp

All UDP connections



*`system.socket.summary.udp.memory`*::
+
--
Memory used by UDP sockets in bytes, based on number of allocated pages and system page size. Corresponds to limits set in /proc/sys/net/ipv4/udp_mem. Only available on Linux. 


type: integer

format: bytes

--

[float]
=== all

All UDP connections



*`system.socket.summary.udp.all.count`*::
+
--
All open UDP connections


type: integer

--

[float]
=== uptime

`uptime` contains the operating system uptime metric.



*`system.uptime.duration.ms`*::
+
--
The OS uptime in milliseconds.


type: long

format: duration

--

[float]
=== users

Logged-in user session data



*`system.users.id`*::
+
--
The ID of the session


type: keyword

--

*`system.users.seat`*::
+
--
An associated logind seat


type: keyword

--

*`system.users.path`*::
+
--
The DBus object path of the session


type: keyword

--

*`system.users.type`*::
+
--
The type of the user session


type: keyword

--

*`system.users.service`*::
+
--
A session associated with the service


type: keyword

--

*`system.users.remote`*::
+
--
A bool indicating a remote session


type: boolean

--

*`system.users.state`*::
+
--
The current state of the session


type: keyword

--

*`system.users.scope`*::
+
--
The associated systemd scope


type: keyword

--

*`system.users.leader`*::
+
--
The root PID of the session


type: long

--

*`system.users.remote_host`*::
+
--
A remote host address for the session


type: keyword

--

[[exported-fields-tomcat]]
== Tomcat fields

Tomcat module




[float]
=== cache

Catalina Cache metrics from the WebResourceRoot


*`tomcat.cache.mbean`*::
+
--
Mbean that this event is related to

type: keyword

--

*`tomcat.cache.hit.total`*::
+
--
The number of requests for resources that were served from the cache

type: long

--

*`tomcat.cache.size.total.kb`*::
+
--
The current estimate of the cache size in kilobytes

type: long

--

*`tomcat.cache.size.max.kb`*::
+
--
The maximum permitted size of the cache in kilobytes

type: long

--

*`tomcat.cache.lookup.total`*::
+
--
The number of requests for resources

type: long

--

*`tomcat.cache.ttl.ms`*::
+
--
The time-to-live for cache entries in milliseconds

type: long

--

[float]
=== memory

Memory metrics from java.lang JMX


*`tomcat.memory.mbean`*::
+
--
Mbean that this event is related to

type: keyword

--

*`tomcat.memory.heap.usage.committed`*::
+
--
Committed heap memory usage

type: long

--

*`tomcat.memory.heap.usage.max`*::
+
--
Max heap memory usage

type: long

--

*`tomcat.memory.heap.usage.used`*::
+
--
Used heap memory usage

type: long

--

*`tomcat.memory.heap.usage.init`*::
+
--
Initial heap memory usage

type: long

--

*`tomcat.memory.other.usage.committed`*::
+
--
Committed non-heap memory usage

type: long

--

*`tomcat.memory.other.usage.max`*::
+
--
Max non-heap memory usage

type: long

--

*`tomcat.memory.other.usage.used`*::
+
--
Used non-heap memory usage

type: long

--

*`tomcat.memory.other.usage.init`*::
+
--
Initial non-heap memory usage

type: long

--

[float]
=== requests

Requests processor metrics from GlobalRequestProcessor JMX


*`tomcat.requests.mbean`*::
+
--
Mbean that this event is related to

type: keyword

--

*`tomcat.requests.total`*::
+
--
Number of requests processed

type: long

--

*`tomcat.requests.bytes.received`*::
+
--
Amount of data received, in bytes

type: long

--

*`tomcat.requests.bytes.sent`*::
+
--
Amount of data sent, in bytes

type: long

--

*`tomcat.requests.processing.ms`*::
+
--
Total time to process the requests

type: long

--

*`tomcat.requests.errors.total`*::
+
--
Number of errors

type: long

--

[float]
=== threading

Threading metrics from the Catalina's ThreadPool JMX


*`tomcat.threading.busy`*::
+
--
Current busy threads from the ThreadPool

type: long

--

*`tomcat.threading.max`*::
+
--
Max threads from the ThreadPool

type: long

--

*`tomcat.threading.current`*::
+
--
Current number of threads, taken from the ThreadPool

type: long

--

*`tomcat.threading.keep_alive.total`*::
+
--
Total keep alive on the ThreadPool

type: long

--

*`tomcat.threading.keep_alive.timeout.ms`*::
+
--
Keep alive timeout on the ThreadPool

type: long

--

*`tomcat.threading.started.total`*::
+
--
Current started threads at JVM level (from java.lang:type=Threading)

type: long

--

*`tomcat.threading.user.time.ms`*::
+
--
User time in milliseconds (from java.lang:type=Threading)

