beats_default_fields_allowlist.yml

# Licensed to Elasticsearch B.V. under one or more contributor
# license agreements. See the NOTICE file distributed with
# this work for additional information regarding copyright
# ownership. Elasticsearch B.V. licenses this file to you under
# the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# 	http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.
---
!!set
# Note: other fields can be inserted as needed

# ECS 1.2 fields
'@timestamp': null
agent.ephemeral_id: null
agent.id: null
agent.name: null
agent.type: null
agent.version: null
as.number: null
as.organization.name: null
client.address: null
client.as.number: null
client.as.organization.name: null
client.bytes: null
client.domain: null
client.geo.city_name: null
client.geo.continent_name: null
client.geo.country_iso_code: null
client.geo.country_name: null
client.geo.location: null
client.geo.name: null
client.geo.region_iso_code: null
client.geo.region_name: null
client.ip: null
client.mac: null
client.nat.ip: null
client.nat.port: null
client.packets: null
client.port: null
client.registered_domain: null
client.top_level_domain: null
client.user.domain: null
client.user.email: null
client.user.full_name: null
client.user.group.domain: null
client.user.group.id: null
client.user.group.name: null
client.user.hash: null
client.user.id: null
client.user.name: null
cloud.account.id: null
cloud.availability_zone: null
cloud.instance.id: null
cloud.instance.name: null
cloud.machine.type: null
cloud.provider: null
cloud.region: null
container.id: null
container.image.name: null
container.image.tag: null
container.labels: null
container.name: null
container.runtime: null
destination.address: null
destination.as.number: null
destination.as.organization.name: null
destination.bytes: null
destination.domain: null
destination.geo.city_name: null
destination.geo.continent_name: null
destination.geo.country_iso_code: null
destination.geo.country_name: null
destination.geo.location: null
destination.geo.name: null
destination.geo.region_iso_code: null
destination.geo.region_name: null
destination.ip: null
destination.mac: null
destination.nat.ip: null
destination.nat.port: null
destination.packets: null
destination.port: null
destination.registered_domain: null
destination.top_level_domain: null
destination.user.domain: null
destination.user.email: null
destination.user.full_name: null
destination.user.group.domain: null
destination.user.group.id: null
destination.user.group.name: null
destination.user.hash: null
destination.user.id: null
destination.user.name: null
dns.answers: null
dns.answers.class: null
dns.answers.data: null
dns.answers.name: null
dns.answers.ttl: null
dns.answers.type: null
dns.header_flags: null
dns.id: null
dns.op_code: null
dns.question.class: null
dns.question.name: null
dns.question.registered_domain: null
dns.question.subdomain: null
dns.question.top_level_domain: null
dns.question.type: null
dns.resolved_ip: null
dns.response_code: null
dns.type: null
ecs.version: null
error.code: null
error.id: null
error.message: null
error.stack_trace: null
error.type: null
event.action: null
event.category: null
event.code: null
event.created: null
event.dataset: null
event.duration: null
event.end: null
event.hash: null
event.id: null
event.kind: null
event.module: null
event.original: null
event.outcome: null
event.provider: null
event.risk_score: null
event.risk_score_norm: null
event.sequence: null
event.severity: null
event.start: null
event.timezone: null
event.type: null
file.accessed: null
file.created: null
file.ctime: null
file.device: null
file.directory: null
file.extension: null
file.gid: null
file.group: null
file.hash.md5: null
file.hash.sha1: null
file.hash.sha256: null
file.hash.sha512: null
file.inode: null
file.mode: null
file.mtime: null
file.name: null
file.owner: null
file.path: null
file.size: null
file.target_path: null
file.type: null
file.uid: null
geo.city_name: null
geo.continent_name: null
geo.country_iso_code: null
geo.country_name: null
geo.location: null
geo.name: null
geo.region_iso_code: null
geo.region_name: null
group.domain: null
group.id: null
group.name: null
hash.md5: null
hash.sha1: null
hash.sha256: null
hash.sha512: null
host.architecture: null
host.geo.city_name: null
host.geo.continent_name: null
host.geo.country_iso_code: null
host.geo.country_name: null
host.geo.location: null
host.geo.name: null
host.geo.region_iso_code: null
host.geo.region_name: null
host.hostname: null
host.id: null
host.ip: null
host.mac: null
host.name: null
host.os.family: null
host.os.full: null
host.os.kernel: null
host.os.name: null
host.os.platform: null
host.os.version: null
host.type: null
host.uptime: null
host.user.domain: null
host.user.email: null
host.user.full_name: null
host.user.group.domain: null
host.user.group.id: null
host.user.group.name: null
