fields.yml

- name: access
  type: group
  description: >
    Contains fields for the Nginx access logs.
  fields:
    - name: remote_ip_list
      type: array
      description: >
        An array of remote IP addresses. It is a list because it is common to include, besides the client
        IP address, IP addresses from headers like `X-Forwarded-For`. See also the `remote_ip` field.
    - name: remote_ip
      type: keyword
      description: >
        Client IP address. The first public IP address from the `remote_ip_list` array. If no public IP
        addresses are present, this field contains the first private IP address from the `remote_ip_list`
        array.
    - name: user_name
      type: keyword
      description: >
        The user name used when basic authentication is used.
    - name: method
      type: keyword
      example: GET
      description: >
        The request HTTP method.
    - name: url
      type: keyword
      description: >
        The request HTTP URL.
    - name: http_version
      type: keyword
      description: >
        The HTTP version.
    - name: response_code
      type: long
      description: >
        The HTTP response code.
    - name: body_sent.bytes
      type: long
      format: bytes
      description: >
        The number of bytes of the server response body.
    - name: referrer
      type: keyword
      description: >
        The HTTP referrer.
    - name: agent
      type: text
      description: >
        Contains the un-parsed user agent string. Only present if the user
        agent Elasticsearch plugin is not available or not used.
    - name: user_agent
      type: group
      description: >
        Contains the parsed User agent field. Only present if the user
        agent Elasticsearch plugin is available and used.
      fields:
        - name: device
          type: keyword
          description: >
            The name of the physical device.
        - name: major
          type: long
          description: >
            The major version of the user agent.
        - name: minor
          type: long
          description: >
            The minor version of the user agent.
        - name: patch
          type: keyword
          description: >
            The patch version of the user agent.
        - name: name
          type: keyword
          example: Chrome
          description: >
            The name of the user agent.
        - name: os
          type: keyword
          description: >
            The name of the operating system.
        - name: os_major
          type: long
          description: >
            The major version of the operating system.
        - name: os_minor
          type: long
          description: >
            The minor version of the operating system.
        - name: os_name
          type: keyword
          description: >
            The name of the operating system.
    - name: geoip
      type: group
      description: >
        Contains GeoIP information gathered based on the remote_ip field.
        Only present if the GeoIP Elasticsearch plugin is available and
        used.
      fields:
        - name: continent_name
          type: keyword
          description: >
            The name of the continent.
        - name: country_iso_code
          type: keyword
          description: >
            Country ISO code.
        - name: location
          type: geo_point
          description: >
            The longitude and latitude.
        - name: region_name
          type: keyword
          description: >
            The region name.
        - name: city_name
          type: keyword
          description: >
            The city name.