type: long

--

*`tomcat.threading.cpu.time.ms`*::
+
--
CPU time in milliseconds (from java.lang:type=Threading)

type: long

--

*`tomcat.threading.total`*::
+
--
Total threads at the JVM level (from java.lang:type=Threading)

type: long

--

*`tomcat.threading.peak`*::
+
--
Peak number of threads at JVM level (from java.lang:type=Threading)

type: long

--

[[exported-fields-traefik]]
== Traefik fields

Traefik reverse proxy / load balancer metrics



[float]
=== traefik

Traefik reverse proxy / load balancer metrics



[float]
=== health

Metrics obtained from Traefik's health API endpoint



*`traefik.health.uptime.sec`*::
+
--
Uptime of Traefik instance in seconds


type: long

--

[float]
=== response

Response metrics



*`traefik.health.response.count`*::
+
--
Number of responses


type: long

--

*`traefik.health.response.avg_time.us`*::
+
--
Average response time in microseconds


type: long

--

*`traefik.health.response.status_codes.*`*::
+
--
Number of responses per status code


type: object

--

[[exported-fields-uwsgi]]
== uWSGI fields

uwsgi module



[float]
=== uwsgi




[float]
=== status

uwsgi.status metricset fields



*`uwsgi.status.total.requests`*::
+
--
Total requests handled


type: long

--

*`uwsgi.status.total.exceptions`*::
+
--
Total exceptions


type: long

--

*`uwsgi.status.total.write_errors`*::
+
--
Total requests write errors


type: long

--

*`uwsgi.status.total.read_errors`*::
+
--
Total read errors


type: long

--

*`uwsgi.status.total.pid`*::
+
--
Process id


type: long

--

*`uwsgi.status.worker.id`*::
+
--
Worker id


type: long

--

*`uwsgi.status.worker.pid`*::
+
--
Worker process id


type: long

--

*`uwsgi.status.worker.accepting`*::
+
--
State of worker, 1 if still accepting new requests otherwise 0


type: long

--

*`uwsgi.status.worker.requests`*::
+
--
Number of requests served by this worker


type: long

--

*`uwsgi.status.worker.delta_requests`*::
+
--
Number of requests served by this worker after worker is reloaded when reached MAX_REQUESTS


type: long

--

*`uwsgi.status.worker.exceptions`*::
+
--
Exceptions raised


type: long

--

*`uwsgi.status.worker.harakiri_count`*::
+
--
Dropped requests by timeout


type: long

--

*`uwsgi.status.worker.signals`*::
+
--
Emitted signals count


type: long

--

*`uwsgi.status.worker.signal_queue`*::
+
--
Number of signals waiting to be handled


type: long

--

*`uwsgi.status.worker.status`*::
+
--
Worker status (cheap, pause, sig, busy, idle)


type: keyword

--

*`uwsgi.status.worker.rss`*::
+
--
Resident Set Size. memory currently used by a process. if always zero try `--memory-report` option of uwsgi


type: long

--

*`uwsgi.status.worker.vsz`*::
+
--
Virtual Set Size. memory size assigned to a process. if always zero try `--memory-report` option of uwsgi