host.user.hash: null
host.user.id: null
host.user.name: null
http.request.body.bytes: null
http.request.body.content: null
http.request.bytes: null
http.request.method: null
http.request.referrer: null
http.response.body.bytes: null
http.response.body.content: null
http.response.bytes: null
http.response.status_code: null
http.version: null
labels: null
log.level: null
log.logger: null
log.origin.file.line: null
log.origin.file.name: null
log.origin.function: null
log.original: null
log.syslog: null
log.syslog.facility.code: null
log.syslog.facility.name: null
log.syslog.priority: null
log.syslog.severity.code: null
log.syslog.severity.name: null
message: null
network.application: null
network.bytes: null
network.community_id: null
network.direction: null
network.forwarded_ip: null
network.iana_number: null
network.name: null
network.packets: null
network.protocol: null
network.transport: null
network.type: null
observer.geo.city_name: null
observer.geo.continent_name: null
observer.geo.country_iso_code: null
observer.geo.country_name: null
observer.geo.location: null
observer.geo.name: null
observer.geo.region_iso_code: null
observer.geo.region_name: null
observer.hostname: null
observer.ip: null
observer.mac: null
observer.name: null
observer.os.family: null
observer.os.full: null
observer.os.kernel: null
observer.os.name: null
observer.os.platform: null
observer.os.version: null
observer.product: null
observer.serial_number: null
observer.type: null
observer.vendor: null
observer.version: null
organization.id: null
organization.name: null
os.family: null
os.full: null
os.kernel: null
os.name: null
os.platform: null
os.version: null
package.architecture: null
package.checksum: null
package.description: null
package.install_scope: null
package.installed: null
package.license: null
package.name: null
package.path: null
package.size: null
package.version: null
process.args: null
process.executable: null
process.hash.md5: null
process.hash.sha1: null
process.hash.sha256: null
process.hash.sha512: null
process.name: null
process.pgid: null
process.pid: null
process.ppid: null
process.start: null
process.thread.id: null
process.thread.name: null
process.title: null
process.uptime: null
process.working_directory: null
related.ip: null
server.address: null
server.as.number: null
server.as.organization.name: null
server.bytes: null
server.domain: null
server.geo.city_name: null
server.geo.continent_name: null
server.geo.country_iso_code: null
server.geo.country_name: null
server.geo.location: null
server.geo.name: null
server.geo.region_iso_code: null
server.geo.region_name: null
server.ip: null
server.mac: null
server.nat.ip: null
server.nat.port: null
server.packets: null
server.port: null
server.registered_domain: null
server.top_level_domain: null
server.user.domain: null
server.user.email: null
server.user.full_name: null
server.user.group.domain: null
server.user.group.id: null
server.user.group.name: null
server.user.hash: null
server.user.id: null
server.user.name: null
service.ephemeral_id: null
service.id: null
service.name: null
service.node.name: null
service.state: null
service.type: null
service.version: null
source.address: null
source.as.number: null
source.as.organization.name: null
source.bytes: null
source.domain: null
source.geo.city_name: null
source.geo.continent_name: null
source.geo.country_iso_code: null
source.geo.country_name: null
source.geo.location: null
source.geo.name: null
source.geo.region_iso_code: null
source.geo.region_name: null
source.ip: null
source.mac: null
source.nat.ip: null
source.nat.port: null
source.packets: null
source.port: null
source.registered_domain: null
source.top_level_domain: null
source.user.domain: null
source.user.email: null
source.user.full_name: null
source.user.group.domain: null
source.user.group.id: null
source.user.group.name: null
source.user.hash: null
source.user.id: null
source.user.name: null
tags: null
threat.framework: null
threat.tactic.id: null
threat.tactic.name: null
threat.tactic.reference: null
threat.technique.id: null
threat.technique.name: null
threat.technique.reference: null
trace.id: null
transaction.id: null
url.domain: null
url.extension: null
url.fragment: null
url.full: null
url.original: null
url.password: null
url.path: null
url.port: null
url.query: null
url.registered_domain: null
url.scheme: null
url.top_level_domain: null
url.username: null
user.domain: null
user.email: null
user.full_name: null
user.group.domain: null
user.group.id: null
user.group.name: null
user.hash: null
user.id: null
user.name: null
user_agent.device.name: null
user_agent.name: null
user_agent.original: null
user_agent.original.text: null
user_agent.os.family: null
user_agent.os.full: null
user_agent.os.kernel: null
user_agent.os.name: null
user_agent.os.platform: null
user_agent.os.version: null
user_agent.version: null