type: long

--

*`uwsgi.status.worker.running_time`*::
+
--
Process running time


type: long

--

*`uwsgi.status.worker.respawn_count`*::
+
--
Respawn count


type: long

--

*`uwsgi.status.worker.tx`*::
+
--
Transmitted size


type: long

--

*`uwsgi.status.worker.avg_rt`*::
+
--
Average response time


type: long

--

*`uwsgi.status.core.id`*::
+
--
worker ID


type: long

--

*`uwsgi.status.core.worker_pid`*::
+
--
Parent worker PID


type: long

--

*`uwsgi.status.core.requests.total`*::
+
--
Number of total requests served


type: long

--

*`uwsgi.status.core.requests.static`*::
+
--
Number of static file serves


type: long

--

*`uwsgi.status.core.requests.routed`*::
+
--
Routed requests


type: long

--

*`uwsgi.status.core.requests.offloaded`*::
+
--
Offloaded requests


type: long

--

*`uwsgi.status.core.write_errors`*::
+
--
Number of failed writes


type: long

--

*`uwsgi.status.core.read_errors`*::
+
--
Number of failed reads


type: long

--

[[exported-fields-vsphere]]
== vSphere fields

vSphere module



[float]
=== vsphere




[float]
=== datastore

datastore



*`vsphere.datastore.name`*::
+
--
Datastore name


type: keyword

--

*`vsphere.datastore.fstype`*::
+
--
Filesystem type


type: keyword

--

*`vsphere.datastore.capacity.total.bytes`*::
+
--
Total bytes of the datastore


type: long

format: bytes

--

*`vsphere.datastore.capacity.free.bytes`*::
+
--
Free bytes of the datastore


type: long

format: bytes

--

*`vsphere.datastore.capacity.used.bytes`*::
+
--
Used bytes of the datastore


type: long

format: bytes

--

*`vsphere.datastore.capacity.used.pct`*::
+
--
Used percent of the datastore


type: scaled_float

format: percent

--

[float]
=== host

host



*`vsphere.host.name`*::
+
--
Host name


type: keyword

--

*`vsphere.host.cpu.used.mhz`*::
+
--
Used CPU in Mhz


type: long

--

*`vsphere.host.cpu.total.mhz`*::
+
--
Total CPU in Mhz


type: long

--

*`vsphere.host.cpu.free.mhz`*::
+
--
Free CPU in Mhz


type: long

--

*`vsphere.host.memory.used.bytes`*::
+
--
Used Memory in bytes


type: long

format: bytes

--

*`vsphere.host.memory.total.bytes`*::
+
--
Total Memory in bytes


type: long

format: bytes

--

*`vsphere.host.memory.free.bytes`*::
+
--
Free Memory in bytes


type: long

format: bytes

--

*`vsphere.host.network_names`*::
+
--
Network names


type: keyword

--

[float]
=== virtualmachine

virtualmachine



*`vsphere.virtualmachine.host.id`*::
+
--
Host id


type: keyword

--

*`vsphere.virtualmachine.host.hostname`*::
+
--
Host name of the host


type: keyword

--

*`vsphere.virtualmachine.name`*::
+
--
Virtual Machine name


type: keyword

--

*`vsphere.virtualmachine.os`*::
+
--
Virtual Machine Operating System name


type: keyword

--

*`vsphere.virtualmachine.cpu.used.mhz`*::
+
--
Used CPU in Mhz


type: long

--

*`vsphere.virtualmachine.cpu.total.mhz`*::
+
--
Total CPU in Mhz


type: long

--

*`vsphere.virtualmachine.cpu.free.mhz`*::
+
--
Available CPU in Mhz


type: long

--

*`vsphere.virtualmachine.memory.used.guest.bytes`*::
+
--
Used Memory of Guest in bytes


type: long

format: bytes

--

*`vsphere.virtualmachine.memory.used.host.bytes`*::
+
--
Used Memory of Host in bytes


type: long

format: bytes

--

*`vsphere.virtualmachine.memory.total.guest.bytes`*::
+
--
Total Memory of Guest in bytes


type: long

format: bytes

--

*`vsphere.virtualmachine.memory.free.guest.bytes`*::
+
--
Free Memory of Guest in bytes


type: long

format: bytes

--

*`vsphere.virtualmachine.custom_fields`*::
+
--
Custom fields


type: object

--

*`vsphere.virtualmachine.network_names`*::
+
--
Network names


type: keyword

--

[[exported-fields-windows]]
== Windows fields

Module for Windows



[float]
=== windows




[float]
=== perfmon

perfmon



*`windows.perfmon.instance`*::
+
--
Instance value.


type: keyword

--

*`windows.perfmon.metrics.*.*`*::
+
--
Metric values returned.


type: object

--

[float]
=== service

`service` contains the status for Windows services.



*`windows.service.id`*::
+
--
A unique ID for the service. It is a hash of the machine's GUID and the service name.


type: keyword

example: hW3NJFc1Ap

--

*`windows.service.name`*::
+
--
The service name.


type: keyword

example: Wecsvc

--

*`windows.service.display_name`*::
+
--
The display name of the service.


type: keyword

example: Windows Event Collector

--

*`windows.service.start_type`*::
+
--
The startup type of the service. The possible values are `Automatic`, `Boot`, `Disabled`, `Manual`, and `System`.


type: keyword

--

*`windows.service.start_name`*::
+
--
Account name under which a service runs.


type: keyword

example: NT AUTHORITY\LocalService

--

*`windows.service.path_name`*::
+
--
Fully qualified path to the file that implements the service, including arguments.


type: keyword

example: C:\WINDOWS\system32\svchost.exe -k LocalService -p

--

*`windows.service.state`*::
+
--
The actual state of the service. The possible values are `Continuing`, `Pausing`, `Paused`, `Running`, `Starting`, `Stopping`, and `Stopped`.


type: keyword

--

*`windows.service.exit_code`*::
+
--
For `Stopped` services this is the error code that service reports when starting to stopping. This will be the generic Windows service error code unless the service provides a service-specific error code.


type: keyword

--

*`windows.service.pid`*::
+
--
For `Running` services this is the associated process PID.


type: long

example: 1092

--

*`windows.service.uptime.ms`*::
+
--
The service's uptime specified in milliseconds.


type: long

format: duration

--

[[exported-fields-zookeeper]]
== ZooKeeper fields

ZooKeeper metrics collected by the four-letter monitoring commands.



[float]
=== zookeeper

`zookeeper` contains the metrics reported by ZooKeeper commands.



[float]
=== connection

connections



*`zookeeper.connection.interest_ops`*::
+
--
Interest ops


type: long

--

*`zookeeper.connection.queued`*::
+
--
Queued connections


type: long

--

*`zookeeper.connection.received`*::
+
--
Received connections


type: long

--

*`zookeeper.connection.sent`*::
+
--
Connections sent


type: long

--

[float]
=== mntr

`mntr` contains the metrics reported by the four-letter `mntr` command.



*`zookeeper.mntr.hostname`*::
+
--
ZooKeeper hostname.


type: keyword

--

*`zookeeper.mntr.approximate_data_size`*::
+
--
Approximate size of ZooKeeper data.


type: long

--

*`zookeeper.mntr.latency.avg`*::
+
--
Average latency between ensemble hosts in milliseconds.


type: long

--

*`zookeeper.mntr.ephemerals_count`*::
+
--
Number of ephemeral znodes.


type: long

--

*`zookeeper.mntr.followers`*::
+
--
Number of followers seen by the current host (Up to ZooKeeper 3.5.9).


type: long

--

*`zookeeper.mntr.max_file_descriptor_count`*::
+
--
Maximum number of file descriptors allowed for the ZooKeeper process.


type: long

--

*`zookeeper.mntr.latency.max`*::
+
--
Maximum latency in milliseconds.


type: long

--

*`zookeeper.mntr.latency.min`*::
+
--
Minimum latency in milliseconds.


type: long

--

*`zookeeper.mntr.num_alive_connections`*::
+
--
Number of connections to ZooKeeper that are currently alive.


type: long

--

*`zookeeper.mntr.open_file_descriptor_count`*::
+
--
Number of file descriptors open by the ZooKeeper process.


type: long

--

*`zookeeper.mntr.outstanding_requests`*::
+
--
Number of outstanding requests that need to be processed by the cluster.


type: long

--

*`zookeeper.mntr.packets.received`*::
+
--
Number of ZooKeeper network packets received.


type: long

--

*`zookeeper.mntr.packets.sent`*::
+
--
Number of ZooKeeper network packets sent.


type: long

--

*`zookeeper.mntr.pending_syncs`*::
+
--
Number of pending syncs to carry out to ZooKeeper ensemble followers.


type: long

--

*`zookeeper.mntr.server_state`*::
+
--
Role in the ZooKeeper ensemble.


type: keyword

--

*`zookeeper.mntr.synced_followers`*::
+
--
Number of synced followers reported when a node server_state is leader.


type: long

--

*`zookeeper.mntr.version`*::
+
--
ZooKeeper version and build string reported.


type: alias

alias to: service.version

--

*`zookeeper.mntr.watch_count`*::
+
--
Number of watches currently set on the local ZooKeeper process.


type: long

--

*`zookeeper.mntr.znode_count`*::
+
--
Number of znodes reported by the local ZooKeeper process.


type: long

--

*`zookeeper.mntr.learners`*::
+
--
Number of learners (either followers or observers) seen by the current host (From ZooKeeper 3.6.0)


type: long

--

[float]
=== server

server contains the metrics reported by the four-letter `srvr` command.


*`zookeeper.server.connections`*::
+
--
Number of clients currently connected to the server

type: long

--


*`zookeeper.server.latency.avg`*::
+
--
Average amount of time taken for the server to respond to a client request

type: long

--

*`zookeeper.server.latency.max`*::
+
--
Maximum amount of time taken for the server to respond to a client request

type: long

--

*`zookeeper.server.latency.min`*::
+
--
Minimum amount of time taken for the server to respond to a client request

type: long

--

*`zookeeper.server.mode`*::
+
--
Mode of the server. In an ensemble, this may either be leader or follower. Otherwise, it is standalone

type: keyword

--

*`zookeeper.server.node_count`*::
+
--
Total number of nodes

type: long

--

*`zookeeper.server.outstanding`*::
+
--
Number of requests queued at the server. This exceeds zero when the server receives more requests than it is able to process

type: long

--

*`zookeeper.server.received`*::
+
--
Number of requests received by the server

type: long

--

*`zookeeper.server.sent`*::
+
--
Number of requests sent by the server

type: long

--

*`zookeeper.server.version_date`*::
+
--
Date of the Zookeeper release currently in use

type: date

--

*`zookeeper.server.zxid`*::
+
--
Unique value of the Zookeeper transaction ID. The zxid consists of an epoch and a counter. It is established by the leader and is used to determine the temporal ordering of changes

type: keyword

--

*`zookeeper.server.count`*::
+
--
Total transactions of the leader in epoch

type: long

--

*`zookeeper.server.epoch`*::
+
--
Epoch value of the Zookeeper transaction ID. An epoch signifies the period in which a server is a leader

type: long

--

